Site-to-Site VPN Components: Required Resources
Which THREE components are required to set up a site-to-site VPN connection between an on-premises network and an AWS VPC? (Choose three.)
Quick Answer
The answer is the VPN connection, along with a virtual private gateway and a customer gateway. These three components are required because a site-to-site VPN creates a secure, encrypted link between your on-premises network and an AWS VPC; the virtual private gateway (or transit gateway) serves as the VPN concentrator on the AWS side, the customer gateway represents the physical or software VPN device on your premises, and the VPN connection is the logical object that ties them together, containing two tunnels for high availability. On the AWS Certified SysOps Administrator Associate SOA-C02 exam, this concept tests your understanding of hybrid networking fundamentals and often appears in scenario-based questions where you must identify the missing resource. A common trap is confusing the VPN connection with the VPN tunnels themselves—remember, the connection is the parent resource that includes the tunnels. For a quick memory aid, think of the three C’s: Cloud gateway, Customer gateway, and Connection.
⚠ Common exam trap
Many exam-takers confuse an internet gateway with a virtual private gateway, thinking any gateway can serve as a VPN endpoint, but only the VGW supports IPsec termination and route propagation for site-to-site VPNs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Virtual private gateway
A virtual private gateway (VGW) is the VPN concentrator on the AWS side of a site-to-site VPN connection. It attaches to the VPC and terminates the IPsec tunnels from the on-premises network. Without a VGW, the VPC has no endpoint to receive encrypted traffic from the customer gateway.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Virtual private gateway
Why this is correct
AWS-side endpoint for the VPN.
- ✗
Internet gateway
Why it's wrong here
Not required for VPN; VPN uses the virtual private gateway.
- ✓
VPN connection
Why this is correct
Links the virtual private gateway and customer gateway.
- ✓
Customer gateway
Why this is correct
Represents the on-premises device.
- ✗
Direct Connect virtual interface
Why it's wrong here
Used for dedicated connection, not VPN.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
One of 247 original SOA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SOA-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which THREE components are required to set up a site-to-site VPN connection between a VPC and an on-premises network? (Choose three.)
hard- ✓ A.Virtual private gateway or transit gateway
- B.NAT Gateway
- ✓ C.VPN connection
- ✓ D.Customer gateway
- E.Internet gateway
Why A: A virtual private gateway or transit gateway is required as the AWS-side VPN concentrator that terminates the VPN tunnels and routes traffic between the VPC and the on-premises network. It provides the target for the VPN connection and must be attached to the VPC to enable site-to-site VPN functionality.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.