SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A company is implementing a hybrid network architecture with multiple VPCs in different AWS accounts. They need to ensure private connectivity between the VPCs and their on-premises data center. Which TWO services should they use together to meet this requirement?
⚠ Common exam trap
Many candidates choose VPC peering (Option C) thinking it can connect multiple VPCs to on-premises directly, but VPC peering lacks transitive routing and cannot terminate a Direct Connect connection, making Transit Gateway the required central aggregation point.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Direct Connect
AWS Direct Connect (A) is correct because it provides a dedicated private network connection from the on-premises data center to AWS, bypassing the public internet for consistent, low-latency private connectivity. AWS Transit Gateway (D) is correct because it acts as a central hub that connects multiple VPCs across different AWS accounts and attaches to the Direct Connect gateway, enabling transitive routing between all VPCs and on-premises. Together, Direct Connect provides the private on-premises link while Transit Gateway provides scalable many-to-many VPC interconnection across accounts. Amazon Route 53 Resolver (B) only handles DNS resolution between on-premises and VPCs and does not provide the private network transport itself. VPC peering (C) connects only two VPCs at a time and does not scale to a hub-and-spoke multi-account topology or integrate natively with on-premises routing. AWS Client VPN (E) is a remote-user VPN solution for individual clients, not for site-to-site private connectivity between VPCs and a data center.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
AWS Direct Connect
Why this is correct
AWS Direct Connect provides a dedicated private network link from the on-premises data centre into AWS, bypassing the public internet. It supplies the private hybrid connectivity the scenario demands, terminating at a VPC or transit gateway.
- ✗
Amazon Route 53 Resolver
Why it's wrong here
Route 53 Resolver handles DNS resolution between on-premises and AWS, but carries no data traffic, so it cannot provide private connectivity. It tempts because hybrid designs need name resolution, yet that is a supporting component; the transport itself requires a VPN or Direct Connect attachment.
- ✗
VPC peering
Why it's wrong here
VPC peering connects VPCs privately but provides no path to on-premises networks, and it does not transitively route across accounts, so it cannot satisfy the hybrid requirement alone. It tempts for inter-VPC connectivity, which is correct only when no on-premises link is needed.
- ✓
AWS Transit Gateway
Why this is correct
AWS Transit Gateway acts as a regional hub, attaching multiple VPCs across accounts and the on-premises connection into one transitive routing domain. This satisfies the stem's requirement for private connectivity between many VPCs and the data centre, avoiding full-mesh peering. Pair it with AWS Site-to-Site VPN or Direct Connect for the on-premises leg.
- ✗
AWS Client VPN
Why it's wrong here
AWS Client VPN connects individual remote users to a VPC; it does not provide site-to-site connectivity between an on-premises data centre and multiple VPCs. It tempts as remote access, which is correct for roaming employees, not for persistent private network-to-network links.
Visual reference
Go deeper
Related to this question
About these practice questions
This SAP-C02 question is part of Courseiva's 984-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.