How to connect on-premises to specific VPCs across regions using AWS Direct Connect cost-effectively?

ANS-C01 By islever Editorial Last updated

Short answer

ABE Create four virtual private gateways. Attach the virtual private gateways to the four VPCs. Create a Direct Connect gateway. Associate the four virtual private gateways with the Direct Connect gateway. Create four private VIFs on each Direct Connect connection to the Direct Connect gateway.

Question

A company has a total of 30 VPCs. Three AWS Regions each contain 10 VPCs. The company has attached the VPCs in each Region to a transit gateway in that Region. The company also has set up inter-Region peering connections between the transit gateways. The company wants to use AWS Direct Connect to provide access from its on-premises location for only four VPCs across the three Regions. The company has provisioned four Direct Connect connections at two Direct Connect locations. Which combination of steps will meet these requirements MOST cost-effectively? (Choose three.)
  1. Create four virtual private gateways. Attach the virtual private gateways to the four VPCs. Correct Answer
  2. Create a Direct Connect gateway. Associate the four virtual private gateways with the Direct Connect gateway. Correct Answer
  3. Create four transit VIFs on each Direct Connect connection. Associate the transit VIFs with the Direct Connect gateway.
  4. Create four transit VIFs on each Direct Connect connection. Associate the transit VIFs with the four virtual private gateways.
  5. Create four private VIFs on each Direct Connect connection to the Direct Connect gateway. Correct Answer

Key Takeaways

The question tests whether candidates recognize that using a Direct Connect gateway with virtual private gateways and private VIFs is significantly more cost-effective than using transit VIFs and a transit gateway when only a few VPCs need on-premises connectivity.

This question tests the most cost-effective way to connect an on-premises network to only four specific VPCs across multiple AWS Regions using AWS Direct Connect. The community consensus confirms that using a Direct Connect gateway with virtual private gateways and private VIFs is cheaper than attaching the Direct Connect gateway to a transit gateway.

Common mistake: Many candidates choose options involving transit VIFs and the existing transit gateway (such as BCF or BC) because a transit gateway is already deployed in the scenario. They overlook that transit VIFs and transit gateway attachment hours incur much higher costs than private VIFs and virtual private gateways when only a handful of VPCs require on-premises access.

Expert Analysis

Understanding the Scenario

The company has 30 VPCs distributed across three AWS Regions, with 10 VPCs per Region. Each Region has a transit gateway (TGW) that interconnects its local VPCs, and the transit gateways are peered across Regions. The company now needs to provide on-premises access to only four specific VPCs using AWS Direct Connect, and it has already provisioned four Direct Connect connections at two Direct Connect locations. The key constraint is cost-effectiveness.

Why Option A is Correct

Option A states: Create four virtual private gateways. Attach the virtual private gateways to the four VPCs.

A virtual private gateway (VGW) is the classic, lightweight VPN/Direct Connect attachment point for a single VPC. Since only four VPCs require on-premises connectivity, creating four VGWs — one per target VPC — is perfectly adequate and avoids the hourly attachment cost of a transit gateway for this traffic path. This directly satisfies the requirement to limit on-premises access to exactly those four VPCs.

Why Option B is Correct

Option B states: Create a Direct Connect gateway. Associate the four virtual private gateways with the Direct Connect gateway.

A Direct Connect gateway (DXGW) is required whenever you want to connect an on-premises network (via Direct Connect) to VPCs in one or more AWS Regions. By associating the four VGWs with a single DXGW, the on-premises router can reach all four VPCs across the three Regions through one logical gateway. This is the standard, well-documented pattern for multi-Region Direct Connect connectivity using VGWs.

Why Option E is Correct

Option E states: Create four private VIFs on each Direct Connect connection to the Direct Connect gateway.

A private virtual interface (VIF) is used to connect a Direct Connect connection to a VGW or DXGW (as opposed to a transit VIF, which connects to a transit gateway). Since the design uses a DXGW associated with VGWs, the correct VIF type is a private VIF. The company has four DX connections, so creating four private VIFs (one per connection) pointing to the DXGW completes the connectivity path.

Why Options C and D are Incorrect

Options C and D propose creating transit VIFs. A transit VIF connects a Direct Connect connection to a transit gateway, not to a VGW or DXGW directly. While this is technically possible, it is significantly more expensive because:

  • You must pay the transit gateway attachment hourly charge in every Region where the DXGW attaches to the TGW.
  • You must pay for transit gateway peering data processing across Regions.
  • You pay for the transit VIF itself.
Community members consistently highlight that "TGW is asking more cost" and that the TGW-based path would also make it harder to restrict on-premises access to only the four target VPCs without careful route-table engineering. Since the question explicitly asks for the MOST cost-effective solution, transit VIFs are the wrong choice.

Furthermore, Option D is technically invalid because transit VIFs cannot be associated with VGWs — they associate only with transit gateways.

Community Consensus

The overwhelming majority of candidates (73 votes) selected A, B, E. Experienced commenters note that the existing transit gateways should remain in place for inter-VPC peering within AWS, while the DXGW + VGW + private VIF pattern is layered on top solely for the on-premises path to the four selected VPCs. This hybrid approach is both cheaper and more precisely scoped than routing on-premises traffic through the transit gateways.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When an AWS exam question emphasizes 'MOST cost-effectively' and only a small subset of VPCs need connectivity, immediately compare the hourly attachment and data-processing costs of transit gateways versus virtual private gateways. Eliminate any option that introduces a transit gateway attachment or transit VIF unless the scenario explicitly requires full-mesh VPC-to-VPC routing through the TGW.

Community Votes

ABE
100%

100% of anonymous learners picked answer ABE. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 10 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 10

  1. psou7 👍 11
    ABE TGW for inter VPC peering within AWS. From on-prem access to only 4 VPCs is required. Hence DXGW and VGW via private VIF. Peering TGW with DXGW would be possible for on-prem connectivity but is more costly. https://docs.aws.amazon.com/whitepapers/latest/hybrid-connectivity/aws-dx-dxgw-with-vgw-multi-regions-and-aws-public-peering.html
  2. KobDragoon 👍 4
    As there is no answer that allows us to configure specific route tables in the TGW to make the DataCenters really only have access to 4 of the 30 VPCs. The most logical solution is ABE, as the other options would allow access to more VPCs than intended.
  3. cerifyme85 👍 3
    TGW for inter VPC peering within AWS. From on-prem access to only 4 VPCs is required. Hence DXGW and VGW via private VIF. Peering TGW with DXGW would be possible for on-prem connectivity but is more costly.
  4. backspace0900 👍 3
    BCF DirectConnectGateway TransitVIF TransitGateway
  5. tromyunpak 👍 2
    ABE are the correct answer as these are required to build the VPG setup. CD are wrong due to the fact all the VPC will access the onpremises (you need to configure the 4 specific VPC prefixes in the DX gateway to TGW association or use different routing tables within the TGW to limit the routes to only the 4 VPCs required to access the on-premises) F is not needed since VPG will be used
Show 5 more comments
  1. Hubabi 👍 1
    From the options presented, it's clear that you need to use DXGW. The only option where "Create a Direct Connect gateway" is stated is option (B). Option (B) also states "Associate the four virtual private gateways with the Direct Connect gateway", thus you need to pick the other two remaining options that make sense with VGW - (A) and (E). Regardless what the cost is, this is the only valid answer that you can select.
  2. MO_SAM 👍 1
    Since there already and exciting TWG there is no need to create VGW and private VIFs, instead just create 4 transit VIF along with DXGW and association to connect things together and hence COST is the main factor!
  3. VerRi 👍 1
    BCF is a good practice but ABE is cheaper.
  4. AlirezaNetWorld 👍 1
    BCF based on the current setup on AWS.
  5. woorkim 👍 2
    TGW is asking more cost!

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

How to make one AWS Direct Connect connection primary and the other failover-only?

S-grade

How to Copy On-Premises Application Logs to Amazon S3 Over AWS Direct Connect?

S-grade

Why Does VPC Traffic Mirroring Randomly Drop Traffic?

S-grade

What is the most secure way to expose cross-account microservices with API Gateway?

S-grade

Practice All ANS-C01 Questions

Access 137 questions with complete answers and detailed explanations.

View Full ANS-C01 Practice Test →

← Back to ANS-C01 Study Guide