Site-to-Site VPN Components: Required Resources
Which THREE components are required to set up a site-to-site VPN connection between an on-premises network and an AWS VPC? (Choose three.)
Quick Answer
The answer is the VPN connection, along with a virtual private gateway and a customer gateway. These three components are required because a site-to-site VPN creates a secure, encrypted link between your on-premises network and an AWS VPC; the virtual private gateway (or transit gateway) serves as the VPN concentrator on the AWS side, the customer gateway represents the physical or software VPN device on your premises, and the VPN connection is the logical object that ties them together, containing two tunnels for high availability. On the AWS Certified SysOps Administrator Associate SOA-C02 exam, this concept tests your understanding of hybrid networking fundamentals and often appears in scenario-based questions where you must identify the missing resource. A common trap is confusing the VPN connection with the VPN tunnels themselves—remember, the connection is the parent resource that includes the tunnels. For a quick memory aid, think of the three C’s: Cloud gateway, Customer gateway, and Connection.
⚠ Common exam trap
Many exam-takers confuse an internet gateway with a virtual private gateway, thinking any gateway can serve as a VPN endpoint, but only the VGW supports IPsec termination and route propagation for site-to-site VPNs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Virtual private gateway
A site-to-site VPN between on-premises and AWS requires a virtual private gateway (A), which is the AWS-side VPN concentrator attached to the VPC and terminating the IPSec tunnels; a customer gateway (D), which is the AWS resource representing the on-premises VPN device (its public IP and BGP ASN) that terminates the other end of the tunnels; and a VPN connection (C), which is the actual IPSec tunnel resource linking the virtual private gateway to the customer gateway and carrying traffic between the two networks. An internet gateway (B) is not required for this design because it provides internet access for public subnets, not the encrypted VPN termination, and a Direct Connect virtual interface (E) belongs to AWS Direct Connect private/public transit VIFs, which are a separate dedicated-connection service rather than an IPSec site-to-site VPN component.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Virtual private gateway
Why this is correct
The virtual private gateway is the AWS-side VPN concentrator attached to the VPC; it terminates the two IPSec tunnels from the customer gateway. Without it, no site-to-site VPN endpoint exists on the AWS side, so the connection cannot be established.
- ✗
Internet gateway
Why it's wrong here
A site-to-site VPN terminates on a virtual private gateway on the AWS side, not an internet gateway; the IGW serves public subnet internet traffic. It is tempting because the VPN traverses the internet, but the correct component is the virtual private gateway plus customer gateway, VPN connection and route propagation.
- ✓
VPN connection
Why this is correct
The VPN connection itself is the IPSec tunnel resource linking the virtual private gateway to the customer gateway. It carries the encrypted traffic between on-premises and the VPC, so it is mandatory for any site-to-site VPN.
- ✓
Customer gateway
Why this is correct
The customer gateway resource represents the on-premises VPN device in AWS, supplying its public IP address and routing type. Without it, AWS cannot terminate the IPSec tunnels, so it is mandatory alongside the virtual private gateway and VPN connection.
- ✗
Direct Connect virtual interface
Why it's wrong here
Direct Connect virtual interfaces belong to dedicated private connectivity over AWS Direct Connect, not an IPsec VPN over the internet. It is tempting because both link on-premises networks to a VPC, but the correct choice for a site-to-site VPN is the virtual private gateway, customer gateway and VPN connection.
Visual reference
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
One of 1,169 original SOA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SOA-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which THREE components are required to set up a site-to-site VPN connection between a VPC and an on-premises network? (Choose three.)
hard- ✓ A.Virtual private gateway or transit gateway
- B.NAT Gateway
- ✓ C.VPN connection
- ✓ D.Customer gateway
- E.Internet gateway
Why A: A virtual private gateway or transit gateway is required as the AWS-side VPN concentrator that terminates the VPN tunnels and routes traffic between the VPC and the on-premises network. It provides the target for the VPN connection and must be attached to the VPC to enable site-to-site VPN functionality.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.