Which solution connects two cross-Region VPCs and on-premises most cost-effectively?

A company runs applications in two VPCs that are in separate AWS Regions. One VPC is in the us-east-1 Region. The second VPC is in the us-west-1 Region. The company needs to establish connectivity between the two VPCs. The company also needs to connect the VPCs to applications that run in an on-premises data center. The current traffic requirement between the VPCs is 50 ТВ per month. The company expects traffic volume between the VPCs to increase. The traffic requirement from the VPCs to the on-premises data center is 10 ТВ per month. The company expects the traffic between the VPCs and the data center to remain constant. Which solution will meet these requirements MOST cost-effectively?

  1. Create a transit gateway in each Region. Create VPN connections from the transit gateways to the on-premises firewall. Create a peering connection between the transit gateways.
  2. Create a virtual private gateway in each Region. Create VPN connections from the on-premises firewall to the virtual private gateways. Configure the on-premises firewall to route the traffic between the two VPCs.
  3. Create a virtual private gateway in each Region. Create VPN connections from the on-premises firewall to the virtual private gateways. Create a VPC peering connection between the two VPCs. Source Reference Answer
  4. Create a virtual private gateway in each Region. Create VPN connections from the on-premises firewall to the virtual private gateways. Create a VPN connection between the virtual private gateways.

Community Votes

C
62%
A
38%

62% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

The question really tests whether you can distinguish between scalability-driven architectures (Transit Gateway) and cost-driven architectures (VPC peering) for a simple two-VPC scenario, while recognizing that Site-to-Site VPN is the standard, cost-effective way to reach on-premises.

This question tests the most cost-effective way to interconnect two VPCs in different AWS Regions and an on-premises data center, weighing Transit Gateway peering against VPC peering plus Site-to-Site VPN. Community consensus favors VPC peering for the inter-Region link because it avoids the hourly and data processing charges of Transit Gateway when only two VPCs are involved.

Many candidates choose option A (Transit Gateway in each Region with TGW peering) because the prompt mentions that inter-VPC traffic will increase, which sounds like a scalability cue. However, Transit Gateway adds a fixed hourly charge per attachment plus data processing fees, making it more expensive than VPC peering when only two VPCs need to communicate.

Community Discussion (8 comments)

ashk123456 👍 1 Selected: A
C is incorrect: VPC peering is not cost-effective for 50 TB/month because AWS charges per GB for inter-Region traffic. No centralized management: Unlike Transit Gateway, VPC Peering requires manual route table updates.
kaerarune 👍 1 Selected: A
The amount of traffic between VPCs is expected to increase, while the amount of traffic between VPCs and on-premises is expected to remain constant, so wouldn't a TGW configuration be more cost-effective in the future?
victian 👍 1 Selected: C
actually, Inter-region TGW peering data transfer fees are higher than inter-region VPC peering data transfer fees
46f094c 👍 1 Selected: C
Inter-region VPC peering is supported. No need to add the cost of a TGW
secdaddy 👍 1 Selected: A
D. AWS does not support VPN connections directly between VGWs and B. seems unlikely due to the increasing VPC-VPC traffic requirement. C. Inter-region VPC peering is not free. A. Inter-region TGW peering data transfer fees are lower than inter-region VPC peering data transfer fees.
woorkim 👍 1 Selected: C
Transit Gateways + VPN + TGW peering Higher base cost due to TGW hourly charges Additional data processing charges More expensive than necessary
kowal_001 👍 1 Selected: C
C. There is no info about extra VPCs in the future. A will work and would be better if we consider more VPCs. But it this case, we have only 2 of them , so peering is xenough.
c1193d4 👍 1 Selected: C
C: because it's the less expensive solution and because a 1.25 Gbps VPN is enough to transfer 10TB over 1 month (around 2h30 / 1 TB)

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Expert Analysis

Correct Answer: C

Option C is the most cost-effective solution that satisfies all requirements:

  • Site-to-Site VPN from the on-premises firewall to a Virtual Private Gateway (VGW) in each Region provides the required connectivity to the on-premises data center. The 10 TB/month on-premises traffic is constant and easily handled by standard VPN throughput.
  • Inter-Region VPC peering directly connects the two VPCs without introducing any hourly infrastructure charges. AWS supports VPC peering across Regions, and the data transfer cost per GB for inter-Region VPC peering is lower than the combined Transit Gateway attachment hourly fee + TGW data processing fee + TGW peering data transfer fee.

Why Option A Is Wrong (Popular Distractor)

Option A uses Transit Gateway in each Region with TGW peering. While Transit Gateway is the right architectural choice when you have many VPCs or need a hub-and-spoke topology, it is overkill here:

  • You pay an hourly charge per TGW attachment (two per Region: one for the VPC, one for the VPN).
  • You pay data processing charges on every GB that transits the TGW.
  • Inter-Region TGW peering adds yet another attachment charge and its own data transfer rate, which is typically higher than inter-Region VPC peering.
The prompt's mention of "traffic will increase" is a deliberate trap. VPC peering scales with traffic automatically and remains cheaper than TGW until you need to connect many VPCs — the question never states additional VPCs are coming.

Why Option B Is Wrong

Option B routes inter-VPC traffic through the on-premises firewall. This is technically possible but:

  • It sends cross-Region VPC-to-VPC traffic out to on-premises and back, adding latency and egress costs.
  • It creates a single point of failure and unnecessarily burdens the on-premises firewall.
  • It is neither cost-effective nor architecturally sound.

Why Option D Is Wrong

Option D suggests a VPN connection between the two Virtual Private Gateways. AWS does not support a direct Site-to-Site VPN between two VGWs — VGWs terminate VPNs from on-premises or from another AWS network appliance, not from each other. This option is technically invalid.

Community Insight

As several candidates noted (see comments [3], [4], [6]), inter-Region VPC peering data transfer fees are lower than TGW peering fees, and TGW adds hourly base costs that are unjustified for only two VPCs. Comment [7] correctly points out that the scenario describes exactly two VPCs with no indication of future VPC expansion, so peering is sufficient.

Official Reference

Exam Strategy

When an AWS question emphasizes 'MOST cost-effectively' and describes only two VPCs, default to VPC peering rather than Transit Gateway. Reserve Transit Gateway answers for scenarios that explicitly mention multiple VPCs, a hub-and-spoke model, or centralized routing requirements.

Related Analysis

A company has two data centers that are interconnected with

S-Grade

A company is replatforming a legacy data processing solution

S-Grade

A company has a total of 30 VPCs. Three AWS Regions each con

S-Grade

Practice All ANS-C01 Questions

Access 137 questions with complete answers and detailed explanations.

View Full ANS-C01 Practice Test →

← Back to ANS-C01 Study Guide