SCS-C02 Infrastructure Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  AWS Transit Gateway

  Why it's wrong here

  AWS Transit Gateway is a regional network transit hub that lets you connect multiple VPCs and on-premises networks via its route tables and attachments. However, it is a logical routing service, not a physical infrastructure product—it does not provision a dedicated private line from your data center to AWS. To create the actual private network connection, you still need Direct Connect or, for a less dedicated path, a Site-to-Site VPN. Therefore, Transit Gateway alone cannot satisfy the requirement of a private network connection over dedicated lines.

• ✗

  AWS Site-to-Site VPN

  Why it's wrong here

  AWS Site-to-Site VPN creates IPsec tunnels between your on-premises VPN device and virtual private gateways or transit gateways. These tunnels traverse the public internet, meaning traffic shares infrastructure with other customers and can experience inconsistent latency or throughput. Because it relies on the public internet rather than a dedicated physical circuit, it does not qualify as a private network connection in the sense of dedicated lines. This is why it is the wrong choice for a requirement of a dedicated physical link.

• ✓

  AWS Direct Connect

  Why this is correct

  AWS Direct Connect delivers a dedicated physical Ethernet-based connection from your on-premises data center to AWS Direct Connect locations, bypassing the public internet entirely. This dedicated link provides consistent network performance, lower latency, and can be scaled from 1 to 100 Gbps depending on the port and partner offerings. A direct connection is established via a cross-connect in a Direct Connect facility or through an AWS Direct Connect Partner, and can be divided into multiple virtual interfaces (VLANs) for accessing public and private AWS resources. This precisely matches the requirement of creating a private network connection using dedicated lines.

• ✗

  VPC Peering

  Why it's wrong here

  VPC peering is a one-to-one connection between two VPCs that allows private IP traffic to flow using AWS's internal infrastructure. It does not extend to on-premises networks, and peering relationships are not transitive, meaning you cannot hop from one peered VPC to another without an explicit peering connection. Creating a VPC peering connection does not provision any physical or logical connectivity to an on-premises data center, so it cannot serve as a private network connection to AWS for hybrid workloads. For hybrid scenarios you would combine a dedicated connection like Direct Connect with a Transit Gateway or virtual private gateway, not VPC peering.

Go deeper

Related to this question