A university already has a cage in a colocation hall that houses the AWS Direct Connect location. They want a private VLAN from that cage to AWS and they do not use an MPLS carrier. Which model fits?
Select an answer to reveal the explanation.
Short Explanation
Since your cage is already in the hall with AWS, you can order a colocation cross-connect from your cage to the AWS endpoint. An SDCI virtual circuit from a metro where you have no port does not use your existing cage, and IPsec over the shared internet uplink is not private connectivity. The MPLS cloud on-ramp also does not fit because you do not buy that carrier service.
Full Explanation
Colocation private connectivity means your equipment and the cloud provider meet in the same facility, and you order the physical cross-connect. Your cage is already in the hall that houses the AWS Direct Connect location, and you want a private VLAN to AWS without an MPLS carrier. A colocation cross-connect from your cage to the AWS endpoint is the matching model, typically paired with a private or transit virtual interface for your VPCs. An SDCI virtual circuit is a software-defined interconnect ordered on a fabric port; ordering one from a metro where you have no port does not use the cage you already occupy. Native IPsec over the colocation facility’s shared internet uplink is internet-based, so it does not give you a private VLAN to the AWS router. The MPLS carrier’s cloud on-ramp is a provider-handoff model, and you do not buy that service, so it fails your stated constraint. Exam caveat: after the cross-connect is lit, you still choose the virtual interface type. A public virtual interface reaches public AWS services; it is not the private VLAN into a VPC. Operational check: confirm that the Direct Connect connection shows the cross-connect up and that the private or transit virtual interface is associated with the gateway holding your campus prefixes.