How to Transition AWS Direct Connect and Site-to-Site VPN to IPv6 Quickly?
A company has a hybrid IT setup that includes services that run in an on-premises data center and in the AWS Cloud. The company is using AWS Direct Connect to connect its data center to AWS. The company is using one AWS Site-to-Site VPN connection as backup and requires a backup connectivity option to always be present. The company is transitioning to IPv6 by implementing dual-stack architectures. Which combination of steps will transition the data center's connectivity to AWS in the LEAST amount of time? (Choose two.)
Community Votes
100% of anonymous learners picked answer AD. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
This question tests the critical limitation that neither existing Site-to-Site VPN connections nor existing Direct Connect VIFs can be modified to add IPv6 support; both require the creation of new resources (a new VPN tunnel and a new IPv6 peer on the VIF).
To transition an AWS hybrid environment to IPv6 in the least amount of time, you must create a new IPv6 Site-to-Site VPN tunnel and add an IPv6 peer to the existing Direct Connect Virtual Interface (VIF). Existing Site-to-Site VPN connections and VIFs cannot be upgraded to support IPv6 in place.
Candidates often choose Option C, believing they must create a completely new dual-stack VIF and migrate traffic. However, this violates the 'least amount of time' constraint because you can simply add an IPv6 peer to the existing VIF (Option D) rather than building and migrating to a new one.
Community Discussion (10 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
The question asks for the combination of steps to transition to IPv6 using dual-stack architectures in the LEAST amount of time. The environment consists of an AWS Direct Connect connection and a Site-to-Site VPN connection used as a backup.
Analyzing the Site-to-Site VPN Constraint
According to AWS documentation, you cannot enable IPv6 support for an existing Site-to-Site VPN connection. Because the company requires the backup VPN connection to always be present and needs to support IPv6, the only way to achieve this is to create a brand new Site-to-Site VPN tunnel specifically for IPv6 traffic. This makes Option A correct and invalidates Option B (which suggests creating a dual-stack VPN, which is not supported) and Option E (which suggests tunneling IPv6 inside IPv4, which is not the standard or required AWS approach for this scenario).Analyzing the Direct Connect Constraint
For AWS Direct Connect, you do not need to create an entirely new Virtual Interface (VIF) to support IPv6. Instead, you can simply add a new IPv6 peer to the existing VIF. This allows the existing connection to handle both IPv4 and IPv6 traffic (dual-stack) without the downtime and configuration overhead of provisioning a new VIF and migrating traffic. This makes Option D the correct choice for the Direct Connect side of the hybrid connection. Option C is incorrect because creating a new dual-stack public VIF and migrating traffic takes significantly more time and effort than simply adding an IPv6 peer to the existing VIF.Official Reference
Exam Strategy
When an AWS exam question emphasizes 'LEAST amount of time' or 'LEAST operational overhead,' always look for the option that modifies or adds to an existing resource rather than tearing it down and rebuilding it, provided the service supports it.
Related Analysis
Practice All ANS-C01 Questions
Access 137 questions with complete answers and detailed explanations.
View Full ANS-C01 Practice Test →