SOA-C02 Networking and Content Delivery Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Customer gateway (CGW)

  Why this is correct

  The Customer Gateway (CGW) is a logical object in AWS that represents the on-premises VPN device or software application. It stores the public IP address of the customer-side router and, if BGP is used, the Border Gateway Protocol Autonomous System Number (ASN). It is mandatory because the AWS-side virtual private gateway needs a defined peer endpoint to establish the IPsec tunnels, and route propagation depends on this object. Without the CGW, there is no specified remote device to encrypt traffic to.

• ✗

  Transit gateway

  Why it's wrong here

  Transit gateway is not a required component for a direct site-to-site VPN between a single VPC and an on-premises network. A VPN connection can be terminated directly on a virtual private gateway attached to one VPC, making the transit gateway unnecessary overhead. It only becomes useful when you need to centrally connect multiple VPCs and on-premises networks, as it acts as a hub router for inter-VPC and VPN traffic. In the scenario of a basic site-to-site VPN, including a transit gateway adds complexity and cost without adding required function.

• ✓

  VPN connection

  Why this is correct

  The VPN connection is the AWS resource that represents the actual IPsec tunnel configuration linking the virtual private gateway and the customer gateway. It contains the parameters for the two tunnel endpoints, including pre-shared keys, encryption and integrity algorithms, and the routing options (static or BGP). This object is required because both gateways are inert until they are connected by an active VPN connection, which is what establishes the encrypted tunnel and controls which CIDRs are routed over it. Without this, the VGW and CGW have no logical binding and no traffic can flow.

• ✓

  Virtual private gateway (VGW)

  Why this is correct

  Virtual private gateway is the AWS-managed VPN concentrator that attaches to a VPC and provides the AWS-side endpoint for IPsec tunnels. It is required to create a site-to-site VPN connection because it is the target for the VPN tunnels, and VPC route tables use it to direct traffic destined for the on-premises network. The VGW also handles BGP peering when dynamic routing is configured and propagates routes to the VPC. Without a VGW, there is nothing on the AWS side to terminate the encrypted tunnels, so the VPN connection cannot be completed.

• ✗

  AWS Direct Connect

  Why it's wrong here

  AWS Direct Connect is an entirely separate service that establishes a dedicated physical network connection over a private, low-latency link rather than over the public internet. It does not replace or fulfill the logical objects required for an IPsec VPN; you still need the gateways and VPN connection if you want a site-to-site VPN, while Direct Connect itself is a distinct product for private connectivity. It is not a required component and is in fact mutually exclusive with VPN setup—you could use Direct Connect entirely without ever creating a VPN. Including it as a required component is incorrect because the question asks specifically about the site-to-site VPN architecture.

Go deeper

Related to this question