How to Connect On-Premises to a Transit Gateway with Single-Digit Latency?

Why the Answer Is Correct

Single-digit latency between on-premises data centers and AWS workloads can only be engineered predictably over a dedicated private circuit, which means AWS Direct Connect — so option D, establishing a Direct Connect connection and creating a transit virtual interface (VIF) attached to a Direct Connect gateway, is mandatory. Option B completes the topology: the Direct Connect gateway must be associated with the Transit Gateway that already attaches the company's VPCs, so one dedicated connection reaches every VPC through the existing hub. Together, B and D give private, high-bandwidth, low-latency transit without building a Direct Connect connection or VIF per VPC. Because the Transit Gateway is reused rather than replaced, the design is also the cheapest way to satisfy the latency requirement.

Why the Other Options Are Wrong

Option A builds a Site-to-Site VPN into each VPC, which multiplies connections and still runs over the public internet with variable latency and encryption overhead — it fails the single-digit latency requirement and does not scale with the Transit Gateway. Option E attaches VPN connections to the Transit Gateway, which is architecturally tidy and cheap but again internet-dependent, so latency is neither low nor predictable. Option C chains a Site-to-Site VPN to a Direct Connect gateway, a topology that does not exist as a supported association for Transit Gateway routing and would not deliver the dedicated-path latency the workloads need. None of these options provide the dedicated private network path that Direct Connect does.

Community Comment Notes

The community consensus is firmly BD, with muhammadahmer36 stating simply "BD is correct" and MSAM16 agreeing. jingen11 initially picked BE and objected that "D is not cheap", which captures the real trap in this question: Direct Connect is the pricier option in isolation, but it is the only one that meets the single-digit latency requirement, so cost must be optimized within that constraint. LeonSauveterre's study memo reinforces the distinction — VPN is encrypted traffic over the public internet with higher latency, while Direct Connect is dedicated private connectivity for large workloads.