How should transit VIF associations be configured on Direct Connect gateways?
An international company wants to implement a multi-site hybrid infrastructure. The company wants to deploy its cloud computing resources on AWS in the us-east-1 Region and in the eu-west-2 Region, and in on-premises data centers in the United States (US) and in the United Kingdom (UK). The data centers are connected to each other by a private WAN connection. IP routing information is exchanged dynamically through BGP. The company wants to have two AWS Direct Connect connections, one each in the US and the UK. The company expects to have 15 VPCs in each Region with CIDR blocks that do not overlap with each other or with CIDR blocks of the on-premises environment. The VPC CIDR blocks are planned so that the prefix aggregation can be performed both on a Regional level and across the entire AWS environment. The company will deploy a transit gateway in each Region to connect the VPCs. A network engineer plans to use a Direct Connect gateway in each Region. A transit VIF will attach the Direct Connect gateway in each Region to the transit gateway in that Region. The transit gateways will be peered with each other. The network engineer wants to ensure that traffic follows the shortest geographical path from source to destination. Traffic between the on-premises data centers and AWS must travel across a local Direct Connect connection. Traffic between the US data center and eu-west-2 and traffic between the UK data center and us-east-1 must use the private WAN connection to reach the Direct Connect connection to the appropriate Region when the Direct Connect connection is available. The network must be resilient to failures in either the private WAN connection or with the Direct Connect connections. The network also must reroute traffic automatically in the event of any failure. How should the network engineer configure the transit VIF associations on the Direct Connect gateways to meet these requirements?
Community Votes
75% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
This question tests understanding of BGP longest-prefix matching, route aggregation, and route advertisement on Direct Connect gateways, with the common trap being over-reliance on BGP communities instead of using specific routes for path selection.
The correct approach is to advertise only local VPC-specific CIDR prefixes plus a single aggregate route for the entire AWS environment. This combines BGP longest-prefix matching with aggregation to enforce shortest-path routing and automatic failover across Direct Connect and the private WAN.
The most common wrong answer is D, which advertises both regional aggregates and uses custom BGP communities. Candidates choose D because community-based policy can influence path selection, but it adds unnecessary complexity and does not leverage the automatic, simple longest-prefix behavior that makes Option B resilient and easy to operate.
Community Discussion (5 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Understanding the Topology
In this scenario, the company has two AWS Regions (us-east-1 and eu-west-2), two on-premises data centers (US and UK), and a private WAN connecting the data centers. Each site has a Direct Connect connection to its local AWS Region, and each Region has a transit gateway. The transit gateways are peered. Each Direct Connect gateway is associated to the local transit gateway through a transit VIF. The requirement is to use the local Direct Connect for all traffic between an on-premises site and the AWS Region in the same country, and to use the private WAN to reach the remote Region's Direct Connect for cross-region traffic. The network must also automatically reroute if either Direct Connect or the private WAN fails.
Why Option B Is Correct
Option B says: Advertise VPC-specific CIDR prefixes from only the local Region. Additionally, advertise the aggregate route for the company’s entire AWS environment.
This works because BGP route selection uses the longest-prefix match first. For a local VPC (for example, a us-east-1 VPC prefix), the US data center receives the specific prefix directly over the US Direct Connect connection. That specific prefix is more specific than any aggregate route, so traffic stays local. For a remote-region VPC (for example, an eu-west-2 VPC prefix), the US Direct Connect gateway does not advertise eu-west-2 specific prefixes. Instead, the UK Direct Connect gateway advertises its local eu-west-2 VPC prefixes to the UK data center, and the UK data center then advertises them over the private WAN to the US data center. Because those remote-specific prefixes are present only over the WAN path, the US router chooses the WAN route, which satisfies the requirement to use the private WAN for cross-region traffic.
The aggregate route for the entire AWS environment provides the resilience mechanism. If the private WAN fails, the remote-specific routes disappear, leaving only the aggregate route over the local Direct Connect. Traffic continues to flow to the remote VPC by going through the local Direct Connect, the local transit gateway, the transit gateway peering, and then the remote transit gateway. Similarly, if a Direct Connect connection fails, the site still has the aggregate route from the other site over the WAN, allowing automatic rerouting.
Why the Other Options Are Wrong
Option A is too restrictive. Advertising only the global aggregate would send all traffic to one path and cannot satisfy the requirement to use the local Direct Connect for local VPCs. There would be no specific routes to make shortest-path decisions.
Option C is too verbose and harmful. Advertising all VPC-specific prefixes from both Regions would make each Direct Connect gateway advertise both local and remote VPC prefixes directly to its data center. For example, the US Direct Connect gateway would learn eu-west-2 VPC routes through the transit gateway peering and advertise them to the US data center. The US router would then see eu-west-2 specific prefixes over both the local Direct Connect and the private WAN. With similar prefix lengths, the local Direct Connect route may be preferred due to shorter AS path, causing traffic to travel over the AWS backbone instead of the private WAN, violating the requirement.
Option D looks tempting because it uses BGP communities for path control. It would advertise both regional aggregate prefixes and tag them with communities, allowing on-premises routers to set local preference values. However, this requires complex BGP community policy configuration on every router. It does not provide the clean longest-prefix separation that Option B gives. It also risks misconfigured communities and does not take advantage of the VPC-specific prefixes that make automatic routing decisions based on prefix length. Given the company has 15 VPCs per Region, the simpler and more robust approach is to advertise local specifics plus a single global aggregate.
Community Consensus
Community voting strongly favors Option B with 75% of votes, while 25% chose Option D. Several commenters point out that Option B is straightforward, provides granular routing, and works with BGP longest-prefix matching. Others correctly note that Option D, while possible, is less optimal and more complex. The key exam takeaway is to prefer simple, standards-based routing behavior over additional BGP policy knobs when a longest-prefix solution satisfies the design requirement.
Official Reference
Exam Strategy
When answering AWS networking scenario questions, first check how route propagation, prefix length, and BGP attributes affect path selection. Look for options that use longest-prefix matching to naturally steer traffic before considering complex BGP policies like communities; simpler solutions that meet all resilience requirements are often the correct answer.
Related Analysis
Practice All ANS-C01 Questions
Access 137 questions with complete answers and detailed explanations.
View Full ANS-C01 Practice Test →