A bank must connect its on-premises data center to two AWS Regions with consistent private connectivity, encrypted traffic over dedicated links, sub-second failover, and BGP routing. Internet-based tunnels alone violate policy. Which hybrid connectivity design meets the encrypted dedicated-link requirements for the bank?

The design with Direct Connect, MACsec, private VIFs, dual links, and resilient BGP routing meets the encrypted dedicated-link requirement: Direct Connect provides dedicated connectivity, MACsec supplies line-rate encryption on those links, and private VIFs keep traffic off the public internet. Dual links and BGP support dynamic prefix exchange and resilient failover; Bidirectional Forwarding Detection (BFD), with intervals around 300 ms and a multiplier of 3, can help detect failures quickly. The design with private VIFs and dual BGP links but no MACsec fails on encryption: dedicated fiber alone carries traffic in cleartext and does not meet the stated encrypted-link mandate. The design limited to one Region fails on scope: local link redundancy does not provide the required attachments to two Regions. The design with MACsec and dual links but static routes fails on routing: Direct Connect virtual interfaces use BGP, while static routes cannot dynamically withdraw and relearn prefixes or provide BFD-assisted failover across Regions. Exam caveat: distinguish Layer 2 MACsec on Direct Connect from IPsec encryption over a VPN; the question requires encryption on dedicated links, not internet-based tunnels alone. Before production, verify MACsec key agreement, private VIF attachments through a Direct Connect Gateway, BGP session states, and BFD timers, then test link failure to confirm rapid failover.