How to Connect Two AWS VPCs to On-Premises Data Center with Least Operational Overhead?

ANS-C01 By islever Editorial Last updated

Short answer

D Configure a customer gateway and a virtual private gateway in each VPC. Configure an AWS Site-to-Site VPN connection between the data center and each VPC. Configure BGP routing between the VPCs and the data center.

Question

A company deployed an application in two AWS Regions in one AWS account. The company has one VPC in each Region. The VPCs use non-overlapping private CIDR ranges. The company needs to connect both VPCs to a single on-premises data center to test the application. The application requires up to 800 Mbps of throughput. A network engineer needs to establish connectivity between the VPCs and the on-premises data center. Which solution will meet this requirement with the LEAST operational overhead?
  1. Order a 2 Gbps Direct Connect connection for the data center. Configure a virtual private gateway in each VPC. Create a private VIF for each virtual private gateway, and associate the virtual private gateways with the Direct Connect connection. Configure static routes in the VPC route tables and in the data center router.
  2. Order a 2 Gbps Direct Connect connection for the data center. Configure a virtual private gateway in each VPC. Create a private VIF for each virtual private gateway, and associate the virtual private gateways with the Direct Connect connection. Configure Open Shortest Path First (OSPF) routing between the private VIF and the data center.
  3. Configure a customer gateway and a virtual private gateway in each VPConfigure an AWS Site-to-Site VPN connection between the data center and each VPConfigure static routes in each VPC route table to point to the subnets in the data center.
  4. Configure a customer gateway and a virtual private gateway in each VPC. Configure an AWS Site-to-Site VPN connection between the data center and each VPC. Configure BGP routing between the VPCs and the data center. Correct Answer

Key Takeaways

The question tests understanding of 'least operational overhead' in AWS networking, where BGP dynamic routing eliminates manual static route management compared to static routing options.

This question tests the optimal AWS connectivity solution for connecting two VPCs to an on-premises data center for testing with 800 Mbps throughput and minimal operational overhead. The community consensus favors AWS Site-to-Site VPN with BGP routing over Direct Connect due to faster setup, dynamic routing, and lower operational overhead.

Common mistake: Many candidates choose Option C (Site-to-Site VPN with static routes) because static routes seem simpler initially, but they overlook that BGP provides automatic route propagation and eliminates ongoing manual route maintenance, resulting in lower operational overhead long-term.

Expert Analysis

Analysis of AWS Connectivity Options

The key requirements in this scenario are:

  • Connect two VPCs to a single on-premises data center
  • Support up to 800 Mbps throughput
  • Least operational overhead
  • Purpose is for testing the application

Why Option D is Correct

AWS Site-to-Site VPN with BGP routing meets all requirements with minimal operational overhead:

1. Throughput: AWS Site-to-Site VPN supports up to 1.25 Gbps per tunnel, easily handling the 800 Mbps requirement 2. BGP Dynamic Routing: Automatically propagates routes between VPCs and on-premises, eliminating manual route table updates 3. Quick Setup: No physical infrastructure provisioning required - can be configured in minutes 4. Cost-Effective: Ideal for testing scenarios where permanent Direct Connect isn't justified 5. Low Maintenance: BGP handles route changes automatically without manual intervention

Why Other Options Are Wrong

Options A and B (Direct Connect):

  • Require ordering physical connections (weeks of lead time)
  • Higher cost for testing scenarios
  • More complex setup and ongoing management
  • Option A uses static routes (higher operational overhead)
  • Option B uses OSPF, which is not supported for AWS Direct Connect routing (BGP is required)
Option C (Site-to-Site VPN with Static Routes):
  • Meets throughput requirements
  • However, static routes require manual configuration and maintenance
  • Any network changes require manual route table updates
  • Higher operational overhead compared to BGP's automatic route propagation

Community Insights

As noted by community members, BGP provides "automatic route propagation" and "dynamic routing updates" which significantly reduce operational overhead. While static routes (Option C) might seem simpler initially, they create ongoing maintenance burden that violates the "least operational overhead" requirement.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When AWS questions mention 'least operational overhead,' prioritize solutions with automation features like BGP dynamic routing over manual configurations like static routes. Also consider the scenario context - 'testing' often indicates temporary solutions like VPN over permanent infrastructure like Direct Connect.

Community Votes

D
71%
C
29%

71% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 5 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 5

  1. woorkim 👍 2 Answered D
    answer is D. Using Site-to-Site VPN connections with BGP routing provides: Automatic route propagation Dynamic routing updates Sufficient throughput Lower cost than Direct Connect Minimal operational overhead for maintenance Simpler setup compared to Direct Connect options
  2. jfedotov 👍 2 Answered C
    isn't it easier to configure static routes for 2 VPC and on-prem DC, than configuring BGP? C or D ?
  3. Sudeepshiv 👍 1 Answered D
    • AWS Site-to-Site VPN is fast to set up, cost-effective, and ideal for temporary or test connectivity. • You can easily establish VPN tunnels to each VPC using virtual private gateways (VGWs) and customer gateways (CGWs). • Using BGP (Border Gateway Protocol) provides dynamic route exchange between your on-premises network and AWS — this reduces manual route configuration and simplifies scaling as new networks are added. • It provides adequate throughput (up to 1.25 Gbps) per VPN connection with ECMP and accelerated VPN — enough for the required 800 Mbps throughput.
  4. ashk123456 👍 1 Answered D
    Option D provides the quickest implementation with the most automated routing management through BGP, making it the solution with the least operational overhead while meeting all requirements. A and B both require ordering and provisioning a physical Direct Connect connection,
  5. c1193d4 👍 1 Answered D
    D: a VPN is enough for 800 Mbps and for testing

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

How to make one AWS Direct Connect connection primary and the other failover-only?

S-grade

How to Copy On-Premises Application Logs to Amazon S3 Over AWS Direct Connect?

S-grade

Why Does VPC Traffic Mirroring Randomly Drop Traffic?

S-grade

What is the most secure way to expose cross-account microservices with API Gateway?

S-grade

Practice All ANS-C01 Questions

Access 137 questions with complete answers and detailed explanations.

View Full ANS-C01 Practice Test →

← Back to ANS-C01 Study Guide