CLF-C02 Cloud Technology and Services Practice Question
A financial analytics company runs a mission-critical application in its on-premises data center. The application must replicate large volumes of market data to Amazon S3 in real time. The company requires a dedicated, private network connection with consistent low latency and high throughput. The connection must not traverse the public internet. Which AWS service should the company use to meet these requirements?
⚠ Common exam trap
Candidates often confuse AWS Site-to-Site VPN as a private connection because it is encrypted, but it still traverses the public internet and lacks the dedicated, low-latency characteristics of Direct Connect.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Direct Connect
AWS Direct Connect provides a dedicated, private network connection from an on-premises data center to AWS, bypassing the public internet. This ensures consistent low latency and high throughput, which is essential for replicating large volumes of market data in real time. The connection uses industry-standard 802.1Q VLANs and can be provisioned at speeds up to 100 Gbps, meeting the requirement for a private, high-performance link.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS Site-to-Site VPN
Why it's wrong here
AWS Site-to-Site VPN is incorrect here because it establishes encrypted IPsec tunnels over your existing internet connection, meaning traffic still traverses the public internet and is subject to its congestion, routing variability, and potentially high/mutable latency. While the tunnel encrypts data, it does not provide a dedicated or guaranteed bandwidth path, nor does it offer the same availability SLAs as Direct Connect. For a mission-critical, low-latency analytics workload, relying on internet transport does not meet the stated requirement of avoiding the internet entirely.
When this WOULD be correct
A company needs a secure connection to AWS over the public internet with encryption, and the requirements do not specify dedicated low latency or high throughput. For example, a small business connecting to AWS for occasional data backups would use Site-to-Site VPN.
- ✓
AWS Direct Connect
Why this is correct
AWS Direct Connect is the correct choice because it provisions a dedicated, private physical cross-connect from your on-premises data center into an AWS Direct Connect location, completely bypassing the public internet. This private circuit provides lower and more consistent latency, higher throughput (from 50 Mbps to 100 Gbps), and a stronger network SLA—critical for mission-critical analytics workloads that require predictable performance. You can create private virtual interfaces to reach your VPCs or connect through a Direct Connect Gateway to multiple VPCs, all without traversing the internet.
- ✗
Amazon VPC peering
Why it's wrong here
Amazon VPC peering is not applicable because it only connects two Amazon VPCs within the same or different AWS accounts/regions using the AWS private network, without any ability to extend beyond the AWS cloud to your on-premises data center. Peering is non-transitive, requires non-overlapping CIDR blocks, and cannot be used to connect to an external environment such as a financial analytics company's data center. Since the traffic would need to traverse an internet-adjacent or VPN connection anyway, VPC peering alone cannot satisfy the requirement for a dedicated on-premises link.
When this WOULD be correct
A company has two VPCs in the same or different AWS regions that need to communicate privately using private IP addresses, without requiring a VPN or Direct Connect. VPC peering would be the correct answer for inter-VPC connectivity within AWS.
- ✗
AWS Transit Gateway
Why it's wrong here
AWS Transit Gateway acts as a central hub for interconnecting VPCs and on-premises networks via VPN or Direct Connect, but it does not itself provide a dedicated connection to on-premises. It would still require Direct Connect to achieve the stated requirement.
When this WOULD be correct
A company has multiple VPCs and on-premises networks that need to communicate with each other, and they want to simplify network management by using a central hub. The question would specify requirements for interconnecting many networks with routing policies, not a dedicated private connection to a single on-premises site.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The CLF-C02 exam frequently reuses these exact scenarios with slightly different constraints.
✓AWS Direct ConnectCorrect answer▾
Why this is correct
AWS Direct Connect is the correct choice because it provisions a dedicated, private physical cross-connect from your on-premises data center into an AWS Direct Connect location, completely bypassing the public internet. This private circuit provides lower and more consistent latency, higher throughput (from 50 Mbps to 100 Gbps), and a stronger network SLA—critical for mission-critical analytics workloads that require predictable performance. You can create private virtual interfaces to reach your VPCs or connect through a Direct Connect Gateway to multiple VPCs, all without traversing the internet.
✗AWS Site-to-Site VPNWrong answer — click to see why▾
Why this is wrong here
AWS Site-to-Site VPN traverses the public internet and cannot guarantee consistent low latency and high throughput, nor does it provide a dedicated private connection.
★ When this WOULD be the correct answer
A company needs a secure connection to AWS over the public internet with encryption, and the requirements do not specify dedicated low latency or high throughput. For example, a small business connecting to AWS for occasional data backups would use Site-to-Site VPN.
Why candidates choose this
Candidates may think VPN provides a private connection because it uses encryption, but they overlook that it still uses the public internet and lacks the dedicated performance of Direct Connect.
✗Amazon VPC peeringWrong answer — click to see why▾
Why this is wrong here
Amazon VPC peering connects VPCs within AWS, not an on-premises data center to AWS. It does not support dedicated private connectivity from on-premises and cannot meet the requirement for a dedicated, private network connection with consistent low latency and high throughput that does not traverse the public internet.
★ When this WOULD be the correct answer
A company has two VPCs in the same or different AWS regions that need to communicate privately using private IP addresses, without requiring a VPN or Direct Connect. VPC peering would be the correct answer for inter-VPC connectivity within AWS.
Why candidates choose this
Candidates may confuse VPC peering as a general private connectivity solution, not realizing it only works between VPCs within AWS and does not extend to on-premises environments.
✗AWS Transit GatewayWrong answer — click to see why▾
Why this is wrong here
AWS Transit Gateway is a network transit hub to interconnect VPCs and on-premises networks, but it does not provide a dedicated private connection itself; it relies on VPN or Direct Connect for the actual private link. The question requires a dedicated, low-latency, high-throughput connection not traversing the public internet, which is a Direct Connect feature, not Transit Gateway.
★ When this WOULD be the correct answer
A company has multiple VPCs and on-premises networks that need to communicate with each other, and they want to simplify network management by using a central hub. The question would specify requirements for interconnecting many networks with routing policies, not a dedicated private connection to a single on-premises site.
Why candidates choose this
Candidates may confuse Transit Gateway as a direct replacement for Direct Connect because it can integrate with Direct Connect, but they overlook that Transit Gateway itself is not a physical connection; it is a routing service that requires an underlying connection like Direct Connect or VPN.
Analysis generated from the official CLF-C02blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every CLF-C02 question from scratch — 988 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.