A campus router builds both tunnels of one AWS Site-to-Site VPN connection across the public internet to a virtual private gateway. No Direct Connect port exists. Which model is this?
Select an answer to reveal the explanation.
Short Explanation
Two tunnels on the public internet are still the public internet. You built native IPsec to the virtual private gateway. Two endpoints do not become two Direct Connect ports, and BGP on a standalone router does not make the path SD-WAN.
Full Explanation
An AWS Site-to-Site VPN connection uses two IPsec tunnels to a virtual private gateway or a transit gateway. When those tunnels cross the public internet and no Direct Connect port exists, the model is native IPsec. The second tunnel is resiliency inside that VPN connection, not a private port. A colocation cross-connect would be the customer's cable to AWS in a shared building. Two VPN endpoints do not create that cable. Catalyst SD-WAN connectivity needs the overlay and controllers. BGP on the tunnels is the routing AWS VPN uses. It is not SD-WAN by itself. Exam caveat: this design survives one tunnel failure and still shares the campus internet. A private port is a different model if the requirement later forbids the internet. Operational check: the AWS VPN connection should show two tunnel outside addresses and no Direct Connect virtual interface for this campus.