SOA-C02 Networking and Content Delivery Practice Question
A company has multiple on-premises branch offices, each with a site-to-site VPN connection to a single VPC in AWS. The SysOps administrator needs to enable communication between the branch offices using the AWS cloud as a hub. Which configuration should be implemented to achieve this with the least operational overhead?
⚠ Common exam trap
Candidates often assume static routes are simpler and sufficient for hub-and-spoke communication, overlooking that BGP route propagation on the VGW provides automated, scalable route exchange with minimal ongoing management, which is the key to reducing operational overhead.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use dynamic routing (BGP) on all VPN connections and enable route propagation on the virtual private gateway (VGW).
Enabling dynamic routing (BGP) on all VPN connections and propagating routes from the virtual private gateway (VGW) into the VPC route table allows each branch office to learn the CIDR blocks of all other branch offices automatically. This eliminates the need for manual static route entries and ensures that traffic between branch offices is routed through the VPC hub with minimal operational overhead, as BGP handles failover and route updates dynamically.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure static routes in the VPC route table pointing to each VPN connection.
Why it's wrong here
Static routes are manually added entries in the VPC route table and must be updated on the VPC and all on-premises routers whenever a branch's CIDR changes or a new site is added. They are not exchanged through the VPN, so the virtual private gateway (VGW) cannot learn routes from one branch and re-advertise them to another, meaning traffic arriving from one branch destined to another branch is dropped. This makes the solution operationally brittle and unscalable as the number of branch offices grows.
- ✓
Use dynamic routing (BGP) on all VPN connections and enable route propagation on the virtual private gateway (VGW).
Why this is correct
Configuring BGP on every Site-to-Site VPN connection and enabling route propagation on the VPC route table for the virtual private gateway (VGW) allows the VGW to automatically exchange route information between all attached VPN connections. Each branch's BGP session advertises its local CIDRs, and those routes are installed into the VPC route table via route propagation, so traffic from one branch to another is forwarded through the VGW without manual entries. This is the native AWS mechanism for a hub-and-spoke setup where the VPC is the hub and branch offices are spokes, enabling dynamic, self-updating inter-branch communication.
- ✗
Create a separate Transit VPC with EC2-based VPN appliances to route traffic between branch offices.
Why it's wrong here
A Transit VPC with EC2-based VPN appliances introduces significant management overhead for patching, scaling, and monitoring the appliances, whereas the correct solution—using AWS Transit Gateway with route tables—handles inter-branch routing natively without such manual upkeep. This option is tempting because a Transit VPC is traditionally used to interconnect multiple VPCs or on-premises networks when native AWS transit routing was unavailable; it would be correct in a scenario requiring custom routing logic or encryption protocols that AWS Transit Gateway does not natively support.
- ✗
Place all branch offices in the same IPsec tunnel by configuring identical pre-shared keys.
Why it's wrong here
An IPsec VPN tunnel is inherently a point-to-point link between a single customer gateway and the virtual private gateway; multiple branch offices cannot share one tunnel simply by using identical pre-shared keys. Each branch needs its own customer gateway and its own VPN connection, and pre-shared keys are only authentication credentials, not routing constructs. Attempting to reuse one tunnel would cause overlapping security associations and route conflicts, and the VPN endpoints would be unable to distinguish which branch a particular subnet belongs to.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every SOA-C02 question from scratch — 247 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.