Most Cost-Effective AWS Connection for Low-Bandwidth On-Premises Link?

SAA-C03 By islever Editorial Last updated Oct 14, 2026

Design cost-optimized network architectures. Design secure access to AWS resources.

Short answer

D Implement an AWS Site-to-Site VPN connection for the fast, secure and most cost-effective link between on-premises and AWS.

Question

A company needs a secure connection between its on-premises environment and AWS. This connection does not need high bandwidth and will handle a small amount of traffic. The connection should be set up quickly. What is the MOST cost-effective method to establish this type of connection?

Implement a client VPN.
Implement AWS Direct Connect.
Implement a bastion host on Amazon EC2.
Implement an AWS Site-to-Site VPN connection. Correct Answer

Key Takeaways

The question tests hybrid connectivity selection against four constraints — security, low bandwidth, small traffic volume and fast setup — and the trap is jumping to Direct Connect because it sounds like the "enterprise-grade" answer.

This SAA-C03 scenario asks for the most cost-effective way to connect a low-traffic on-premises environment to AWS quickly, and the answer is an AWS Site-to-Site VPN connection. The page explains why a managed IPsec VPN over the internet beats Direct Connect, a client VPN and a bastion host for this small, fast-to-deploy use case.

Common mistake: The most common wrong pick is AWS Direct Connect (B), because candidates associate private dedicated connectivity with security; but Direct Connect requires dedicated circuits, partner coordination and weeks of lead time, making it cost-inefficient and slow for a small amount of traffic.

Expert Analysis

Why the Answer Is Correct

An AWS Site-to-Site VPN connection creates an IPsec tunnel between the on-premises customer gateway and a virtual private gateway or transit gateway in the VPC, providing an encrypted path over the public internet. It is provisioned in minutes and billed by connection-hour plus data transfer, so a low-bandwidth, low-volume link stays cheap. This matches every stated constraint: secure, quick to set up, and cost-effective for small traffic. The AWS documentation linked in the community comments confirms it is the standard mechanism for extending a remote network into a VPC.

Why the Other Options Are Wrong

A client VPN (A) is designed for individual remote users reaching AWS, not for a network-to-network link between a company's data centre and a VPC — as mk168898 put it, it is for "individual connection not company". Direct Connect (B) delivers dedicated private bandwidth but demands physical cross-connects and long provisioning cycles, which is overkill when the question explicitly says high bandwidth is not needed. A bastion host (C) is just an EC2 jump box for administrative SSH/RDP access and provides no site-to-site tunnel for production traffic.

Community Comment Notes

Consensus on the page is unanimous: every recorded vote is for D, and multiple commenters cite the AWS Site-to-Site VPN documentation page directly. Scheldon summarises it plainly — the Site-to-Site VPN "is the best solution here" — while sandordini describes the mechanism of creating the connection and configuring routing on the VPC. mk168898 walks through the rejection of A, B and C one by one, noting that a bastion host is for remote access and that Direct Connect is "overkill" because the question already rules out high bandwidth. No dissenting reasoning appears in the comments, so the source key and learner analysis agree.

Official Reference

https://docs.aws.amazon.com/vpn/latest/s2svpn/VPC_VPN.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

When a connectivity question states its constraints explicitly, score each option against every constraint rather than picking the most impressive-sounding service. Words like "quickly", "small amount of traffic" and "most cost-effective" are deliberate signals that rule out Direct Connect in favour of a managed VPN.

Frequently Asked Questions

Why is AWS Direct Connect not the most cost-effective option here?

Direct Connect needs dedicated circuits or partner provisioning and can take weeks to activate, so it suits sustained high-bandwidth traffic, not the small, fast link described in the question.

Why can't a client VPN satisfy the on-premises-to-AWS requirement?

A client VPN gives individual remote users access into a VPC; it does not build a network-to-network tunnel between a company's on-premises environment and AWS.

More SAA-C03 FAQ →

Community Votes

100%

100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

Scheldon 👍 4 Answered D

AnswerD AWS site-to-site VPN is the best solution here. https://docs.aws.amazon.com/vpn/latest/s2svpn/VPC_VPN.html
sandordini 👍 3 Answered D

You can enable access to your remote (on-prem) network from your VPC by creating an AWS Site-to-Site VPN (Site-to-Site VPN) connection and configuring routing to pass traffic through the connection.
Kaula 👍 3 Answered D

https://docs.aws.amazon.com/vpn/latest/s2svpn/VPC_VPN.html
mk168898 👍 2 Answered D

Not A because for individual conenction not company Not B because overkill, usually for high bandwidth, but qns clearly stated no need for high bandwidth and handle small traffic Not C because bastion host for remote access D because ideal for small amt of traffic

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide