ANS-C01 practice question 15 of 35

A company is using an AWS Site-to-Site VPN connection from the company's on-premises data center to a virtual private gateway in the AWS Cloud…

A company is using an AWS Site-to-Site VPN connection from the company's on-premises data center to a virtual private gateway in the AWS Cloud Because of congestion, the company is experiencing availability and performance issues as traffic travels across the internet before the traffic reaches AWS. A network engineer must reduce these issues for the connection as quickly as possible with minimum administration effort. Which solution will meet these requirements?

Answer options

A: Edit the existing Site-to-Site VPN connection by enabling acceleration. Stop and start the VPN service on the customer gateway for the new setting to take effect.

B: Configure a transit gateway in the same AWS Region as the existing virtual private gateway. Create a new accelerated Site-to-Site VPN connection. Connect the new connection to the transit gateway by using a VPN attachment. Update the customer gateway device to use the new Site to Site VPN connection. Delete the existing Site-to-Site VPN connection Correct answer

C: Create a new accelerated Site-to-Site VPN connection. Connect the new Site-to-Site VPN connection to the existing virtual private gateway. Update the customer gateway device to use the new Site-to-Site VPN connection. Delete the existing Site-to-Site VPN connection.

D: Create a new AWS Direct Connect connection with a private VIF between the on-premises data center and the AWS Cloud. Update the customer gateway device to use the new Direct Connect connection. Delete the existing Site-to-Site VPN connection.

Correct Answer:

B. Configure a transit gateway in the same AWS Region as the existing virtual private gateway. Create a new accelerated Site-to-Site VPN connection. Connect the new connection to the transit gateway by using a VPN attachment. Update the customer gateway device to use the new Site to Site VPN connection. Delete the existing Site-to-Site VPN connection

Explanation

An accelerated Site-to-Site VPN connection uses AWS Global Accelerator to route traffic from the on-premises network through the nearest AWS edge location. This traffic then travels over the AWS global network backbone to the AWS Region, avoiding internet congestion and improving performance. A key requirement is that accelerated VPN connections can only be attached to a transit gateway, not a virtual private gateway. Creating a new accelerated connection and attaching it to a new transit gateway is the fastest way to implement this performance improvement with minimal administrative overhead compared to ordering a physical Direct Connect circuit.

Why Incorrect

A. Acceleration cannot be enabled on an existing standard VPN connection; a new, specific "accelerated" connection must be created.
C. Accelerated Site-to-Site VPN connections cannot be attached to a virtual private gateway (VGW); they require a transit gateway.
D. AWS Direct Connect provides excellent performance but is not a quick solution and involves significant administrative effort and lead time for provisioning.

References

1. AWS Documentation, "Accelerated Site-to-Site VPN connections". It states, "An accelerated Site-to-Site VPN connection (Accelerated VPN) uses AWS Global Accelerator to route traffic from your on-premises network to an AWS edge location that is closest to your customer gateway device."

2. AWS Documentation, "Accelerated Site-to-Site VPN connections - Rules and restrictions". It explicitly states, "You must specify a transit gateway for the target gateway. You cannot specify a virtual private gateway."

3. AWS Documentation, "What is AWS Global Accelerator?". The documentation explains how Global Accelerator improves performance by using the "congestion-free AWS global network".

Keep practicing

Take the free ANS-C01 practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test