SOA-C02 Networking and Content Delivery Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Use AWS Transit Gateway to connect all VPCs and the Direct Connect gateway, then configure route tables to isolate traffic.

  Why it's wrong here

  AWS Transit Gateway operates at Layer 3 and does not provide 802.1Q VLAN tagging or the ability to multiplex multiple private VIFs over a single Direct Connect connection. To use Transit Gateway with Direct Connect, you would instead create a single transit VIF to the Direct Connect gateway and attach the gateway to the Transit Gateway, which then requires VPC attachments and route table configuration. This approach does not satisfy the requirement of using VLAN-tagged private virtual interfaces for per-VPC isolation, and it adds unnecessary complexity while still consuming only one VIF on the connection.

• ✓

  Configure a single Direct Connect connection with multiple private virtual interfaces, each tagged with a different VLAN ID and associated with a different VPC.

  Why this is correct

  A single AWS Direct Connect connection supports multiple private virtual interfaces, each configured with a unique 802.1Q VLAN tag on the customer router and a distinct BGP session. Each private VIF is associated with a separate Virtual Private Gateway or through a Direct Connect Gateway, enabling isolated, dedicated connectivity to a specific VPC over the same physical fiber. This design maximizes bandwidth utilization by sharing the underlying port while maintaining Layer 2 isolation between VPCs, and it is the standard, cost-effective way to connect one on-premises network to multiple VPCs.

• ✗

  Provision multiple Direct Connect connections, one for each VPC, and use a different VLAN on each connection.

  Why it's wrong here

  Provisioning a separate Direct Connect connection for each VPC multiplies the cost of physical ports, cross-connects, and monthly port hours without any technical benefit, because a single connection can carry multiple private VIFs. Additionally, VLAN tagging is meaningful only when multiple VIFs share one physical connection; using a different VLAN on separate connections does not improve isolation or performance, as each connection is already independent. This over-provisioning contradicts the principle of maximizing bandwidth utilization and is unnecessary for connecting multiple VPCs.

• ✗

  Establish a single Direct Connect connection and use IPsec VPN tunnels over it to connect to each VPC.

  Why it's wrong here

  Using IPsec VPN tunnels over a single Direct Connect connection would introduce encryption overhead, thereby reducing the effective bandwidth available and failing to maximise bandwidth utilisation as required by the scenario. This approach is typically employed when an organisation has strict compliance requirements for end-to-end encryption of all traffic, even over a dedicated private link, prioritising data confidentiality over raw throughput. It provides an additional layer of security for sensitive data in transit.

Go deeper

Related to this question