Which AWS Services Connect an On-Premises Network to a VPC?
Which AWS services or features enable users to connect on-premises networks to a VPC? (Choose two.)
Community Insight
The exam tests hybrid connectivity scope — the trap is picking VPC peering because it also uses the word "connection", even though peering only links VPCs to each other inside AWS.
CLF-C02 tests whether you can distinguish hybrid connectivity services from internal AWS routing and traffic-distribution services. This page confirms that AWS VPN and AWS Direct Connect are the two options that link an on-premises network to a VPC, while VPC peering, ELB and CloudFront do not.
Choosing VPC peering (D) instead of AWS Direct Connect (C), because peering sounds like a network link, but it connects VPC-to-VPC or VPC-to-AWS-service only and never reaches a customer data center.
Community Discussion (8 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
On-premises-to-VPC connectivity is a hybrid networking capability, and AWS provides exactly two primary in-scope services for it: AWS Site-to-Site VPN, which builds encrypted IPsec tunnels over the public internet between a customer gateway and a virtual private gateway or transit gateway, and AWS Direct Connect, which provides a dedicated private fiber link from a customer facility or colocation to AWS. Both terminate into a VPC through a gateway or transit gateway, which is precisely the requirement stated in the question. As xxjbloxx summarized, Site-to-Site VPN "allows you to create a secure, encrypted network tunnel over the public internet," while Direct Connect is a private dedicated connection. Together they are the canonical answer pair for hybrid connectivity in CLF-C02.
Why the Other Options Are Wrong
Elastic Load Balancing (B) distributes incoming application traffic across targets inside one or more Availability Zones — it is a traffic-distribution service, not a WAN link to a data center. VPC peering (D) creates a private routing connection between two VPCs, or between a VPC and another AWS network, but it explicitly does not extend to on-premises networks; as Rinkans noted, it is a "Connection between VPC(not on premises)." Amazon CloudFront (E) is a global content delivery network that caches content at edge locations for end users, and it has no role in establishing private network connectivity from a corporate data center into a VPC.
Community Comment Notes
Learner consensus here is unusually clean: asdfcdsxdfc asked whether "AC looks correct," and OX_HDR, y2k121, fguglia, db97 and EssentialD all confirmed A and C, with fguglia writing "Also for me A and C are correct!" The most useful contribution is Rinkans's option-by-option breakdown, which correctly eliminates ELB, VPC peering and CloudFront by defining each service's actual purpose. For CLF-C02, treat the pairing of VPN plus Direct Connect as the standard heuristic whenever a question asks how a data center reaches a VPC.
Official Reference
Exam Strategy
When a CLF-C02 question mentions "on-premises," "data center," or "hybrid," scan only for AWS VPN, Direct Connect or Transit Gateway. Any option whose scope is VPC-to-VPC (peering) or user-to-edge (CloudFront, ELB) can be eliminated immediately.
Frequently Asked Questions
Why is VPC peering not a valid way to connect on-premises to a VPC?
VPC peering only routes traffic between two VPCs (or a VPC and an AWS service network); it never extends to a customer data center, so it cannot reach an on-premises network.
When would I choose AWS Direct Connect over AWS VPN?
Pick Direct Connect when you need a dedicated private link with consistent bandwidth and latency that bypasses the public internet; use Site-to-Site VPN for encrypted tunnels over the internet.
Related Analysis
Practice All CLF-C02 Questions
Access 120 questions with complete answers and detailed explanations.
View Full CLF-C02 Practice Test →