Your company decides to use Amazon S3 to augment its on-premises data store. Instead of using the company's highly controlled, on-premises Internet gateway, a Direct Connect connection is ordered to provide high bandwidth, low latency access to S3. Since the company does not own a publically routable IPv4 address block, a request was made to AWS for an AWS-owned address for a Public Virtual Interface (VIF).
The security team is calling this new connection a "backdoor", and you have been asked to clarify the risk to the company. Which concern from the security team is valid and should be addressed?

Question

Your company decides to use Amazon S3 to augment its on-premises data store. Instead of using the company's highly controlled, on-premises Internet gateway, a Direct Connect connection is ordered to provide high bandwidth, low latency access to S3. Since the company does not own a publically routable IPv4 address block, a request was made to AWS for an AWS-owned address for a Public Virtual Interface (VIF).

The security team is calling this new connection a "backdoor", and you have been asked to clarify the risk to the company. Which concern from the security team is valid and should be addressed?

David Looby · Accepted Answer

AWS advertises its aggregate routes to the Internet allowing anyone on the Internet to reach the router.

David Looby · Answer

Direct Connect customers with a Public VIF in the same region could directly reach the router.

David Looby · Answer

EC2 instances in the same region with access to the Internet could directly reach the router.

David Looby · Answer

The S3 service could reach the router through a pre-configured VPC Endpoint.

Question list

List of questions

Question 1

(1)

Question 2

(0)

Question 3

(0)

Question 4

(0)

Question 5

(0)

Question 6

(0)

Question 7

(0)

Question 8

(0)

Question 9

(0)

Question 10

(0)

Related questions

Question 150 - ANS-C00 discussion

Suggested answer: A

0 comments