A manufacturer runs factory systems on premises and VPC workloads in us-east-1 that must stay connected during carrier outages, with sub-second failover between paths and centralized routing to three VPCs. Compliance requires encrypted redundant corporate connectivity. Which hybrid connectivity design delivers redundant failover with centralized routing?
Select an answer to reveal the explanation.
Short Explanation
Factories can't pause for carrier issues, so redundant paths with central routing keep you running. Dual Direct Connect plus VPN backup fails over automatically.
Full Explanation
Two MACsec-encrypted Direct Connect dedicated connections (10, 100 or 400 Gbps) from diverse locations with diverse providers terminate via a Direct Connect gateway to Transit Gateway which centralizes routing to three VPCs with dynamic BGP failover, while a Site-to-Site VPN over the internet attaches to the same Transit Gateway as an encrypted backup path with BGP priority tuning for automatic failover. A single Direct Connect connection creates a single point of failure at the circuit and location level despite Transit Gateway centralization, missing carrier redundancy. Two VPN tunnels alone provide redundancy but lack dedicated bandwidth, consistent latency, and SLA-backed performance for factory systems, missing enterprise-grade primary connectivity. Ordering Outposts extends AWS locally but still requires WAN connectivity for hybrid routing and does not itself provide redundant encrypted corporate links, missing the connectivity failover requirement. Exam caveat is to pair redundant Direct Connect with VPN backup and BGP for fast failover. Practical check is to verify BGP priorities, Transit Gateway route tables, and failover by simulating a connection down event.