ANS-C01 Site-to-Site VPN Practice Question
A company wants to securely connect an on-premises data center to a VPC using AWS Site-to-Site VPN. The security team requires that all traffic between the on-premises network and the VPC be encrypted and that the VPN tunnel be highly available. Which design BEST meets these requirements?
⚠ Common exam trap
Candidates may think that high availability requires multiple virtual private gateways, but AWS only allows one virtual private gateway per VPC. The correct approach is to use two tunnels to the same virtual private gateway for redundancy.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create two VPN tunnels to the same virtual private gateway for redundancy.
AWS Direct Connect with a private VIF does not inherently encrypt traffic; a VPN overlay would be required, and a single Direct Connect connection is not highly available. Option B is incorrect because a single VPN tunnel provides encryption but not high availability; if the tunnel fails, connectivity is lost. Option C is correct because a VPN connection with two tunnels to the same virtual private gateway provides redundancy for the tunnels, and the virtual private gateway is a highly available service within a region. Option D is incorrect because an AWS VPC can only have one virtual private gateway; you cannot attach two virtual private gateways to the same VPC. The recommended design for high availability is to use a single VPN connection with two tunnels (Option C) or multiple VPN connections to different VPCs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use AWS Direct Connect with a private VIF and enable encryption on the connection.
Why it's wrong here
Incorrect. AWS Direct Connect with a private VIF does not encrypt traffic natively; encryption would require an additional VPN overlay. Also, a single Direct Connect connection is not highly available because it has a single point of failure.
- ✗
Create a single VPN tunnel with a virtual private gateway and enable encryption.
Why it's wrong here
Incorrect. A single VPN tunnel provides encryption but no high availability; if the tunnel or the on-premises device fails, connectivity is lost.
- ✓
Create two VPN tunnels to the same virtual private gateway for redundancy.
Why this is correct
Correct. Creating two VPN tunnels to the same virtual private gateway provides redundancy for the tunnels. The virtual private gateway is a highly available service, so this design meets both encryption and high availability requirements.
- ✗
Create a VPN connection with two tunnels, each terminating on a different virtual private gateway in the same VPC.
Why it's wrong here
Incorrect. A VPC can only have one virtual private gateway attached. You cannot create two virtual private gateways in the same VPC. The described design is not possible in AWS.
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.