A manufacturer must connect a factory to two AWS Regions with dedicated 10-Gbps throughput, consistent low latency, and link-layer encryption for OT data. Internet-based VPN jitter is unacceptable and compliance mandates encrypted private lines. Which hybrid connectivity design provides secure connectivity as required?

The correct design meets dedicated throughput, consistency, privacy, and encryption together because dedicated Direct Connect ports deliver 10-Gbps private capacity that avoids internet jitter, private VIFs provide private routing into VPCs, MACsec provides line-rate IEEE 802.1AE link-layer encryption required for OT compliance, and dual-region connections with failover ensure resiliency and low-latency paths. The dedicated design without MACsec fails by encryption concept because a private line is isolated but not encrypted, so the mandate for encrypted private lines remains unsatisfied despite correct throughput and routing. The hosted-connection design fails by tenancy concept because hosted connections use shared partner capacity at sub-line-rate increments for cost efficiency, so they cannot guarantee exclusive 10-Gbps dedicated ports and deterministic performance for OT workloads. The single-Region MACsec design with an internet VPN to the second Region fails by transport concept because the second Region depends on internet-based tunnels, which reintroduces the jitter the company ruled out and is not a dedicated encrypted private line. Exam caveat is to map keywords precisely: dedicated signals exclusive ports, private VIF signals private routing not encryption, and MACsec signals link-layer encryption. Practical check is to validate port speed, MACsec key association, BGP over each private VIF, diverse locations, and sustained throughput before migration.