Exams / SOA-C03 / Study guide / Hybrid and private connectivity

Hybrid and private connectivity: SOA-C03 study notes and practice questions

What to know about Hybrid and private connectivity for the SOA-C03 exam, from the Networking and Content Delivery domain (18% of the exam guide), then 1 free question to test it. Part of the SOA-C03 study guide.

Last verified October 2026 against current AWS documentation ·How we write our questions

What to know for the exam

Hybrid connectivity questions ask how to connect on-premises networks reliably and how to fix a link that is down.

Site-to-Site VPN

Encrypted IPsec tunnels over the internet between a customer gateway (your device) and a virtual private gateway or transit gateway.
Every connection has two tunnels on different AWS endpoints; configure both so AWS maintenance or a failure doesn’t cut you off.
Static routing or dynamic routing with BGP (BGP fails over between tunnels automatically).
Watch the TunnelState metric; alarm when a tunnel goes down.
Accelerated VPN (with a transit gateway) uses Global Accelerator for better performance.
Bandwidth per tunnel is limited (about 1.25 Gbps); ECMP over several VPNs on a transit gateway adds more.

AWS Direct Connect

A dedicated private connection with consistent performance; takes weeks to set up.
Virtual interfaces: private (to a VPC via a virtual private gateway or Direct Connect gateway), transit (to transit gateways), public (to AWS public services).
Not encrypted by default: use MACsec on supported connections or run a VPN over Direct Connect.
Resiliency: two connections at two locations for high resiliency, or a Site-to-Site VPN as backup at lower cost.
A Direct Connect gateway reaches VPCs in many Regions.

Other options

AWS Client VPN: remote users connect to VPCs and on-premises networks with OpenVPN clients.
Transit Gateway as the hub joining VPCs, VPNs and Direct Connect.

Troubleshooting a VPN

Problem	Check
Tunnel down (phase 1/2)	Pre-shared keys, IKE versions, encryption settings, customer gateway public IP, firewall allowing UDP 500/4500
Tunnel up, no traffic	Route propagation or static routes in VPC route tables, BGP advertisements, security groups and network ACLs
Only one tunnel used	Normal for active/passive; make sure both are configured for failover

Common traps

One VPN tunnel configured and an outage during AWS maintenance.
Assuming Direct Connect is encrypted.
Forgetting route propagation on the VPC route tables.

Try the 1 practice question

Practice Hybrid and private connectivity Take the free practice exam

Question 1

Harder ·Link to this question

A dental chain connects its head office to a VPC with an AWS Site-to-Site VPN.

The customer gateway device supports BGP, but the network team configured only tunnel 1 with static routes. Last night, connectivity to AWS dropped for 20 minutes, and the AWS Health Dashboard showed scheduled maintenance on that VPN endpoint.

The chain wants the VPN to keep working during future AWS maintenance and tunnel failures without manual action.

What should a CloudOps engineer recommend?

Choose one answer.

A. Configure both tunnels on the customer gateway device and run BGP dynamic routing over them so that traffic fails over between tunnels automatically.
B. Ask AWS Support to exclude the chain's VPN endpoint from scheduled maintenance so that tunnel 1 stays available at all times.
C. Create a second VPN connection that also uses only one tunnel with static routes, and update the routes by hand when a tunnel fails.
D. Replace the VPN with a single AWS Direct Connect connection, because Direct Connect is not affected by AWS maintenance.

Show the answer and explanation

Answer: A

A. Right: Correct. Each Site-to-Site VPN connection has two tunnels on different AWS endpoints so that one stays up during maintenance. With BGP on both tunnels, traffic moves to the working tunnel automatically. Learn more: Resilience in AWS Site-to-Site VPN (opens in a new tab)
B. Wrong: AWS performs maintenance on VPN endpoints as part of running the service, and customers cannot opt out. The connection's second tunnel exists to cover it. Learn more: Tunnel options for your AWS Site-to-Site VPN connection (opens in a new tab)
C. Wrong: A second connection adds redundancy, but manual route changes fail the requirement for no manual action. Using both tunnels of the existing connection with BGP is simpler. Learn more: Site-to-Site VPN routing options (opens in a new tab)
D. Wrong: Direct Connect connections also have scheduled maintenance, and a single connection is a single point of failure. It also takes weeks to provision. Learn more: AWS Direct Connect resiliency recommendations (opens in a new tab)

Explanation

Every Site-to-Site VPN connection provides two tunnels that terminate on different AWS endpoints, so AWS can maintain one while the other carries traffic. The customer must configure both on the customer gateway, and BGP dynamic routing lets traffic shift between them without manual changes. Configuring only one tunnel makes routine maintenance an outage.

Study

Want more on Hybrid and private connectivity? The 5 full-length practice sets have 5 more Hybrid and private connectivity questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets

Study Hybrid and private connectivity

What is AWS Site-to-Site VPN?