Direct Connect Backup: Why a Site-to-Site VPN Beats a Second VIF

SAP-C02 By islever Editorial Last updated

Architect network connectivity strategies.

Short answer

D Add a static AWS Site-to-Site VPN as an independent, encrypted secondary path that provides resilience for the 1 Gbps Direct Connect connection cost-effectively.

Question

A company is designing an AWS environment for a manufacturing application. The application has been successful with customers, and the application's user base has increased. The company has connected the AWS environment to the company's on-premises data center through a 1 Gbps AWS Direct Connect connection. The company has configured BGP for the connection.
The company must update the existing network connectivity solution to ensure that the solution is highly available, fault tolerant, and secure.
Which solution will meet these requirements MOST cost-effectively?
  1. Add a dynamic private IP AWS Site-to-Site VPN as a secondary path to secure data in transit and provide resilience for the Direct Connect connection. Configure MACsec to encrypt traffic inside the Direct Connect connection.
  2. Provision another Direct Connect connection between the company's on-premises data center and AWS to increase the transfer speed and provide resilience. Configure MACsec to encrypt traffic inside the Direct Connect connection.
  3. Configure multiple private VIFs. Load balance data across the VIFs between the on-premises data center and AWS to provide resilience.
  4. Add a static AWS Site-to-Site VPN as a secondary path to secure data in transit and to provide resilience for the Direct Connect connection. Correct Answer

Key Takeaways

The trap is confusing logical redundancy with physical redundancy: private VIFs and private-IP VPNs still ride the same Direct Connect circuit, and MACsec is unavailable at 1 Gbps.

This SAP-C02 question tests how to add cost-effective resilience to a 1 Gbps Direct Connect link. The correct answer is D: a public AWS Site-to-Site VPN as an encrypted secondary path, because MACsec needs 10/100 Gbps and multiple VIFs share one physical circuit.

Common mistake: Option A is the most plausible wrong answer: its dynamic BGP VPN and MACsec sound more modern and secure, but MACsec is unsupported on a 1 Gbps Direct Connect port and a private-IP VPN traverses Direct Connect itself, so it cannot back it up.

Expert Analysis

The boundary in question: independent resilience vs. sharing the same circuit. The requirement is high availability, fault tolerance and security for an existing 1 Gbps Direct Connect link that already runs BGP, at the lowest cost. The deciding constraints are the link speed and the physical path each option rides on.

Why MACsec eliminates A and B. AWS supports MACsec only on 10 Gbps and 100 Gbps Direct Connect ports, not on the 1 Gbps connection described here. Both A and B attach "Configure MACsec" to the existing or a new link, so neither is valid as written. B is additionally the most expensive option, since provisioning a second DX circuit carries port and cross-connect charges.

Why C fails the fault-tolerance test. Multiple private VIFs are logical interfaces on the same physical Direct Connect connection. As one comment notes, "a single AWS Direct Connect connection with multiple private virtual interfaces (VIFs) does not provide redundancy, as all the VIFs share the same underlying physical connection." A fiber cut or port failure takes down every VIF at once, so C delivers neither fault tolerance nor independent security.

Why D is correct. An AWS Site-to-Site VPN over the public internet rides a completely separate physical path from Direct Connect, so it survives a DX outage, and IPsec encrypts data in transit — satisfying both resilience and security. It is far cheaper than a second DX circuit, which is why it is the MOST cost-effective choice. The trap is A: its dynamic (BGP) private VPN sounds superior, and one comment argues BGP-based failover is "better for automatic failover," but a private IP VPN traverses Direct Connect itself, so it cannot back up the very connection it depends on — and A still requires the unsupported MACsec. With BGP already configured on DX, D's static routing is a tolerable trade-off for a backup path that actually exists off-circuit.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

On connectivity-resilience questions, first check whether each option rides a physically independent path — anything on the same Direct Connect circuit (private VIFs, private-IP VPN) cannot back it up. Then verify feature prerequisites such as MACsec's 10/100 Gbps requirement, and finally weigh cost: a public IPsec VPN is the standard cheap backup to a DX link. Eliminate options failing any gate before comparing wording like dynamic versus static routing.

Frequently Asked Questions

Why can't MACsec be used on a 1 Gbps Direct Connect connection?

AWS supports MACsec encryption only on 10 Gbps and 100 Gbps Direct Connect ports. On the existing 1 Gbps link in this scenario, MACsec cannot be configured, so any option requiring it is invalid.

Do multiple private VIFs make a Direct Connect connection highly available?

No. Private VIFs are logical interfaces that share the same physical Direct Connect circuit, so a port or fiber failure takes down all of them simultaneously.

Why is a public Site-to-Site VPN a better backup for Direct Connect than a private-IP VPN?

A public Site-to-Site VPN travels over the internet on a separate physical path, so it survives a Direct Connect outage, while a private-IP VPN traverses Direct Connect itself and fails with it.

More SAP-C02 FAQ →

Community Votes

D
59%
A
41%

59% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 23 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 23

  1. oayoade 👍 14 Answered D
    MACsec is only supported on 10gbps and 100gbps Direct Connect https://docs.aws.amazon.com/directconnect/latest/UserGuide/direct-connect-mac-sec-getting-started.html
  2. CMMC 👍 4 Answered A
    Provide resilience for the Direct Connect connection. Configure MACsec to encrypt traffic inside the Direct Connect connection. More cost effective than the static Site-to-Site VPN in Option D (which does not have the MACsec encryption for additional security).
  3. Curious76 👍 2 Answered A
    Static VPN doesn’t use BGP — so no automatic failover, more manual effort or config needed compared to dynamic VPN.
  4. djangoUnchained 👍 2 Answered D
    With A the VPN is dependent on the DX connection, so not adding any resilience. VPN is encrypted by default, D.
  5. Daniel76 👍 2
    This URL was updated as it supports 400gbps. (it does not change the answer).
Show 18 more comments
  1. k23319 👍 2 Answered A
    MACSec is the difference here for the additional security for Direct Connect.
  2. joseribas89 👍 2 Answered D
    as oayoade says we need at least 10gbps to use MACsec, so option D
  3. stantx 👍 1 Answered D
    Correct answer: D — Add a Site-to-Site VPN as a secondary path. An internet-based Site-to-Site VPN provides an independent, encrypted backup connection at a lower cost than provisioning another Direct Connect circuit. Option Assessment A MACsec is unavailable on the existing 1 Gbps connection. Also, private IP VPN runs over Direct Connect, so it cannot independently back up that same connection. B A second Direct Connect connection costs more, and MACsec cannot encrypt the existing 1 Gbps connection. C Multiple VIFs share the same physical connection, so they do not protect against its failure. D Adds an independent, encrypted backup path economically. AWS supports MACsec on selected 10, 100, and 400 Gbps dedicated connections, not 1 Gbps. Private IP VPN uses Direct Connect as its underlying transport.
  4. ovladan 👍 1
    Solution: A If we look at the request "MOST cost-effectively" we can eliminate the answer under B. If we look at this part of the requirement "the solution is highly available, fault tolerant" we can eliminate C. If we look at this part "The company has configured BGP for the connection" and "the solution is ... secure" we can eliminate D, because the current Direct Connect connection is not encrypted and answer under D does not offer a solution to encrypt the traffic. Base on this answer under A is right choice.
  5. titi_r 👍 1 Answered D
    Answer: D To encrypt data over DX, you use MACsec for 10 Gbps and 100 Gbps links, and S2S VPN for slower links (e.g. 1 Gbps). https://docs.aws.amazon.com/whitepapers/latest/aws-vpc-connectivity-options/aws-direct-connect-site-to-site-vpn.html https://repost.aws/knowledge-center/create-vpn-direct-connect https://aws.amazon.com/blogs/networking-and-content-delivery/adding-macsec-security-to-aws-direct-connect-connections/
  6. TomTom 👍 1
    Why not C? Adding multiple VIFs to your Direct Connect connection is a cost-effective way to increase redundancy and improve performance. https://docs.aws.amazon.com/whitepapers/latest/building-scalable-secure-multi-vpc-network-infrastructure/direct-connect.html#:~:text=Option%201%3A%20Create%20a%20private,allowing%20you%20to%20connect%20to
  7. Curious76 👍 1 Answered A
    The type of routing that you select can depend on the make and model of your customer gateway device. If your customer gateway device supports Border Gateway Protocol (BGP), specify dynamic routing when you configure your Site-to-Site VPN connection. If your customer gateway device does not support BGP, specify static routing.
  8. nimbus_00 👍 1
    A single AWS Direct Connect connection with multiple private virtual interfaces (VIFs) does not provide redundancy, as all the VIFs share the same underlying physical connection.
  9. Amac1979 👍 1 Answered A
    Dynamic (BGP) Dynamic VPN uses BGP — matches the existing BGP setup on Direct Connect. Enables automatic failover without manual route changes.
  10. OCHT 👍 1 Answered A
    D — Static VPN is possible but dynamic (BGP) is better for automatic failover and preferred in modern designs. That's why I choose A.
  11. HarryNZ1982 👍 1
    Yes I agree A is the correct answer because it is Dynamic BGP based AWS Site-to-Site VPN provides HA and Fault Tolerance
  12. Daniel76 👍 1
    https://docs.aws.amazon.com/directconnect/latest/UserGuide/MACsec.html
  13. Dgix 👍 1 Answered A
    A is the correct answer. D uses static routing which is less suitable.
  14. ahmadraufsyahputra 👍 1
    A because dynamic IP is more resilence than static IP
  15. ArunRav 👍 1 Answered D
    D as mentioned by oayoade.
  16. zawminhtay.it.ucsm 👍 1 Answered D
    same as oayosde mentioned,
  17. trungtd 👍 1 Answered D
    mentioned by oayoade.
  18. pangchn 👍 1 Answered D
    vote for D too

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Cost-Effective Image Processing with SQS and S3 Lifecycle Policies

S-grade

Modernize centralized firewall appliances with a Gateway Load Balancer and Auto Scaling

S-grade

Use Lambda over a CloudWatch Logs stream to count unique users per client

S-grade

Serve global game assets with Route 53 latency records and health checks

S-grade

Practice All SAP-C02 Questions

Access 85 questions with complete answers and detailed explanations.

View Full SAP-C02 Practice Test →

← Back to SAP-C02 Study Guide