SOA-C03 practice question: Hybrid and private connectivity

Networking and Content Delivery A free question from our original SOA-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.

A dental chain connects its head office to a VPC with an AWS Site-to-Site VPN.

The customer gateway device supports BGP, but the network team configured only tunnel 1 with static routes. Last night, connectivity to AWS dropped for 20 minutes, and the AWS Health Dashboard showed scheduled maintenance on that VPN endpoint.

The chain wants the VPN to keep working during future AWS maintenance and tunnel failures without manual action.

What should a CloudOps engineer recommend?

Choose one answer.

A. Configure both tunnels on the customer gateway device and run BGP dynamic routing over them so that traffic fails over between tunnels automatically.
B. Ask AWS Support to exclude the chain's VPN endpoint from scheduled maintenance so that tunnel 1 stays available at all times.
C. Create a second VPN connection that also uses only one tunnel with static routes, and update the routes by hand when a tunnel fails.
D. Replace the VPN with a single AWS Direct Connect connection, because Direct Connect is not affected by AWS maintenance.

Show the answer and explanation

Answer: A

A. Right: Correct. Each Site-to-Site VPN connection has two tunnels on different AWS endpoints so that one stays up during maintenance. With BGP on both tunnels, traffic moves to the working tunnel automatically. Learn more: Resilience in AWS Site-to-Site VPN (opens in a new tab)
B. Wrong: AWS performs maintenance on VPN endpoints as part of running the service, and customers cannot opt out. The connection's second tunnel exists to cover it. Learn more: Tunnel options for your AWS Site-to-Site VPN connection (opens in a new tab)
C. Wrong: A second connection adds redundancy, but manual route changes fail the requirement for no manual action. Using both tunnels of the existing connection with BGP is simpler. Learn more: Site-to-Site VPN routing options (opens in a new tab)
D. Wrong: Direct Connect connections also have scheduled maintenance, and a single connection is a single point of failure. It also takes weeks to provision. Learn more: AWS Direct Connect resiliency recommendations (opens in a new tab)

Explanation

Every Site-to-Site VPN connection provides two tunnels that terminate on different AWS endpoints, so AWS can maintain one while the other carries traffic. The customer must configure both on the customer gateway, and BGP dynamic routing lets traffic shift between them without manual changes. Configuring only one tunnel makes routine maintenance an outage.

SOA-C03 practice question: Hybrid and private connectivity

Explanation

Study

Keep practicing