SOA-C02 Networking and Content Delivery Practice Question
An organization wants to allow an on-premises data center to access an Amazon RDS database in a VPC. Which AWS service should be used to establish a dedicated, private, and high-bandwidth connection?
⚠ Common exam trap
SOA-C02 often tests the distinction between 'dedicated private connection' (Direct Connect) and 'encrypted tunnel over the internet' (Site-to-Site VPN), causing candidates to pick VPN when the question emphasizes dedicated bandwidth or private connectivity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Direct Connect
AWS Direct Connect provides a dedicated, private network connection from an on-premises data center to AWS, bypassing the public internet. It offers consistent high bandwidth (1 Gbps, 10 Gbps, or 100 Gbps dedicated ports) and lower latency than internet-based connections. This makes it the correct choice for a dedicated, private, high-bandwidth link to an RDS database inside a VPC.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
AWS Direct Connect
Why this is correct
AWS Direct Connect is the correct choice because it provides a dedicated, private, physical network connection from the on-premises data center directly to AWS, bypassing the public internet. This delivers consistent, low-latency, high-bandwidth connectivity and is ideal for hybrid workloads that require reliable, secure, and predictable network performance, meeting the organization's requirement for a dedicated connection.
- ✗
AWS Transit Gateway
Why it's wrong here
AWS Transit Gateway is not the correct answer because it is a network transit hub that interconnects VPCs, VPNs, and Direct Connect connections within the AWS cloud, but it does not itself provide the physical or logical link to an on-premises data center. While a Transit Gateway can simplify routing once a Direct Connect or VPN is established, it must be paired with an underlying connectivity option and therefore cannot fulfill the organization's need for a dedicated on-premises connection.
- ✗
AWS Site-to-Site VPN
Why it's wrong here
AWS Site-to-Site VPN is incorrect because it establishes an encrypted tunnel over the public internet between the on-premises data center and an AWS Virtual Private Gateway, rather than using a dedicated private circuit. Although secure and inexpensive, its performance is subject to internet variability, latency, and potential congestion, so it does not meet the requirement for a dedicated, private network connection with consistent throughput.
- ✗
VPC Peering
Why it's wrong here
VPC Peering is wrong because it only connects one VPC to another VPC within AWS using private IP routing, enabling traffic between those VPCs without traversing the internet. It has no mechanism to extend connectivity to an on-premises data center; a separate connection such as Direct Connect or a VPN is required to bridge the data center to a VPC, so peering cannot satisfy the stated requirement.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SOA-C02 question from scratch — 1,169 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.