SOA-C02 Networking and Content Delivery Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Add a route in the VPC route table pointing to the on-premises network via a virtual private gateway (VGW)

  Why this is correct

  The VGW is attached to the VPC and is the entry/exit point for Direct Connect. By adding a route with the on-premises destination and the VGW as the target, traffic is forced through the Direct Connect connection.

• ✗

  Add a route in the VPC route table pointing to the on-premises network via a NAT gateway

  Why it's wrong here

  A NAT gateway operates at the network edge for IPv4 translation and is designed solely to provide outbound internet connectivity from private subnets. It has no virtual interface or BGP presence toward an on-premises router, so it cannot terminate a Direct Connect private virtual interface. Setting a route to the on-premises CIDR with a NAT gateway as the target would simply drop traffic because the NAT gateway cannot forward packets to a Direct Connect link, nor does it have a route back into the data center. Direct Connect requires a virtual private gateway or transit gateway attached to the VPC as the route target.

• ✗

  Add a route in the VPC route table pointing to the on-premises network via an internet gateway

  Why it's wrong here

  An internet gateway provides a target for public IPv4 traffic destined to the internet and performs no translation or forwarding to private on-premises networks. If a VPC route for the on-premises CIDR pointed at an internet gateway, packets would be sent over the public internet, completely bypassing the private Direct Connect connection and losing all its low-latency and security benefits. Moreover, private RFC 1918 IP address ranges used on-premises are not routable over the internet gateway, so the traffic would fail or be blackholed rather than traverse the DX link. The correct target for a DX private VIF is the virtual private gateway that terminates the BGP session.

• ✗

  Add a route in the VPC route table pointing to the on-premises network via a VPC peering connection

  Why it's wrong here

  VPC peering connections only join two VPCs within AWS and are explicitly non-transitive, meaning a route entry using a peering connection as a target cannot forward traffic to any third network such as an on-premises data center. There is no peering attachment to Direct Connect, and AWS does not allow a peered VPC to route traffic through a VPC's virtual private gateway. To reach on-premises networks via Direct Connect, you must use a virtual private gateway or transit gateway with an associated private virtual interface and configure specific routes in the VPC route table. Thus, selecting a VPC peering connection as the route target would be invalid for this hybrid network scenario.

Go deeper

Related to this question