A hospital will reach an AWS VPC from the campus edge router using only the public internet, and AWS will terminate the tunnels on a virtual private gateway. Which connectivity model is this?
Select an answer to reveal the explanation.
Short Explanation
Think of the internet as a public road and IPsec as a locked case in the truck. You are still on that public road; you only locked the cargo. The trap is calling it Direct Connect or SD-WAN when the far end is simply the AWS VPN gateway.
Full Explanation
AWS Site-to-Site VPN is the provider's native IPsec service. The campus router builds the tunnels across the public internet, and the virtual private gateway decrypts them into the VPC. The payload is encrypted, but the underlay is still the internet and the terminator is AWS's own VPN endpoint, so this is the internet-based native IPsec model. A private MPLS handoff into a Direct Connect private virtual interface never uses that internet VPN gateway. It is a private circuit into the VPC and sits in the private-connectivity model. A colocation cross-connect is also private: the cage meets AWS inside a building, with no IPsec session to a virtual private gateway. Catalyst SD-WAN Cloud OnRamp would insert a cloud gateway and steer traffic with the SD-WAN overlay, which this design does not include. The campus router talks IPsec directly to AWS. Exam caveat: encryption does not turn an internet path into Direct Connect, and a Direct Connect port is not encrypted unless you add protection separately. Operational check: on the AWS VPN connection, confirm two tunnel outside addresses, then confirm the campus router has matching IKEv2 security associations to those addresses.