ANS-C01 practice question 26 of 35

A company is planning to deploy many software-defined WAN (SD-WAN) sites. The company is using AWS Transit Gateway and has deployed a transit gateway…

A company is planning to deploy many software-defined WAN (SD-WAN) sites. The company is using AWS Transit Gateway and has deployed a transit gateway in the required AWS Region. A network engineer needs to deploy the SD-WAN hub virtual appliance into a VPC that is connected to the transit gateway. The solution must support at least 5 Gbps of throughput from the SD-WAN hub virtual appliance to other VPCs that are attached to the transit gateway. Which solution will meet these requirements?

Answer options

A: Create a new VPC for the SD-WAN hub virtual appliance. Create two IPsec VPN connections between the SD-WAN hub virtual appliance and the transit gateway. Configure BGP over the IPsec VPN connections

B: Assign a new CIDR block to the transit gateway. Create a new VPC for the SD-WAN hub virtual appliance. Attach the new VPC to the transit gateway with a VPC attachment. Add a transit gateway Connect attachment. Create a Connect peer and specify the GRE and BGP parameters. Create a route in the appropriate VPC for the SD-WAN hub virtual appliance to route to the transit gateway. Correct answer

C: Create a new VPC for the SD-WAN hub virtual appliance. Attach the new VPC to the transit gateway with a VPC attachment. Create two IPsec VPN connections between the SD-WAN hub virtual appliance and the transit gateway. Configure BGP over the IPsec VPN connections.

D: Assign a new CIDR block to the transit gateway. Create a new VPC for the SD-WAN hub virtual appliance. Attach the new VPC to the transit gateway with a VPC attachment. Add a transit gateway Connect attachment. Create a Connect peer and specify the VXLAN and BGP parameters. Create a route in the appropriate VPC for the SD-WAN hub virtual appliance to route to the transit gateway.

Correct Answer:

B. Assign a new CIDR block to the transit gateway. Create a new VPC for the SD-WAN hub virtual appliance. Attach the new VPC to the transit gateway with a VPC attachment. Add a transit gateway Connect attachment. Create a Connect peer and specify the GRE and BGP parameters. Create a route in the appropriate VPC for the SD-WAN hub virtual appliance to route to the transit gateway.

Explanation

Analysis

Correct Answer: [B]

Explanation

The key requirement is at least 5 Gbps throughput. A standard AWS Site-to-Site IPsec VPN attachment is limited to a maximum of 1.25 Gbps per tunnel (aggregate throughput per VPN connection ~2.5 Gbps with ECMP), which cannot meet 5 Gbps. The Transit Gateway Connect attachment is purpose-built for SD-WAN appliances and supports up to 5 Gbps default (max 20 Gbps) per Connect peer, using GRE as the tunnel protocol and BGP for dynamic routing. A Connect attachment is created on top of an existing VPC (or Direct Connect) transport attachment. Therefore, creating a VPC attachment, then a Connect attachment specifying GRE and BGP parameters, satisfies both the throughput and dynamic routing requirements.

Why Incorrect Options are Wrong

A. IPsec VPN tunnels cap at ~1.25 Gbps each; cannot reach 5 Gbps. Also omits required VPC attachment as transport.

C. Same IPsec throughput limitation (~1.25 Gbps/tunnel); IPsec VPN cannot achieve 5 Gbps to other VPCs.

D. Transit Gateway Connect uses GRE, not VXLAN, as its tunnel encapsulation protocol; specifying VXLAN is technically incorrect.

References

1. AWS Transit Gateway Documentation – "Transit gateway Connect attachments and Transit Gateway Connect peers," Amazon VPC Developer Guide: States Connect uses GRE tunnel protocol with BGP, and each Connect peer supports up to 5 Gbps default throughput (max 20 Gbps per attachment across up to 4 peers). Section: Connect attachments.

2. AWS Site-to-Site VPN User Guide – "Site-to-Site VPN quotas / tunnel throughput," Amazon: Documents ~1.25 Gbps maximum per VPN tunnel, confirming IPsec cannot meet the 5 Gbps requirement.

3. AWS Transit Gateway Documentation – "Transit gateway Connect and Connect peers – Requirements," Amazon VPC Transit Gateways Guide: Specifies that a transport attachment (VPC or Direct Connect) must exist before creating a Connect attachment, and a CIDR (inside/transit CIDR block) must be specified for the Connect peer.

4. AWS Whitepaper – "Building a Scalable and Secure Multi-VPC AWS Network Infrastructure," Amazon (Transit Gateway Connect section): Describes Connect as the recommended integration for SD-WAN virtual appliances using GRE + BGP for higher bandwidth and dynamic routing.

---

Note: The provided answer (D) is incorrect. Transit Gateway Connect uses GRE encapsulation, not VXLAN. Option B correctly specifies GRE and BGP parameters and meets the 5 Gbps requirement.

Why Incorrect

A. Two IPsec tunnels offer ~2.5 Gbps aggregate—insufficient capacity.
C. Same bandwidth limitation as A; attaching the hub VPC does not raise the tunnel limit.
D. Transit Gateway Connect supports GRE, not VXLAN; specifying VXLAN is invalid and unsupported.

References

1. AWS Transit Gateway Connect, “Performance – up to 20 Gbps per Connect attachment” (VPC Guide, 2023-07-18, §‘Quotas and performance’)

2. AWS Site-to-Site VPN quotas, “1.25 Gbps per tunnel” (AWS VPN Docs, 2023-05-30, §‘Throughput limits’)

3. AWS Transit Gateway Connect, “Connect peer configuration uses GRE encapsulation with BGP” (VPC Guide, §‘Connect peer’)

Keep practicing

Take the free ANS-C01 practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test