The answer is to create a VPN connection as a backup and configure route propagation with a lower priority. This is correct because AWS Direct Connect does not provide automatic failover between virtual interfaces; without a dynamic routing mechanism like BGP metrics or a backup path, traffic will simply stop when a VIF fails. By establishing a VPN connection as a secondary link and propagating its routes with a lower priority (e.g., using a longer AS_PATH or a less specific prefix), you ensure that the Direct Connect path is preferred when healthy, but traffic automatically shifts to the VPN if the primary link drops. On the AWS Certified SysOps Administrator Associate SOA-C02 exam, this scenario tests your understanding of hybrid networking resilience and the limitations of Direct Connect’s native redundancy. A common trap is assuming that multiple VIFs alone guarantee failover, but they require explicit routing configuration. Memory tip: think “Direct Connect for speed, VPN for safety”—the VPN is your automatic safety net when the primary fiber fails.
SOA-C02 Networking and Content Delivery Practice Question
This SOA-C02 practice question tests your understanding of networking and content delivery. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A company uses AWS Direct Connect to connect its on-premises data center to a VPC. The connection is redundant with two virtual interfaces (VIFs). Recently, one VIF failed, and the administrator notices that traffic is not automatically failing over. What must be configured to enable automatic failover?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a VPN connection as a backup and configure route propagation with a lower priority.
AWS Direct Connect does not automatically failover. Using BGP with AS_PATH prepending or using a Direct Connect gateway with multiple VIFs can help, but the simplest approach is to use a VPN as a backup or configure BGP metrics. However, the question implies the need for active/backup. The common solution is to use a VPN connection as a backup and configure route propagation.
Key principle: A trunk being up does not mean the VLAN is allowed across it. Always verify the allowed VLAN list and whether the VLAN exists on both switches.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Configure BGP metrics to prefer the primary VIF.
Why it's wrong here
BGP metrics alone do not trigger failover; they influence route selection but failover still requires BGP session to go down.
✓
Create a VPN connection as a backup and configure route propagation with a lower priority.
Why this is correct
Correct. A VPN backup with BGP metrics ensures automatic failover.
Related concept
Access ports place end devices into a single VLAN.
ECMP load-balances across both paths but does not handle failover.
Common exam traps
Common exam trap: an active trunk can still block the VLAN you need
A trunk being up does not prove every VLAN is crossing it. Check allowed VLAN lists, native VLAN mismatch, VLAN existence and access-port assignment.
Detailed technical explanation
How to think about this question
VLAN questions usually combine access-port and trunking clues. The key is to identify whether the issue is local to one switchport, caused by the trunk, or caused by the VLAN not existing where it needs to exist.
KKey Concepts to Remember
Access ports place end devices into a single VLAN.
Trunk ports carry multiple VLANs between switches.
Allowed VLAN lists decide which VLANs can cross a trunk.
Native VLAN mismatch can create confusing symptoms.
TExam Day Tips
→Use show vlan brief to verify access VLANs.
→Use show interfaces trunk to verify trunk state and allowed VLANs.
→Do not treat every same-VLAN issue as a routing problem.
Key takeaway
A trunk being up does not mean the VLAN is allowed across it. Always verify the allowed VLAN list and whether the VLAN exists on both switches.
Real-world example
How this comes up in practice
A startup's cloud architect reviews their monthly bill and notices costs are higher than expected for a long-running batch job. Switching from on-demand instances to Reserved Instances — or using Spot/Preemptible VMs — can reduce compute costs by up to 72 %. Questions like this test whether you understand the tradeoffs between commitment, flexibility, and cost across cloud pricing models.
What to study next
Got this wrong? Here's your next step.
Review VLAN allowed lists, native VLAN mismatch detection, and how to verify VLAN membership with show vlan brief and show interfaces trunk. Then practise related SOA-C02 questions on switching, trunking, and access-port configuration.
Networking and Content Delivery — This question tests Networking and Content Delivery — Access ports place end devices into a single VLAN..
What is the correct answer to this question?
The correct answer is: Create a VPN connection as a backup and configure route propagation with a lower priority. — AWS Direct Connect does not automatically failover. Using BGP with AS_PATH prepending or using a Direct Connect gateway with multiple VIFs can help, but the simplest approach is to use a VPN as a backup or configure BGP metrics. However, the question implies the need for active/backup. The common solution is to use a VPN connection as a backup and configure route propagation.
What should I do if I get this SOA-C02 question wrong?
Review VLAN allowed lists, native VLAN mismatch detection, and how to verify VLAN membership with show vlan brief and show interfaces trunk. Then practise related SOA-C02 questions on switching, trunking, and access-port configuration.
What is the key concept behind this question?
Access ports place end devices into a single VLAN.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.