Q90 — AWS SAA-C03 Ch.16

Question 90 of 100 | ← Chapter 16

Q1290. A company is planning to migrate workloads from an on-premises data center to AWS. The company wants to test the migrated workloads on AWS by setting up a temporary testing environment in one AWS Region. The testing environment includes a single Amazon EC2 instance in VPC. The company does not have any bandwidth or resiliency requirements for the testing environment.The company needs to establish bidirectional connectivity between the on-premises data center and the testing environment.Which solution will meet these requirements MOST cost-effectively?

Correct Answer: B. Create an AWS Site-to-Site VPN connection between the on-premises data center and AWS.

Explanation

The correct solution must provide bidirectional connectivity between an on-premises data center and a temporary AWS testing environment (single EC2 instance in a VPC) in the most cost-effective way, without requiring high bandwidth or resiliency.Correct Answer: B. Create an AWS Site-to-Site VPN connection between the on-premises data center and AWS.Why Option B is Best:Cost-Effective for Temporary Testing:AWS Site-to-Site VPN is much cheaper than AWS Direct Connect (which requires dedicated hardware and long-term contracts).No need for multiple VPNs (unlike Option C, which adds unnecessary cost).Meets Basic Connectivity Requirements:Provides secure, encrypted bidirectional communication between on-premises and AWS over the public internet.Sufficient for a single EC2 instance (no high bandwidth or resiliency needs).Easy to Set Up and Tear Down:Can be quickly deployed via AWS Console/CLI.No long-term commitment (unlike Direct Connect, which is ideal for permanent hybrid setups).Why Other Options Fail:A. Create an AWS Direct Connect connection between the on-premises data center and AWS.Overkill for Temporary Testing:Direct Connect is expensive (requires dedicated network circuits, minimum 1 Gbps, and long-term contracts).Not cost-effective for a short-term testing environment.C. Create multiple AWS Site-to-Site VPN connections between the on-premises data center and AWS.Unnecessary and Costly:A single VPN is sufficient for bidirectional connectivity. Multiple VPNs increase costs without providing additional benefits (no resiliency requirement). D. Create an AWS Client VPN connection between the on-premises data center and AWS.Wrong Use Case:Client VPN is for individual user access (e.g., remote employees connecting to AWS). Not designed for site-to-site (network-to-network) connectivity (which is needed here).Key Comparison:RequirementOption B (Site-to-Site VPN)Other OptionsCost-effectiveness for temporary use(Low-cost, pay-as-you-go) (A: Direct Connect is expensive; C: Multiple VPNs add cost; D: Wrong solution)Bidirectional connectivity(Network-to-network) (D: Client VPN is user-to-network) Sufficient for single EC2 instance(No high bandwidth needed) (A: Overkill for testing) Easy setup/teardown(Managed service) (A: Requires physical circuit setup)How Option B Works in Practice:Set up a Virtual Private Gateway (VGW) in the AWS VPC.Configure a Customer Gateway (CGW) on-premises (using a compatible VPN device). Create a Site-to-Site VPN connection in AWS, linking the VGW and CGW. Establish an IPsec tunnel over the public internet (encrypted traffic). Update on-premises routing to send traffic to AWS via the VPN.Conclusion:Option B is the most cost-effective and appropriate solution for temporary, low-bandwidth bidirectional connectivity between on-premises and AWS.Final Answer: B