Designing High Availability with AWS Direct Connect
A company is designing a hybrid network using AWS Direct Connect. They need to ensure high availability and failover. Which THREE components should be deployed to meet these requirements?
Quick Answer
The answer is two AWS Direct Connect connections, two Customer Gateways, and two Virtual Private Gateways. This trio eliminates all single points of failure by creating redundant physical paths and redundant termination points on both sides of the hybrid link. On your side, a pair of Customer Gateways ensures that if one on-premises router fails, traffic can still flow through the other. On the AWS side, two Virtual Private Gateways provide failover for the logical termination of the Direct Connect virtual interfaces. For the ANS-C01 exam, this question tests your grasp of the “no single point of failure” principle in hybrid networking—a common trap is assuming a single VPN backup suffices, but the question specifically asks for Direct Connect components, not a VPN. Remember the memory tip: “Two of everything on both ends”—two connections, two on-prem gateways, two cloud gateways—to guarantee true high availability.
⚠ Common exam trap
Watch out — candidates often think a single Direct Connect connection with a VPN backup (option E) is sufficient for high availability, but the exam expects you to recognize that true high availability requires redundant physical connections and redundant BGP termination points (two VGWs and two CGWs) to avoid any single point of failure in the network path.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Two Customer Gateways (CGWs).
To achieve high availability and failover with AWS Direct Connect, you need at least two Direct Connect connections (option D) to provide physical diversity and eliminate single points of failure. Additionally, you must deploy two Virtual Private Gateways (VGWs) (option C) to attach to separate Direct Connect Virtual Interfaces (VIFs) and enable active/active or active/passive routing. Finally, two Customer Gateways (CGWs) (option B) are required to terminate the BGP sessions from each Direct Connect connection, ensuring that if one CGW or connection fails, the other can take over traffic forwarding.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A single AWS Direct Connect connection.
Why it's wrong here
A single Direct Connect connection creates a single point of failure; if the physical link, router, or provider edge fails, the entire hybrid network loses connectivity, violating the high-availability requirement. This option is tempting because a single connection is the simplest, lowest-cost deployment for a non-critical workload where occasional downtime is acceptable, and it would be correct if the scenario demanded only basic private connectivity without any failover capability.
- ✓
Two Customer Gateways (CGWs).
Why this is correct
Two CGWs provide on-premises redundancy.
- ✓
Two Virtual Private Gateways (VGWs).
Why this is correct
Two VGWs provide AWS-side redundancy.
- ✓
Two AWS Direct Connect connections.
Why this is correct
Two connections provide physical redundancy.
- ✗
An AWS Site-to-Site VPN connection as backup.
Why it's wrong here
VPN is not required; Direct Connect with redundant connections provides failover.
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on ANS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company is designing a hybrid network using AWS Direct Connect. They want to ensure high availability and minimize downtime. Which TWO actions should they take?
medium- ✓ A.Set up a site-to-site VPN as a backup for the Direct Connect connection
- B.Use a single customer router for both connections
- C.Provision a single Direct Connect connection with two virtual interfaces
- ✓ D.Provision Direct Connect connections at two different Direct Connect locations
- E.Use the same BGP ASN on both Direct Connect connections
Why A: A site-to-site VPN provides a cost-effective, encrypted backup path over the internet if the Direct Connect connection fails. This ensures high availability by maintaining connectivity through an alternate path, which is a best practice for hybrid network designs.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.