Which AWS Services Connect an On-Premises Network to a VPC?

CLF-C02 By islever Editorial Last updated

Identify AWS network services.

Short answer

AC AWS Site-to-Site VPN and AWS Direct Connect both provide on-premises-to-VPC connectivity.

Question

Which AWS services or features enable users to connect on-premises networks to a VPC? (Choose two.)
  1. AWS VPN Correct Answer
  2. Elastic Load Balancing
  3. AWS Direct Connect Correct Answer
  4. VPC peering
  5. Amazon CloudFront

Key Takeaways

The exam tests hybrid connectivity scope — the trap is picking VPC peering because it also uses the word "connection", even though peering only links VPCs to each other inside AWS.

CLF-C02 tests whether you can distinguish hybrid connectivity services from internal AWS routing and traffic-distribution services. This page confirms that AWS VPN and AWS Direct Connect are the two options that link an on-premises network to a VPC, while VPC peering, ELB and CloudFront do not.

Common mistake: Choosing VPC peering (D) instead of AWS Direct Connect (C), because peering sounds like a network link, but it connects VPC-to-VPC or VPC-to-AWS-service only and never reaches a customer data center.

Expert Analysis

Why the Answer Is Correct

On-premises-to-VPC connectivity is a hybrid networking capability, and AWS provides exactly two primary in-scope services for it: AWS Site-to-Site VPN, which builds encrypted IPsec tunnels over the public internet between a customer gateway and a virtual private gateway or transit gateway, and AWS Direct Connect, which provides a dedicated private fiber link from a customer facility or colocation to AWS. Both terminate into a VPC through a gateway or transit gateway, which is precisely the requirement stated in the question. As xxjbloxx summarized, Site-to-Site VPN "allows you to create a secure, encrypted network tunnel over the public internet," while Direct Connect is a private dedicated connection. Together they are the canonical answer pair for hybrid connectivity in CLF-C02.

Why the Other Options Are Wrong

Elastic Load Balancing (B) distributes incoming application traffic across targets inside one or more Availability Zones — it is a traffic-distribution service, not a WAN link to a data center. VPC peering (D) creates a private routing connection between two VPCs, or between a VPC and another AWS network, but it explicitly does not extend to on-premises networks; as Rinkans noted, it is a "Connection between VPC(not on premises)." Amazon CloudFront (E) is a global content delivery network that caches content at edge locations for end users, and it has no role in establishing private network connectivity from a corporate data center into a VPC.

Community Comment Notes

Learner consensus here is unusually clean: asdfcdsxdfc asked whether "AC looks correct," and OX_HDR, y2k121, fguglia, db97 and EssentialD all confirmed A and C, with fguglia writing "Also for me A and C are correct!" The most useful contribution is Rinkans's option-by-option breakdown, which correctly eliminates ELB, VPC peering and CloudFront by defining each service's actual purpose. For CLF-C02, treat the pairing of VPN plus Direct Connect as the standard heuristic whenever a question asks how a data center reaches a VPC.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When a CLF-C02 question mentions "on-premises," "data center," or "hybrid," scan only for AWS VPN, Direct Connect or Transit Gateway. Any option whose scope is VPC-to-VPC (peering) or user-to-edge (CloudFront, ELB) can be eliminated immediately.

Frequently Asked Questions

Why is VPC peering not a valid way to connect on-premises to a VPC?

VPC peering only routes traffic between two VPCs (or a VPC and an AWS service network); it never extends to a customer data center, so it cannot reach an on-premises network.

When would I choose AWS Direct Connect over AWS VPN?

Pick Direct Connect when you need a dedicated private link with consistent bandwidth and latency that bypasses the public internet; use Site-to-Site VPN for encrypted tunnels over the internet.

More CLF-C02 FAQ →

Discussion 7 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 7

  1. Rinkans 👍 5
    A. AWS VPN B. Elastic Load Balancing - automatically distributes incoming application traffic across multiple targets and virtual appliances in one or more Availability Zones (AZs) C. AWS Direct Connect D. VPC peering - Connection between VPC(not on premises) E. Amazon CloudFront - content delivery network (CDN) service globally
  2. asdfcdsxdfc 👍 3
    AC looks correct, can anyone confirm?
  3. xxjbloxx 👍 1
    These are the correct choices:AWS VPN (specifically AWS Site-to-Site VPN) allows you to create a secure, encrypted network tunnel over the public internet between your on-premises data center or office network and your Amazon VPC.AWS Direct Connect establishes a dedicated, private network connection from your on-premises facility directly to AWS. Because it completely bypasses the public internet, it delivers more consistent network performance and lower latency than a VPN.
  4. fguglia 👍 1
    Also for me A and C are correct!
  5. EssentialD 👍 1
    They looks correct, so AC
Show 2 more comments
  1. db97 👍 1
    You're right buddy
  2. OX_HDR 👍 1
    A and C

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Which migration strategies move a cloud-incompatible CMS with least effort?

S-grade

Launching Third-Party IDS in AWS

S-grade

Which AWS Support Plan Offers API Access Most Cost-Effectively?

S-grade

S3 Express One Zone for Single-Digit Millisecond Latency

S-grade

Practice All CLF-C02 Questions

Access 120 questions with complete answers and detailed explanations.

View Full CLF-C02 Practice Test →

← Back to CLF-C02 Study Guide