How to Connect Tokyo Office to Paris AWS Workloads Within 5 Days?
A company has established connectivity between its on-premises data center in Paris. France, and the AWS Cloud by using an AWS Direct Connect connection. The company uses a transit VIF that connects the Direct Connect connection with a transit gateway that is hosted in the Europe (Paris) Region. The company hosts workloads in private subnets in several VPCs that are attached to the transit gateway. The company recently acquired another corporation that hosts workloads on premises in an office building in Tokyo, Japan. The company needs to migrate the workloads from the Tokyo office to AWS. These workloads must have access to the company's existing workloads in Paris. The company also must establish connectivity between the Tokyo office building and the Paris data center. In the Asia Pacific (Tokyo) Region, the company creates a new VPC with private subnets for migration of the workloads. The workload migration must be completed in 5 days. The workloads cannot be directly accessible from the internet. Which set of steps should a network engineer take to meet these requirements?
Community Votes
100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
This question tests your ability to choose between Direct Connect and VPN based on deployment time, with the trap being that most candidates assume Direct Connect must be used because it already exists in Paris.
AWS ANS-C01 experts agree the correct answer is C: when migrating workloads on a 5-day timeline, a new Direct Connect circuit is too slow, so use a Site-to-Site VPN to a Tokyo transit gateway and peer it with the Paris transit gateway for fast, secure connectivity.
Selecting Direct Connect for the Tokyo office (or Option D, a VPN straight to the Paris transit gateway) is the most common mistake—Direct Connect provisioning takes weeks, and a VPN to Paris alone does not migrate workloads into the new Tokyo VPC or connect the Tokyo office to the Paris data center.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Option C creates a transit gateway in Tokyo, attaches the Tokyo VPC, establishes a Site-to-Site VPN from the Tokyo office to the Tokyo transit gateway, and then uses transit gateway peering to interconnect with the Paris transit gateway. This design allows workloads migrated to the Tokyo VPC to reach Paris workloads through the peering attachment, and the Tokyo office can reach the Paris data center via VPN → Tokyo TGW → peering → Paris TGW → Direct Connect. The 5-day migration deadline is the decisive factor: a VPN can be configured in hours, while a new Direct Connect connection typically takes weeks to provision. This satisfies all requirements without exposing workloads to the internet.
Why the Other Options Are Wrong
Option A is wrong because it creates public subnets in the Tokyo VPC, which would allow internet-facing access; the requirement clearly states the workloads cannot be directly accessible from the internet. Option B is incomplete and incorrect because simply configuring a transit gateway and associating the Tokyo VPC does nothing to connect the Tokyo office or the Paris data center—it lacks the VPN and peering steps. Option D is wrong because a VPN from the Tokyo office directly to the Paris transit gateway only connects the office to Paris, but it does not provide connectivity to the new Tokyo VPC where workloads are being migrated; it also does not enable inter-VPC routing for the migrated workloads. Furthermore, connecting directly to Paris would create a single-region dependency and fails to establish a scalable Tokyo-side gateway.
Community Comment Notes
One highly-voted comment (5 likes) succinctly states "5 days so VPN needs to be used over Direct Connect," which is the key insight that leads to answer C. Another commenter with 2 likes expands on this: "Provisioning a new Direct Connect connection for the Tokyo office would take weeks, making it infeasible for a 5-day migration timeline." These comments directly highlight why any answer involving a physical Direct Connect for Tokyo is disqualified, and why the VPN + transit gateway peering combination is the only realistic solution.
Official Reference
Exam Strategy
Always look for the timeline clue in migration scenarios—if it says 'days' rather than weeks, Direct Connect is likely out of scope and a Site-to-Site VPN should be selected. Then confirm the VPN is terminated on a transit gateway in the target region and peered to the original region to satisfy both workload-to-workload and office-to-data-center connectivity.
Related Analysis
Practice All ANS-C01 Questions
Access 137 questions with complete answers and detailed explanations.
View Full ANS-C01 Practice Test →