Connecting global WAN to data in multiple Regions over Direct Connect Gateway

SAP-C02 By islever Editorial Last updated

Architect network connectivity strategies.

Short answer

D Use two Direct Connect links from HQ to one Region and a Direct Connect Gateway to reach VPCs in other Regions privately and cost-effectively.

Question

To abide by industry regulations, a solutions architect must design a solution that will store a company's critical data in multiple public AWS Regions, including in the United States, where the company's headquarters is located. The solutions architect is required to provide access to the data stored in AWS to the company’s global WAN network. The security team mandates that no traffic accessing this data should traverse the public internet. How should the solutions architect design a highly available solution that meets the requirements and is cost-effective?
  1. Establish AWS Direct Connect connections from the company headquarters to all AWS Regions in use. Use the company WAN to send traffic over to the headquarters and then to the respective DX connection to access the data.
  2. Establish two AWS Direct Connect connections from the company headquarters to an AWS Region. Use the company WAN to send traffic over a DX connection. Use inter-region VPC peering to access the data in other AWS Regions.
  3. Establish two AWS Direct Connect connections from the company headquarters to an AWS Region. Use the company WAN to send traffic over a DX connection. Use an AWS transit VPC solution to access data in other AWS Regions.
  4. Establish two AWS Direct Connect connections from the company headquarters to an AWS Region. Use the company WAN to send traffic over a DX connection. Use Direct Connect Gateway to access data in other AWS Regions. Correct Answer

Key Takeaways

A Direct Connect Gateway attaches to DX connections and to VPCs across Regions, so two DX links at one Region can privately reach data in other Regions — more cost-effective than DX to every Region or a transit VPC.

Critical data spans multiple public Regions and must be reachable from a global WAN without traversing the public internet. Two DX connections from HQ to one Region plus a Direct Connect Gateway extend private connectivity to VPCs in other Regions cost-effectively, without per-Region DX circuits.

Common mistake: Using inter-region VPC peering (Option B) over DX does not provide a clean private path across Regions via the WAN, and a transit VPC (Option C) adds cost and operational overhead versus a DXGW.

Expert Analysis

Why the Answer Is Correct

Option D establishes two DX connections from HQ to a single Region (for resilience) and uses a Direct Connect Gateway to associate those connections with VPCs in other Regions. This keeps all traffic on private AWS backbone (no public internet) and avoids provisioning a separate DX circuit to every Region, satisfying the cost-effectiveness requirement.

Why the Other Options Are Wrong

Option A requires a DX connection to every Region, which is expensive and not cost-effective. Option B relies on inter-region VPC peering, which does not extend the on-prem WAN path cleanly across Regions. Option C uses a transit VPC, adding operational overhead and cost versus the native DXGW.

Community Comment Notes

trungtd (likes 5) succinctly endorses DX + DXGW. sarlos notes that TGW is regional, so D is correct. TomTom prefers B for cost but overlooks that DXGW is the purpose-built multi-Region private reachability mechanism.

Official Reference

https://docs.aws.amazon.com/directconnect/latest/UserGuide/direct-connect-gateways.html

This link opens the official vendor documentation in a new tab.

Community Votes

D
100%

100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 10 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 10

  1. adelynllllllllll 👍 4
    D: Need direct connect gateway to share with other regions
  2. AzureDP900 👍 3
    This solution meets the requirements and is cost-effective. Option D AWS Direct Connect: This service allows you to establish a dedicated network connection between your premises and an AWS Region, which bypasses the public internet. Two connections: Establishing two connections provides redundancy, ensuring that if one connection fails, the other can take over. This meets the requirement for high availability. Direct Connect Gateway: By using a Direct Connect Gateway, you can extend the connectivity to multiple AWS Regions, allowing your global WAN network to access data in those regions without traversing the public internet.
  3. nharaz 👍 3 Answered D
    D - offers a blend of high availability (through redundancy with two DX connections), cost-effectiveness (by reducing the number of DX connections required), and simplicity (by avoiding the complexity of managing a transit VPC or multiple peering connections).
  4. sarlos 👍 3
    between C and D: TGW is a regional service. So D is the answer
  5. kejam 👍 2 Answered D
    https://docs.aws.amazon.com/whitepapers/latest/building-scalable-secure-multi-vpc-network-infrastructure/direct-connect.html
Show 5 more comments
  1. TomTom 👍 1 Answered B
    The most cost-effective option for accessing data across multiple AWS Regions while using AWS Direct Connect is B.
  2. trungtd 👍 5 Answered D
    DX + DXGW
  3. alexis123456 👍 2
    Correct Answer is D
  4. TheCloudGuruu 👍 1 Answered C
    C. transit VPC
  5. career360guru 👍 1 Answered D
    Option D

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Modernize centralized firewall appliances with a Gateway Load Balancer and Auto Scaling

S-grade

Use Lambda over a CloudWatch Logs stream to count unique users per client

S-grade

Serve global game assets with Route 53 latency records and health checks

S-grade

Reach a cross-account S3 data lake through a gateway endpoint and an access point bucket policy

S-grade

Practice All SAP-C02 Questions

Access 85 questions with complete answers and detailed explanations.

View Full SAP-C02 Practice Test →

← Back to SAP-C02 Study Guide