How to meet encrypted private IP connectivity over Direct Connect with least overhead?

ANS-C01 By islever Editorial Last updated

Short answer

B Create a transit gateway. Configure a transit VIF on the Direct Connect connection. Associate the transit VIF with a Direct Connect gateway. Associate the Direct Connect gateway with a new transit gateway. Set up an AWS Site-to-Site VPN private IP VPN connection to the transit gateway.

Question

A company has an application that runs on premises. The application needs to communicate with an application that runs in a VPC on AWS. The communication between the applications must be encrypted and must use private IP addresses. The communication cannot travel across the public internet. The company has established a 1 Gbps AWS Direct Connect connection between the on-premises location and AWS. Which solution will meet the connectivity requirements with the LEAST operational overhead?
  1. Configure a private VIF on the Direct Connect connection. Associate the private VIF with the VPC's virtual private gateway. Set up an AWS Site-to-Site VPN private IP VPN connection to the virtual private gateway.
  2. Create a transit gateway. Configure a transit VIF on the Direct Connect connection. Associate the transit VIF with a Direct Connect gateway. Associate the Direct Connect gateway with a new transit gateway. Set up an AWS Site-to-Site VPN private IP VPN connection to the transit gateway. Correct Answer
  3. Configure a public VIF on the Direct Connect connection. Associate the public VIF with a Direct Connect gateway. Associate the Direct Connect gateway with a new transit gateway. Set up an AWS Site-to-Site VPN private IP VPN connection to the transit gateway.
  4. Create a transit gateway. Configure a transit VIF on the Direct Connect connection. Associate the transit VIF with a Direct Connect gateway. Associate the Direct Connect gateway with a new transit gateway. Set up a third-party firewall in a new VPC that is attached to the transit gateway. Set up a VPN connection to the third-party firewall.

Key Takeaways

This question tests the private IP VPN feature over Direct Connect: it must be attached to a transit gateway and use a transit VIF or private VIF with a Direct Connect gateway, not a public VIF or a VGW-based VPN.

For encrypted private IP communication over AWS Direct Connect without internet transit, the correct design uses a transit VIF, Direct Connect gateway, and transit gateway with an AWS Site-to-Site VPN private IP VPN attachment. Community consensus favors option B, as it is both valid and operationally efficient.

Common mistake: The most common wrong answer is A, because candidates see only one VPC and assume a private VIF attached to the VPC's virtual private gateway is simpler. However, a private IP VPN connection to a virtual private gateway is not the supported architecture for encrypted private IP traffic over Direct Connect; public VIF also appears attractive but is invalid for private IP VPN.

Expert Analysis

Understanding the Requirement

The company needs on-premises and AWS applications to communicate privately and securely. Encryption is required, private IP addresses must be used, and the path must never traverse the public internet. The existing 1 Gbps AWS Direct Connect link is the physical foundation. The solution must also be the least operational overhead, meaning fully managed AWS services are preferred over third-party appliances.

Why Option B Is Correct

Option B creates a transit gateway and configures a transit VIF on the Direct Connect connection. The transit VIF is associated with a Direct Connect gateway, which in turn is associated with the new transit gateway. Then an AWS Site-to-Site VPN private IP VPN connection is attached to the transit gateway.

This architecture is the supported AWS pattern for encrypted private IP connectivity over Direct Connect. The IPsec tunnels use private IP addresses on both ends, and the physical path stays entirely on the Direct Connect link. No public internet or public VIF is involved. Because the solution uses AWS-managed components (Direct Connect Gateway and Transit Gateway), there is no firewall or virtual appliance to operate, making it the least operational overhead.

Why Option A Fails

Option A uses a private VIF associated with the VPC's virtual private gateway and then adds a Site-to-Site VPN private IP VPN to that VGW. A standard Direct Connect private VIF already provides private Layer 3 connectivity, but it does not encrypt traffic. Adding an IPsec VPN connection to a VGW over a private VIF is not the correct pattern for private IP VPN; AWS private IP VPN is designed around a Transit Gateway attachment. The VGW VPN endpoint is publicly reachable, so without a public VIF or internet path, the VPN tunnel cannot establish. Therefore A does not meet the encryption or private-only requirements.

Why Option C Fails

Option C uses a public VIF and attempts to associate it with a Direct Connect gateway and transit gateway. Public VIFs are used for AWS public services such as S3 or DynamoDB and cannot be associated with a Direct Connect gateway or transit gateway. Additionally, private IP VPN cannot run over a public VIF. Although a public VIF physically travels over Direct Connect, it is not a private-IP solution and is architecturally invalid for this scenario.

Why Option D Fails

Option D correctly sets up a transit VIF, Direct Connect gateway, and transit gateway, but then adds a third-party firewall in a new VPC and connects the VPN to that firewall. While this could satisfy encryption and private IP requirements, it significantly increases operational overhead because you must deploy, patch, monitor, and manage a third-party virtual appliance. The question asks for the least operational overhead, and AWS-native private IP VPN to the transit gateway is more operationally efficient.

Community Consensus

The community strongly favored option B (68 votes) over option A (18 votes). One comment from Blitz1 correctly summarizes the failures: A cannot use a Site-to-Site VPN with a private VIF, C cannot combine a public VIF with a transit gateway/Direct Connect gateway, and D's third-party firewall adds unnecessary overhead. Another comment from AzureDP900 also notes that B meets all requirements with the least operational overhead by using AWS-managed services.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When a question asks for both encryption and private IP addresses over Direct Connect, look for a solution that combines a transit VIF, a Direct Connect gateway, and a Transit Gateway with a private IP Site-to-Site VPN. Eliminate any option using a public VIF or a third-party appliance, as those either violate the private-only requirement or introduce unnecessary operational overhead.

Community Votes

B
79%
A
21%

79% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 10 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 10

  1. strike3test 👍 4 Answered B
    Private VIFs are used to establish private connectivity between your on-premises network and your VPCs in AWS without traversing the public internet. They are typically used for scenarios where you need dedicated, private communication between your on-premises infrastructure and your AWS resources. However, to establish a Site-to-Site VPN connection, you need to configure a virtual private gateway (VGW) in your VPC. The VGW acts as the VPN endpoint in the AWS cloud. Site-to-Site VPN connections are established between the VGW and your on-premises VPN device or network. Option B is correct
  2. vic614 👍 4 Answered A
    Least operational overhead. No need for a transit gateway since just 1 vpc. Use Site-to-site to make sure encryption. No public VIF.
  3. AzureDP900 👍 3 Answered B
    Option B meets all of the requirements with least operational overhead: It uses a transit gateway and a transit VIF on the Direct Connect connection. Associating the transit VIF with a Direct Connect gateway ensures that communication between the Direct Connect connection and the AWS infrastructure is secure. The transit gateway can be associated with a new transit gateway, which allows data to flow between sites while maintaining security and meeting requirements. It sets up an AWS Site-to-Site VPN private IP VPN connection to the transit gateway.
  4. Akshay0403 👍 3 Answered B
    Option B is the most operationally efficient solution that meets all requirements: Encrypted Communication: The AWS Site-to-Site VPN connection provides encryption. Private IP Addresses: The transit VIF and Direct Connect gateway ensure private IP connectivity. Least Operational Overhead: By using the transit gateway and Direct Connect's transit VIF, the solution simplifies network management and minimizes operational complexity.
  5. Blitz1 👍 3 Answered B
    A - you cannot have s2s vpn with private vif. You need public -> A fail C - can you can have 2s2 vpn with public vif but you cannot have in the same time trasit vif(because is mentioning transit gateway) and public vif associated with direct connect gateway -> C fail D - third party vpn -> not LEAST operational overhead -> D fail
Show 5 more comments
  1. AlirezaNetWorld 👍 3
    C is the correct answer. Establishing IPsec is only permitted over the Public VIF, but this doesn't mean traffic is transmitted over the public Internet as all traffic will be sent and received between the on-prem and AWS across the DX line which is considered as a private link.
  2. tsangckl 👍 3 Answered C
    Site-to-site VPN have to be created over public VIF
  3. AXH 👍 3
    Agree, A is least overhead to implement.
  4. veyisceylan 👍 2
    To build Site-to-Site VPN over Direct Connect to Amazon VPC, use a public virtual interface. To build Site-to-Site VPN between on-premises equipment and AWS Transit Gateway, choose a public or a transit virtual interface. It should be B with Transit Gateway and Private IP VPN
  5. Nel07 👍 2 Answered B
    https://docs.aws.amazon.com/vpn/latest/s2svpn/private-ip-dx.html

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

How to make one AWS Direct Connect connection primary and the other failover-only?

S-grade

How to Copy On-Premises Application Logs to Amazon S3 Over AWS Direct Connect?

S-grade

Why Does VPC Traffic Mirroring Randomly Drop Traffic?

S-grade

What is the most secure way to expose cross-account microservices with API Gateway?

S-grade

Practice All ANS-C01 Questions

Access 137 questions with complete answers and detailed explanations.

View Full ANS-C01 Practice Test →

← Back to ANS-C01 Study Guide