Study guide
Technical reference and lesson notes
Purpose of This Lesson
This lesson covers two important AWS hybrid networking patterns for the AWS Certified Solutions Architect – Professional SAP-C02 exam:
- AWS VPN CloudHub, which is a hub-and-spoke VPN topology using AWS Site-to-Site VPN and a Virtual Private Gateway.
- AWS Direct Connect, which provides private physical connectivity between corporate networks and AWS.
These topics matter because SAP-C02 often tests how to design secure, resilient, cost-effective hybrid network architectures. You need to know when to use VPN, when to use Direct Connect, how routing works with BGP, how failover is handled, and how to connect multiple offices, data centers, VPCs, or AWS services.
Key Concepts
AWS VPN CloudHub
AWS VPN CloudHub is not a separate AWS service. It is a deployment topology built using multiple AWS Site-to-Site VPN connections attached to the same Virtual Private Gateway, or VGW.
The basic idea is simple:
- AWS acts as the hub.
- Each branch office or data center acts as a spoke.
- Each remote site connects to AWS using a Site-to-Site VPN.
- Routing between locations is controlled through BGP and route tables.
This is useful when an organization has multiple branch offices or data centers that need to connect to AWS and possibly communicate with each other through AWS.
Core CloudHub Components
Virtual Private Gateway
The Virtual Private Gateway, or VGW, is attached to the VPC on the AWS side.
It acts as the VPN termination point for Site-to-Site VPN connections. In a CloudHub topology, multiple customer sites connect back to the same VGW.
Customer Gateway
A Customer Gateway represents the customer-side VPN device or software appliance.
Each branch office, data center, or remote network location has its own customer gateway. This could be a physical firewall, router, SD-WAN appliance, or other VPN-capable network device.
Site-to-Site VPN
Each remote office connects to AWS using an IPsec Site-to-Site VPN.
The VPN provides encrypted connectivity over the public internet between the customer gateway and the AWS Virtual Private Gateway.
BGP and Unique ASNs
CloudHub relies heavily on BGP, or Border Gateway Protocol.
Each remote site must use a unique BGP Autonomous System Number, or ASN. This is important because AWS uses the ASN information to distinguish routes from each location.
If multiple branch offices use the same ASN incorrectly, routing behavior can become unpredictable or unsupported for the intended CloudHub design.
CloudHub Traffic Flow
CloudHub supports two main traffic patterns.
Branch Office to AWS VPC
This is the most common use case.
A remote office connects over Site-to-Site VPN to access workloads inside a VPC, such as EC2 instances, internal applications, databases, or shared services.
Branch Office to Branch Office
CloudHub can also allow traffic between customer sites.
For example:
- Branch Office A connects to AWS over VPN.
- Branch Office B connects to AWS over VPN.
- Traffic from Branch Office A can route through AWS to Branch Office B.
This depends on the routing configuration. AWS is effectively being used as a hub for inter-site connectivity.
Important CloudHub Design Point
CloudHub is controlled by routing.
Just because multiple VPNs terminate on the same VGW does not automatically mean all traffic flows everywhere. You still need the correct route propagation, route table entries, and BGP advertisements.
For the exam, remember that CloudHub is a topology using existing VPN components, not a new standalone managed networking service.
AWS Direct Connect
AWS Direct Connect, often abbreviated as DX, provides private connectivity between a customer network and AWS.
Instead of sending traffic over the public internet like a standard Site-to-Site VPN, Direct Connect uses a dedicated physical connection through an AWS Direct Connect location.
This is commonly used when organizations need:
- More predictable network performance
- Lower latency
- Higher bandwidth
- Private connectivity
- Lower data transfer costs at scale
- Hybrid connectivity for enterprise workloads
Direct Connect Physical Architecture
A Direct Connect connection involves several physical and logical pieces.
Corporate Data Center
This is the customer-owned location where the on-premises network resides.
The corporate data center has customer routing equipment that must connect to the Direct Connect location.
Direct Connect Location
A Direct Connect location is a facility where AWS networking equipment is available.
Inside the facility, there may be:
- An AWS cage containing AWS Direct Connect equipment
- A customer cage or partner cage containing customer or partner routing equipment
- A cross-connect between the customer/partner equipment and AWS equipment
Cross-Connect
The cross-connect is the physical connection between the customer or partner router and the AWS Direct Connect router inside the Direct Connect location.
AWS provides the AWS-side infrastructure from the Direct Connect location into AWS, but the customer is responsible for arranging connectivity into the DX location.
Customer or Partner Router
The customer may place their own router in the DX location, or they may work with an AWS Direct Connect Partner.
This is an important real-world decision:
- Co-locating your own equipment gives more control but adds operational overhead.
- Using a partner can simplify deployment but may involve provider-specific costs and shared service models.
Direct Connect Speeds
Direct Connect supports high-bandwidth private connectivity.
The transcript referenced speeds ranging from 1 Gbps up to 400 Gbps, but this is an area where AWS capabilities can change over time. For real project work or exam prep, always verify the current AWS Direct Connect speed options in the AWS documentation.
For SAP-C02, the more important concept is that Direct Connect is intended for predictable, private, high-throughput hybrid connectivity, especially when compared to standard internet-based VPN connectivity.
Benefits of Direct Connect
Direct Connect provides several advantages over internet-based connectivity.
Consistent Network Experience
Because traffic does not traverse the public internet in the same way, Direct Connect can provide more consistent latency, bandwidth, and throughput.
This matters for workloads such as:
- Large-scale data migration
- Hybrid databases
- Backup and disaster recovery
- Analytics pipelines
- Enterprise applications with predictable latency requirements
Private Connectivity
Direct Connect gives private connectivity between the customer environment and AWS.
However, private connectivity does not automatically mean encryption. Direct Connect is not encrypted by default.
Potential Cost Savings
For organizations transferring large volumes of data, Direct Connect can sometimes reduce data transfer costs compared to moving large amounts of data over standard internet paths.
This is not automatic. You must compare:
- Direct Connect port charges
- Partner charges
- Cross-connect fees
- Data transfer volume
- Existing internet service costs
- Redundancy requirements
Direct Connect Virtual Interfaces
A Direct Connect physical connection is not enough by itself. You also need one or more Virtual Interfaces, or VIFs.
A VIF is a logical interface over the Direct Connect connection. It uses:
- 802.1Q VLAN tagging
- BGP routing
- AWS-side and customer-side router configuration
There are three major VIF types to understand.
Private Virtual Interface
A Private VIF is used to connect to private resources in a VPC using private IP addresses.
In the basic model, a private VIF connects to a VPC through a Virtual Private Gateway.
Use a private VIF when you need private connectivity from an on-premises network to VPC resources such as:
- EC2 instances
- Private application servers
- Internal load balancers
- Private databases
- Shared services inside the VPC
Public Virtual Interface
A Public VIF is used to connect to AWS public service endpoints using public IP addressing.
This can include services such as:
- Amazon S3
- Amazon DynamoDB
- Public AWS service endpoints
- Amazon CloudFront-related AWS public prefixes
A key exam point: a public VIF is for AWS public services, not general internet access. You do not use a public VIF as an internet egress path.
Another important exam point: when building an IPsec VPN over Direct Connect, the VPN runs over a public VIF, not a private VIF.
Transit Virtual Interface
A Transit VIF is used to connect Direct Connect to one or more Transit Gateways through a Direct Connect Gateway.
This is important for larger enterprise architectures where many VPCs, accounts, or regions need centralized connectivity.
Use a transit VIF when the design involves:
- AWS Transit Gateway
- Multiple VPCs
- Centralized hybrid routing
- Scalable multi-account network architecture
- Direct Connect Gateway integration
Multiple VPCs and Direct Connect
There are several ways to connect Direct Connect to multiple VPCs.
Multiple Private VIFs
You can use multiple private VIFs to connect to multiple VPCs. Each VPC would typically have its own Virtual Private Gateway.
This can work for smaller environments, but it becomes harder to manage as the number of VPCs grows.
Transit Gateway with Transit VIF
For larger environments, a transit VIF with Transit Gateway is often the better pattern.
This centralizes routing and avoids having to manage many individual private VIFs.
Hosted VIFs and Hosted Connections
Direct Connect can also be delivered through partners.
A Hosted VIF is a virtual interface provisioned through a partner model.
A Hosted Connection is a Direct Connect connection delivered by a partner, with a dedicated connection capacity for the customer.
The key exam concept is that AWS Direct Connect Partners can provide access when the customer does not want to deploy their own equipment in a Direct Connect location.
Direct Connect Encryption
Direct Connect is private, but it is not encrypted by default.
There are two major encryption options discussed in this lesson:
- MACsec
- IPsec VPN over Direct Connect
MACsec Encryption
MACsec provides Layer 2 encryption for supported Direct Connect connections.
It protects traffic between the customer router or switch and the AWS Direct Connect device.
Important MACsec points:
- It operates at Layer 2.
- It provides encryption near line rate.
- It has minimal performance impact.
- It protects only part of the path.
- It does not provide end-to-end encryption all the way to the workload.
The transcript described MACsec as encrypting the link from the customer router or switch to the AWS Direct Connect device. After that point, traffic should be considered unencrypted unless another encryption method is used.
For SAP-C02, MACsec is useful when you need high-throughput encryption on supported Direct Connect links without the overhead or bandwidth limits of VPN.
IPsec VPN over Direct Connect
Another option is to run an IPsec Site-to-Site VPN over Direct Connect.
This encrypts traffic from the customer network to the AWS Virtual Private Gateway.
Important exam point:
The IPsec VPN is established over a public VIF.
This can be confusing because the goal may be to reach private VPC resources, but the VPN tunnel itself terminates using AWS public IP endpoints over the public VIF.
Use IPsec VPN over Direct Connect when:
- Direct Connect traffic must be encrypted.
- MACsec is not available or not sufficient.
- The organization wants encryption up to the VGW.
- The architecture can tolerate VPN throughput and operational limits.
Direct Connect High Availability
A single Direct Connect connection can contain several single points of failure.
Potential failure points include:
- Customer router
- Partner router
- AWS router
- Cross-connect
- DX location
- Corporate data center
- Physical cable path
AWS Direct Connect locations have redundancy, but that does not eliminate all customer-side or facility-level risks.
Redundant Direct Connect Connections
A more resilient design uses redundant connections.
For example, you might deploy:
- Multiple customer routers
- Multiple Direct Connect routers
- Multiple cross-connects
- Multiple physical Direct Connect connections
This improves resilience, but it may still leave some shared risks if everything is in the same data center or Direct Connect location.
Multiple Data Centers and Multiple DX Locations
For stronger resiliency, use multiple corporate data centers and multiple Direct Connect locations.
This reduces dependency on:
- One customer facility
- One DX location
- One fiber path
- One set of routers
This is more expensive but may be justified for mission-critical workloads.
VPN Backup for Direct Connect
Another common pattern is to use Direct Connect as the primary path and Site-to-Site VPN as the backup path.
In this design:
- Direct Connect is the preferred active path.
- Site-to-Site VPN provides backup connectivity over the internet.
- Both connections terminate on the same Virtual Private Gateway.
This is often less expensive than deploying multiple Direct Connect links, but it may not provide the same performance during failover.
The transcript specifically notes that VPN backup is not recommended for speeds above 1 Gbps due to VPN limitations.
Routing Preference with Direct Connect and VPN
When Direct Connect and VPN advertise the same prefixes to a Virtual Private Gateway, AWS prefers routes in this order:
- BGP propagated routes from AWS Direct Connect
- Manually added static routes for Site-to-Site VPN
- BGP propagated routes from Site-to-Site VPN
For matching BGP VPN routes, AWS then evaluates BGP attributes such as:
- Shortest AS path
- Lowest MED value, when applicable
This is a major SAP-C02 exam area. If a scenario asks why Direct Connect is preferred over VPN when both advertise the same prefix, the answer is AWS route preference.
Direct Connect Router Requirements
Customer routers must meet specific technical requirements for Direct Connect.
Key requirements include:
- BGP support
- BGP MD5 authentication
- 802.1Q VLAN support
- Single-mode fiber
- Compatible optical transceivers
- Correct transceiver type for the port speed
- ASN for BGP peering
For private ASNs, the transcript referenced the range 64512 to 65535.
For public VIFs, the customer must own and advertise the public IP prefixes they intend to use.
Bidirectional Forwarding Detection
Bidirectional Forwarding Detection, or BFD, is used for faster failure detection.
Without BFD, BGP failover may wait for keepalives and hold timers, which can take longer.
The transcript notes that:
- BFD is optional but recommended.
- AWS automatically enables asynchronous BFD on the virtual interface side.
- The customer configures BFD on the router.
- AWS default BFD minimum interval is 300 milliseconds.
- AWS default BFD multiplier is 3.
The exam may not focus deeply on the exact timers, but the design concept is important: BFD improves convergence during network failure events.
Exam-Relevant Takeaways
For SAP-C02, focus on service selection, routing behavior, encryption, and resiliency.
CloudHub Takeaways
- AWS VPN CloudHub is a topology, not a standalone service.
- It uses multiple Site-to-Site VPN connections attached to a Virtual Private Gateway.
- Each remote site uses a customer gateway.
- Each remote site must use a unique BGP ASN.
- CloudHub supports branch-to-VPC traffic and branch-to-branch routing through AWS.
- Route tables and BGP control what traffic is allowed to flow.
Direct Connect Takeaways
- Direct Connect provides private physical connectivity to AWS through a Direct Connect location.
- Direct Connect is useful for predictable latency, high bandwidth, and large data transfer patterns.
- Direct Connect is not encrypted by default.
- Private VIFs are used for private VPC access.
- Public VIFs are used for AWS public services and for IPsec VPN over Direct Connect.
- Transit VIFs are used with Direct Connect Gateway and Transit Gateway.
- MACsec provides Layer 2 encryption for supported DX links but is not end-to-end.
- IPsec VPN over Direct Connect provides encryption to the VGW and uses a public VIF.
- Direct Connect is preferred over VPN when both advertise the same prefix.
- VPN can be used as a lower-cost backup path for Direct Connect.
- Multiple DX locations and multiple data centers provide stronger resiliency than redundant equipment in a single location.
Architecture Decision Guide
| Scenario | Best AWS Choice | Why |
|---|---|---|
| Multiple branch offices need VPN connectivity to one AWS VPC | AWS VPN CloudHub | Uses multiple Site-to-Site VPNs connected to the same VGW in a hub-and-spoke model |
| Branch offices need to communicate with each other through AWS | AWS VPN CloudHub with proper routing | AWS can act as the hub between customer sites if routes allow it |
| A company needs predictable low-latency private connectivity to AWS | AWS Direct Connect | Provides private physical connectivity instead of relying on the public internet |
| A company needs encrypted internet-based connectivity to AWS quickly | AWS Site-to-Site VPN | Faster and usually cheaper to deploy than Direct Connect |
| A company needs private connectivity to resources inside a VPC | Direct Connect Private VIF | Private VIF connects to VPC resources using private IPs |
| A company needs access to AWS public services such as S3 over Direct Connect | Direct Connect Public VIF | Public VIF reaches AWS public endpoints, not general internet destinations |
| A company wants to run IPsec VPN over Direct Connect | Public VIF plus Site-to-Site VPN | The VPN is established over a public VIF to AWS VPN endpoints |
| A company has many VPCs and wants scalable centralized hybrid connectivity | Transit VIF with Direct Connect Gateway and Transit Gateway | Better suited for multi-VPC and multi-account network architectures |
| A company needs encryption on Direct Connect with minimal performance impact | MACsec | Provides Layer 2 encryption near line rate on supported DX links |
| A company needs encryption up to the VGW over Direct Connect | IPsec VPN over Direct Connect | Encrypts traffic through VPN tunnel terminating at the VGW |
| Direct Connect should be primary, with lower-cost backup | Direct Connect plus Site-to-Site VPN backup | DX is preferred route; VPN provides failover path |
| Mission-critical workloads cannot depend on one DX location | Multiple DX locations and multiple data centers | Reduces facility, router, and path failure risk |
Common Exam Traps
Trap 1: Thinking CloudHub Is a Separate AWS Service
CloudHub is a topology using Site-to-Site VPN, customer gateways, BGP, and a Virtual Private Gateway.
It is not a separate service like Transit Gateway.
Trap 2: Reusing the Same ASN for Multiple CloudHub Sites
Each remote site in a CloudHub design must use a unique BGP ASN.
If the question emphasizes multiple customer offices using BGP, watch for ASN uniqueness.
Trap 3: Assuming Direct Connect Is Encrypted by Default
Direct Connect is private, but not encrypted by default.
For encryption, consider MACsec or IPsec VPN over Direct Connect.
Trap 4: Choosing a Private VIF for IPsec VPN over Direct Connect
IPsec VPN over Direct Connect uses a public VIF, not a private VIF.
This is one of the most important exam details from this topic.
Trap 5: Treating a Public VIF as Internet Access
A public VIF provides access to AWS public service endpoints.
It does not provide general internet routing.
Trap 6: Assuming One Direct Connect Connection Is Highly Available
A single DX connection still has multiple possible failure points.
For high availability, design with redundant routers, cross-connects, DX connections, DX locations, and possibly multiple data centers.
Trap 7: Ignoring Route Preference Between DX and VPN
When the same prefix is advertised over both Direct Connect and VPN, Direct Connect BGP routes are preferred.
This explains why DX is commonly the primary path and VPN is the backup path.
Trap 8: Using VPN Backup for Very High Bandwidth Requirements
VPN backup can be cost-effective, but it may not be suitable for high-bandwidth workloads, especially above 1 Gbps.
Trap 9: Thinking MACsec Is End-to-End Encryption
MACsec encrypts the Layer 2 link between the customer device and the AWS Direct Connect device.
It does not encrypt traffic all the way to the EC2 instance, database, or application endpoint.
Real-World Engineer Notes
CloudHub in Real Environments
CloudHub is useful for smaller or simpler branch-office designs where multiple sites need to connect to AWS without deploying a more complex WAN architecture.
However, in larger enterprises, CloudHub may be less scalable than Transit Gateway-based designs.
Operationally, you need to manage:
- Customer gateway configuration
- BGP ASN planning
- Route propagation
- VPN tunnel health
- Branch-to-branch routing policy
- Overlapping CIDR avoidance
- Firewall rules between sites
- Monitoring and alerting for tunnel failures
In the real world, the biggest challenge is often not creating the VPNs. It is maintaining clean routing and avoiding accidental transitive connectivity between locations that should remain isolated.
Direct Connect in Real Environments
Direct Connect is usually selected when the business needs predictable network behavior.
Common real-world use cases include:
- Data center extension into AWS
- VMware or server migration projects
- Large backup and replication jobs
- Hybrid Active Directory and identity services
- Low-latency application dependencies
- Data lake ingestion
- Enterprise shared services
But Direct Connect is not just an AWS configuration task. It often requires coordination between:
- Network engineering
- Cloud engineering
- Telecom providers
- Data center providers
- Security teams
- Change management
- AWS or Direct Connect Partners
Provisioning can take time because physical connectivity, cross-connects, LOAs, router configuration, and partner coordination may all be involved.
Resiliency Planning
For production workloads, a single Direct Connect link should be treated as a risk.
A stronger design may include:
- Two routers on the customer side
- Two DX connections
- Two DX locations
- Two corporate data centers
- VPN backup
- BFD for faster failure detection
- BGP route policies for deterministic failover
The right answer depends on business impact. Not every workload justifies multiple DX locations, but critical workloads often do.
Cost Considerations
Direct Connect can reduce cost for heavy data transfer workloads, but it also introduces fixed costs.
Real cost analysis should include:
- Port charges
- Partner charges
- Cross-connect fees
- Data transfer charges
- Router costs
- Colocation costs
- Operational support
- Redundant connection costs
A VPN may be cheaper and faster for smaller environments, but DX may become attractive as traffic volume and performance requirements grow.
Security Considerations
Do not confuse private connectivity with encrypted connectivity.
Security teams may require encryption for traffic crossing Direct Connect. In that case:
- Use MACsec when supported and when Layer 2 link encryption is acceptable.
- Use IPsec VPN over Direct Connect when encryption to the VGW is required.
- Use application-layer encryption where end-to-end protection is needed.
Also remember that routing design is security design. If branch-to-branch traffic is allowed through CloudHub, make sure that is intentional and governed.
Quick Reference Summary
- AWS VPN CloudHub is a hub-and-spoke VPN topology using Site-to-Site VPN and a Virtual Private Gateway.
- CloudHub is not a separate service.
- Each branch office or data center uses a Customer Gateway.
- Each CloudHub site must use a unique BGP ASN.
- CloudHub can route traffic between branch offices through AWS if routing allows it.
- Direct Connect provides private physical connectivity from on-premises networks to AWS.
- Direct Connect uses a DX location, customer or partner equipment, and a cross-connect to AWS equipment.
- Direct Connect improves network consistency, bandwidth, latency, and potentially cost at scale.
- Direct Connect is not encrypted by default.
- Private VIF = private VPC access.
- Public VIF = AWS public services and IPsec VPN over Direct Connect.
- Transit VIF = Transit Gateway connectivity through Direct Connect Gateway.
- MACsec encrypts the Layer 2 DX link but is not end-to-end.
- IPsec VPN over DX uses a public VIF and encrypts to the VGW.
- Direct Connect BGP routes are preferred over VPN routes when the same prefix is advertised.
- VPN backup is cheaper than redundant DX but has performance limits.
- Strong DX resiliency requires multiple connections, locations, routers, and possibly data centers.
Flashcards
Q: What is AWS VPN CloudHub?
A: A hub-and-spoke VPN topology that uses multiple AWS Site-to-Site VPN connections attached to a Virtual Private Gateway.
Q: Is CloudHub a standalone AWS service?
A: No. It is a deployment topology using Site-to-Site VPN, VGW, customer gateways, routing, and BGP.
Q: What AWS-side component acts as the hub in a CloudHub design?
A: The Virtual Private Gateway attached to the VPC.
Q: What must be unique for each remote site in a CloudHub BGP design?
A: Each remote site must use a unique BGP ASN.
Q: Can CloudHub support branch-to-branch communication?
A: Yes, if routing is configured to allow traffic between customer sites through AWS.
Q: What is AWS Direct Connect used for?
A: Private physical connectivity between a customer network and AWS for consistent performance, lower latency, higher bandwidth, and potential cost savings at scale.
Q: Is Direct Connect encrypted by default?
A: No. Direct Connect is private but not encrypted by default.
Q: Which Direct Connect VIF is used to access private resources in a VPC?
A: A private virtual interface.
Q: Which Direct Connect VIF is used to access AWS public service endpoints?
A: A public virtual interface.
Q: Which VIF is used with Direct Connect Gateway and Transit Gateway?
A: A transit virtual interface.
Q: Which VIF is used for IPsec VPN over Direct Connect?
A: A public virtual interface.
Q: What does MACsec protect in a Direct Connect architecture?
A: The Layer 2 link between the customer router or switch and the AWS Direct Connect device.
Q: When both Direct Connect and VPN advertise the same prefix, which route is preferred?
A: BGP propagated routes from AWS Direct Connect are preferred.
Q: What is BFD used for in Direct Connect designs?
A: Faster failure detection and quicker network reconvergence.
Q: Why might an organization use VPN backup with Direct Connect?
A: To provide a lower-cost backup path if the Direct Connect connection fails.
Practice Questions
Question 1:
A company has three branch offices that need encrypted connectivity to resources in a single AWS VPC. The company also wants the branch offices to be able to communicate with each other through AWS. Each branch has its own customer gateway device and uses BGP. Which design is most appropriate?
A. Create one Client VPN endpoint and connect all branch offices to it
B. Use AWS VPN CloudHub with multiple Site-to-Site VPN connections attached to the same VGW
C. Create a public VIF for each branch office
D. Use VPC peering between each branch office and the VPC
Correct Answer:
B
Explanation:
AWS VPN CloudHub is designed for multiple customer sites connecting to a VPC through Site-to-Site VPN connections in a hub-and-spoke topology. It can also support branch-to-branch communication through AWS when routing is configured correctly.
Question 2:
A company uses AWS Direct Connect as its primary connection to a VPC and also has a Site-to-Site VPN backup. Both connections advertise the same on-premises prefix to the Virtual Private Gateway. Which path will AWS prefer?
A. Site-to-Site VPN because it is encrypted
B. Direct Connect because BGP propagated DX routes are preferred
C. The route with the highest MED value
D. The route with the longest AS path
Correct Answer:
B
Explanation:
When the same prefix is advertised, AWS prefers BGP propagated routes from Direct Connect over manually added static VPN routes and BGP propagated VPN routes.
Question 3:
A company wants to encrypt traffic over AWS Direct Connect and terminate encryption at the Virtual Private Gateway. Which design should be used?
A. MACsec over a private VIF
B. IPsec Site-to-Site VPN over a public VIF
C. Public VIF directly to the VPC route table
D. Private VIF with no additional encryption
Correct Answer:
B
Explanation:
IPsec VPN over Direct Connect uses a public VIF and terminates at the Virtual Private Gateway. This provides encryption over the Direct Connect path up to the VGW.
Question 4:
A company needs to connect an on-premises data center to many VPCs through a centralized AWS network architecture using AWS Transit Gateway. Which Direct Connect virtual interface type is most appropriate?
A. Private VIF
B. Public VIF
C. Transit VIF
D. Hosted VIF only
Correct Answer:
C
Explanation:
A transit VIF is used to connect Direct Connect to Transit Gateway through a Direct Connect Gateway. This is the scalable pattern for centralized hybrid connectivity across multiple VPCs.
Question 5:
A company is designing Direct Connect for a mission-critical workload. The initial design uses one customer router, one cross-connect, one DX location, and one corporate data center. What is the main issue with this design?
A. Direct Connect cannot use BGP
B. Direct Connect cannot connect to private VPC resources
C. The design contains multiple single points of failure
D. Direct Connect requires CloudHub
Correct Answer:
C
Explanation:
A single Direct Connect architecture can fail at several points, including the customer router, cross-connect, AWS router, DX location, or corporate data center. High availability requires redundant equipment, connections, locations, or backup VPN paths depending on business requirements.