ANS-C01 Network Implementation Practice Question

Which TWO statements about AWS Direct Connect are correct? (Select TWO.)

⚠ Common exam trap

Many exam-takers confuse Direct Connect's private, dedicated nature with inherent encryption, but AWS explicitly states that encryption is optional and must be added by the customer (e.g., using IPsec or TLS).

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Direct Connect supports multiple virtual interfaces (VIFs) over a single connection

AWS Direct Connect allows you to create multiple virtual interfaces (VIFs) — including private VIFs, public VIFs, and transit VIFs — over a single physical Direct Connect connection. This enables you to segment traffic to different AWS services (e.g., VPCs via private VIF, public AWS endpoints via public VIF) without needing separate physical cables, leveraging 802.1Q VLAN tagging to isolate each VIF.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Direct Connect traffic is encrypted by default
Why it's wrong here
Encryption is optional via IPsec.
✓
Direct Connect supports multiple virtual interfaces (VIFs) over a single connection
Why this is correct
You can have public, private, and transit VIFs.
✗
Direct Connect is a managed VPN service
Why it's wrong here
It is a dedicated network connection.
✗
Direct Connect can be provisioned in minutes without any physical infrastructure
Why it's wrong here
It requires physical cabling and cross-connects.
✓
Direct Connect provides a consistent network experience with lower latency and higher bandwidth than internet-based VPN
Why this is correct
Direct Connect bypasses the internet.

Visual reference

Go deeper

ANS-C01 Network Implementation Practice Question

Why each option matters

Option-by-option breakdown

Related to this question