An organization's internal security team mandated that public cloud resources must be accessible only by a corporate VPN and not by direct public internet access. Which of the following would achieve this objective?

A Virtual Private Cloud (VPC) provides a logically isolated section of a public cloud, allowing an organization to define and control its own virtual network. To meet the requirement, an administrator can configure the VPC without a direct connection to the public internet (e.g., by not attaching an Internet Gateway). Instead, a VPN Gateway can be configured on the VPC to establish a secure, private connection to the corporate network. This architecture ensures that all traffic to and from the cloud resources must traverse the corporate VPN, effectively blocking direct public internet access and fulfilling the security mandate.

A. WAF: A Web Application Firewall (WAF) operates at the application layer to protect web services, but it does not provide the fundamental network-level isolation required.
B. ACL: An Access Control List (ACL) is a set of rules that filters traffic at the subnet or resource level; it is a component used within a VPC, not the overarching isolation solution itself.
D. SSH: Secure Shell (SSH) is a protocol used for secure administrative access to a specific server; it does not create or manage the isolated network environment.

1. Amazon Web Services (AWS) Documentation. "A virtual private cloud (VPC) is a virtual network dedicated to your AWS account. It is logically isolated from other virtual networks in the AWS Cloud... You can connect your VPC to your on-premises data center by using AWS Site-to-Site VPN."

Source: AWS VPC User Guide

"What is Amazon VPC?". Retrieved from https://docs.aws.amazon.com/vpc/latest/userguide/what-is-amazon-vpc.html

2. Microsoft Azure Documentation. "Azure Virtual Network (VNet) is the fundamental building block for your private network in Azure... You can connect on-premises networks to virtual networks using... Site-to-site virtual private network (VPN) gateway."

Source: Microsoft Learn

"What is Azure Virtual Network?". Retrieved from https://learn.microsoft.com/en-us/azure/virtual-network/virtual-networks-overview

3. University of California

Berkeley Courseware. Lecture slides on Cloud Computing describe a VPC as a "Logically isolated network for customer" and a VPN Gateway as the component that "Connects VPC to customer’s on-premise network."

Source: Patterson

D. & Kubiatowicz

R. (2019). CS 162: Operating Systems and System Programming

Lecture 23: Cloud Computing. University of California

Berkeley

Slide 35. Retrieved from https://inst.eecs.berkeley.edu/~cs162/fa19/static/lectures/23-Cloud.pdf