A brokerage connects its headquarters to six production VPCs in one Region. Trading feeds require consistent private throughput, must fail over automatically if a dedicated path fails, and must avoid manual router changes during outages. Which hybrid connectivity design provides redundant automatic failover for the VPC estate?

The correct design is right because two Direct Connect connections in diverse locations deliver consistent private throughput that bypasses the public internet, Transit Gateway provides centralized attachment for all six VPCs in the Region with simplified routing and scalable management, and the VPN backup combined with BGP enables dynamic route propagation with health-based automatic failover without manual router changes during an outage. The VPN-only design with two tunnels to Transit Gateway fails by transport concept because although BGP provides redundancy and automation, IPsec over the internet cannot guarantee consistent private throughput and latency for trading feeds due to public path variability and lack of dedicated bandwidth. The static-route design with diverse Direct Connect links fails by routing concept because static routes lack dynamic peer health detection and automatic withdrawal, so failover depends on operator intervention which violates the requirement to avoid manual router changes during outages. The single-location design with two links plus VPN backup fails by resilience concept because colocating both dedicated paths creates shared fate for facility, device, or fiber failures, so loss of that location leaves only VPN and loses redundant dedicated capacity. Exam caveat: distinguish dedicated private throughput from encrypted internet throughput, as VPN encryption alone does not make a path private or consistent. Practical check: verify BGP ASN, priorities, and route propagation on Transit Gateway, then simulate failure of one Direct Connect and confirm traffic shifts automatically with expected latency.