Question 1

Explanation

Correct option:

Third-party software VPN solution deployed from the AWS Marketplace

Amazon VPC provides network routing flexibility. This includes the ability to create secure VPN tunnels between two or more software VPN appliances to connect multiple VPCs into a larger virtual private network so that instances in each VPC can seamlessly connect using private IP addresses. This option is recommended when you want to manage both ends of the VPN connection using your preferred VPN software provider. This option uses an internet gateway attached to each VPC to facilitate communication between the software VPN appliances.

For the given use case, you need to select a third-party software VPN solution that meets all the requirements.

via - https://docs.aws.amazon.com/whitepapers/latest/aws-vpc-connectivity-options/appendix-a-high-level-ha-architecture-for-software-vpn-instances.html

Incorrect options:

AWS Site-to-Site VPN between the virtual private gateway and customer gateway - AWS Site-to-Site VPN does not support user access via SSL VPN. You need to use Client VPN to support user access via SSL. In addition, Site-to-Site VPN does not support rotating keys and passwords.

AWS Site-to-Site VPN between the virtual private gateways in the two AWS Regions - A Site-to-Site VPN connection offers two VPN tunnels between a virtual private gateway or a transit gateway on the AWS side, and a customer gateway (which represents a VPN device) on the remote (on-premises) side. So this option is incorrect.

AWS Client VPN between the virtual private gateways in the two AWS Regions - AWS Client VPN is a fully managed service that provides customers with the ability to securely access AWS and on-premises resources from any location using OpenVPN based clients. Connectivity from remote end-users to AWS and on-premises resources can be facilitated by this highly available, scalable, and pay-as-you-go service. AWS Client VPN supports both certificate-based and Active Directory based authentication. Customers get tighter security controls because they can define access control rules based on Active Directory groups and can use security groups to limit access of AWS Client VPN users. You cannot configure Client VPN between virtual private gateways.

References:

https://docs.aws.amazon.com/whitepapers/latest/aws-vpc-connectivity-options/software-site-to-site-vpn-1.html

https://docs.aws.amazon.com/whitepapers/latest/aws-vpc-connectivity-options/appendix-a-high-level-ha-architecture-for-software-vpn-instances.html

https://aws.amazon.com/blogs/networking-and-content-delivery/introducing-aws-client-vpn-to-securely-access-aws-and-on-premises-resources/

https://docs.aws.amazon.com/vpn/latest/s2svpn/VPC_VPN.html