CLF-C02 Cloud Technology and Services Practice Question
A company runs a latency-sensitive application on AWS that must communicate with an on-premises data center. The company requires a dedicated, private network connection that provides consistent, low-latency performance and bypasses the public internet. Which AWS service should the company use to meet these requirements?
⚠ Common exam trap
Candidates often confuse AWS Site-to-Site VPN (which also provides a private tunnel) with a dedicated connection, overlooking that VPNs still traverse the public internet and cannot guarantee consistent low latency, whereas Direct Connect offers a physically private path.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Direct Connect
AWS Direct Connect is the correct choice because it provides a dedicated, private network connection from an on-premises data center to AWS, bypassing the public internet entirely. This ensures consistent, low-latency performance for latency-sensitive applications by using a physical cross-connect or hosted virtual interface, which avoids the variability and potential congestion of internet-based connections.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
AWS Direct Connect
Why this is correct
AWS Direct Connect is the correct choice because it provides a dedicated, private network connection from your on-premises data center directly to AWS, bypassing the public internet entirely. This results in consistent, low-latency performance with a service-level agreement (SLA) on availability, making it ideal for latency-sensitive applications. Traffic traverses the AWS global network, avoiding internet congestion and reducing packet loss, jitter, and variable delay.
- ✗
AWS Site-to-Site VPN
Why it's wrong here
AWS Site-to-Site VPN is incorrect because although it creates an encrypted tunnel between your data center and AWS, it operates over the public internet via IPsec. This means your traffic shares bandwidth with other internet traffic, leading to variable latency, jitter, and potential throughput bottlenecks that cannot meet strict low-latency requirements. Furthermore, Site-to-Site VPN does not provide a dedicated connection or bandwidth guarantees, and its performance is subject to internet conditions, unlike the predictable path offered by AWS Direct Connect.
When this WOULD be correct
A company needs a secure, encrypted connection between its VPC and on-premises network but can tolerate variable internet performance and does not require dedicated bandwidth. The question would emphasize cost-effectiveness and ease of setup over latency guarantees.
- ✗
AWS Client VPN
Why it's wrong here
Incorrect. AWS Client VPN is a managed remote access VPN service for individual users to connect to AWS or on-premises networks. It is not designed for site-to-site data center connections and uses the public internet.
When this WOULD be correct
A company needs to provide secure remote access for individual employees to access resources in an AWS VPC from their home or remote locations. The employees use client software to connect, and the company requires user-based authentication and encryption over the internet.
- ✗
AWS Transit Gateway
Why it's wrong here
Incorrect. AWS Transit Gateway is a network transit hub that simplifies connecting multiple VPCs and on-premises networks, but it does not itself provide the physical connectivity. It works with Direct Connect or VPN attachments to route traffic.
When this WOULD be correct
A company has multiple VPCs and on-premises networks that need to be interconnected with centralized routing and management. The question asks for a service that simplifies network architecture by acting as a hub for transitive routing between many networks, without specifying the need for a dedicated physical connection.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The CLF-C02 exam frequently reuses these exact scenarios with slightly different constraints.
✓AWS Direct ConnectCorrect answer▾
Why this is correct
AWS Direct Connect is the correct choice because it provides a dedicated, private network connection from your on-premises data center directly to AWS, bypassing the public internet entirely. This results in consistent, low-latency performance with a service-level agreement (SLA) on availability, making it ideal for latency-sensitive applications. Traffic traverses the AWS global network, avoiding internet congestion and reducing packet loss, jitter, and variable delay.
✗AWS Site-to-Site VPNWrong answer — click to see why▾
Why this is wrong here
AWS Site-to-Site VPN uses the public internet to establish encrypted tunnels, which cannot guarantee the consistent, low-latency performance required by a latency-sensitive application, and does not bypass the public internet.
★ When this WOULD be the correct answer
A company needs a secure, encrypted connection between its VPC and on-premises network but can tolerate variable internet performance and does not require dedicated bandwidth. The question would emphasize cost-effectiveness and ease of setup over latency guarantees.
Why candidates choose this
Candidates may confuse Site-to-Site VPN as a private connection because it is encrypted, overlooking that it still traverses the public internet and cannot provide the dedicated, low-latency performance of Direct Connect.
✗AWS Client VPNWrong answer — click to see why▾
Why this is wrong here
AWS Client VPN is a managed remote access VPN service that connects individual users to AWS or on-premises networks over the public internet, not a dedicated private connection between a VPC and a data center. It does not provide consistent low-latency performance or bypass the public internet as required.
★ When this WOULD be the correct answer
A company needs to provide secure remote access for individual employees to access resources in an AWS VPC from their home or remote locations. The employees use client software to connect, and the company requires user-based authentication and encryption over the internet.
Why candidates choose this
Candidates may confuse 'Client VPN' with a site-to-site VPN solution or think it can be used for dedicated connectivity, overlooking that it is designed for individual user access rather than network-to-network private connections.
✗AWS Transit GatewayWrong answer — click to see why▾
Why this is wrong here
AWS Transit Gateway is a network transit hub that connects VPCs and on-premises networks, but it does not provide a dedicated, private physical connection itself; it relies on VPN or Direct Connect for the actual link. The question specifically requires a dedicated, private network connection bypassing the public internet, which is a feature of AWS Direct Connect, not Transit Gateway.
★ When this WOULD be the correct answer
A company has multiple VPCs and on-premises networks that need to be interconnected with centralized routing and management. The question asks for a service that simplifies network architecture by acting as a hub for transitive routing between many networks, without specifying the need for a dedicated physical connection.
Why candidates choose this
Candidates may confuse Transit Gateway as a direct replacement for Direct Connect because it can integrate with Direct Connect and VPNs, and they might think it provides the dedicated connection itself rather than being a routing service that requires an underlying connection.
Analysis generated from the official CLF-C02blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
About these practice questions
Courseiva writes every CLF-C02 question from scratch — 988 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.