Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5
SOA-C02 Reliability and Business Continuity Practice Question
Drag and drop the steps to set up an AWS Site-to-Site VPN connection into the correct order.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create and attach virtual private gateway, then define customer gateway, then create VPN connection, then configure on-premises router, then verify tunnel
First create and attach the virtual private gateway, then define the customer gateway, then create the VPN connection, configure the on-premises router, and verify the tunnel.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create and attach virtual private gateway, then define customer gateway, then create VPN connection, then configure on-premises router, then verify tunnel
Why this is correct
This is the correct order because the virtual private gateway must be attached to the VPC first, then the customer gateway defined to represent the on-premises device, followed by creating the VPN connection, configuring the on-premises router, and finally verifying the tunnel.
- ✗
Define customer gateway, then create and attach virtual private gateway, then create VPN connection, then configure on-premises router, then verify tunnel
Why it's wrong here
Starting with the customer gateway is invalid because the virtual private gateway (VGW) must first be created and attached to your VPC to serve as the AWS-side endpoint of the tunnel. The customer gateway object merely represents your on-premises router; without an attached VGW, there is no VPN target on the AWS side, so subsequent VPN connection creation would fail for lack of a required gateway. Therefore, the VGW attachment must precede any customer gateway definition.
- ✗
Create and attach virtual private gateway, then create VPN connection, then define customer gateway, then configure on-premises router, then verify tunnel
Why it's wrong here
Creating the VPN connection before defining the customer gateway is invalid because the CreateVpnConnection API requires both a customer gateway ID and a virtual private gateway ID as mandatory parameters. The customer gateway object encapsulates the on-premises router's public IP and routing protocol, and AWS uses it to negotiate the tunnels; without it, the VPN connection cannot be provisioned. Thus, the customer gateway must exist before you attempt to create the VPN connection.
- ✗
Create and attach virtual private gateway, then define customer gateway, then configure on-premises router, then create VPN connection, then verify tunnel
Why it's wrong here
Placing on-premises router configuration before VPN connection creation is invalid because the router configuration is downloaded from the generated VPN connection and contains the tunnel endpoints, pre-shared keys, and BGP ASN values. You cannot configure the on-premises router correctly until the VPN connection exists and you have retrieved its configuration file. Therefore, the VPN connection must be created first, then the router configured, and finally the tunnel status verified.
Go deeper
Related to this question
About these practice questions
One of 247 original SOA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.