How to Connect Tokyo Office to Paris AWS Workloads Within 5 Days?

ANS-C01 By islever Editorial Last updated

Short answer

C 1. Configure a transit gateway in the Asia Pacific (Tokyo) Region. Associate this transit gateway with the Tokyo VPC.

Question

A company has established connectivity between its on-premises data center in Paris. France, and the AWS Cloud by using an AWS Direct Connect connection. The company uses a transit VIF that connects the Direct Connect connection with a transit gateway that is hosted in the Europe (Paris) Region. The company hosts workloads in private subnets in several VPCs that are attached to the transit gateway. The company recently acquired another corporation that hosts workloads on premises in an office building in Tokyo, Japan. The company needs to migrate the workloads from the Tokyo office to AWS. These workloads must have access to the company's existing workloads in Paris. The company also must establish connectivity between the Tokyo office building and the Paris data center. In the Asia Pacific (Tokyo) Region, the company creates a new VPC with private subnets for migration of the workloads. The workload migration must be completed in 5 days. The workloads cannot be directly accessible from the internet. Which set of steps should a network engineer take to meet these requirements?
    1. Create public subnets in the Tokyo VPC to migrate the workloads into.
    1. Configure a transit gateway in the Asia Pacific (Tokyo) Region. Associate this transit gateway with the Tokyo VPC.
    1. Configure a transit gateway in the Asia Pacific (Tokyo) Region. Associate this transit gateway with the Tokyo VPC.
    Correct Answer
    1. Configure an AWS Site-to-Site VPN connection from the Tokyo office to the Paris transit gateway.

Key Takeaways

This question tests your ability to choose between Direct Connect and VPN based on deployment time, with the trap being that most candidates assume Direct Connect must be used because it already exists in Paris.

AWS ANS-C01 experts agree the correct answer is C: when migrating workloads on a 5-day timeline, a new Direct Connect circuit is too slow, so use a Site-to-Site VPN to a Tokyo transit gateway and peer it with the Paris transit gateway for fast, secure connectivity.

Common mistake: Selecting Direct Connect for the Tokyo office (or Option D, a VPN straight to the Paris transit gateway) is the most common mistake—Direct Connect provisioning takes weeks, and a VPN to Paris alone does not migrate workloads into the new Tokyo VPC or connect the Tokyo office to the Paris data center.

Expert Analysis

Why the Answer Is Correct

Option C creates a transit gateway in Tokyo, attaches the Tokyo VPC, establishes a Site-to-Site VPN from the Tokyo office to the Tokyo transit gateway, and then uses transit gateway peering to interconnect with the Paris transit gateway. This design allows workloads migrated to the Tokyo VPC to reach Paris workloads through the peering attachment, and the Tokyo office can reach the Paris data center via VPN → Tokyo TGW → peering → Paris TGW → Direct Connect. The 5-day migration deadline is the decisive factor: a VPN can be configured in hours, while a new Direct Connect connection typically takes weeks to provision. This satisfies all requirements without exposing workloads to the internet.

Why the Other Options Are Wrong

Option A is wrong because it creates public subnets in the Tokyo VPC, which would allow internet-facing access; the requirement clearly states the workloads cannot be directly accessible from the internet. Option B is incomplete and incorrect because simply configuring a transit gateway and associating the Tokyo VPC does nothing to connect the Tokyo office or the Paris data center—it lacks the VPN and peering steps. Option D is wrong because a VPN from the Tokyo office directly to the Paris transit gateway only connects the office to Paris, but it does not provide connectivity to the new Tokyo VPC where workloads are being migrated; it also does not enable inter-VPC routing for the migrated workloads. Furthermore, connecting directly to Paris would create a single-region dependency and fails to establish a scalable Tokyo-side gateway.

Community Comment Notes

One highly-voted comment (5 likes) succinctly states "5 days so VPN needs to be used over Direct Connect," which is the key insight that leads to answer C. Another commenter with 2 likes expands on this: "Provisioning a new Direct Connect connection for the Tokyo office would take weeks, making it infeasible for a 5-day migration timeline." These comments directly highlight why any answer involving a physical Direct Connect for Tokyo is disqualified, and why the VPN + transit gateway peering combination is the only realistic solution.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

Always look for the timeline clue in migration scenarios—if it says 'days' rather than weeks, Direct Connect is likely out of scope and a Site-to-Site VPN should be selected. Then confirm the VPN is terminated on a transit gateway in the target region and peered to the original region to satisfy both workload-to-workload and office-to-data-center connectivity.

Community Votes

C
100%

100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. Akshay0403 👍 5 Answered C
    5 days so VPN needs to be used over Direct connect
  2. woorkim 👍 1
    C is answer! Provisioning a new Direct Connect connection for the Tokyo office would take weeks, making it infeasible for a 5-day migration timeline.
  3. cas_tori 👍 2 Answered C
    this is C

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

How to make one AWS Direct Connect connection primary and the other failover-only?

S-grade

How to Copy On-Premises Application Logs to Amazon S3 Over AWS Direct Connect?

S-grade

Why Does VPC Traffic Mirroring Randomly Drop Traffic?

S-grade

What is the most secure way to expose cross-account microservices with API Gateway?

S-grade

Practice All ANS-C01 Questions

Access 137 questions with complete answers and detailed explanations.

View Full ANS-C01 Practice Test →

← Back to ANS-C01 Study Guide