A hospital has one AWS Site-to-Site VPN connection from the campus. One of the two tunnels is down and the other is up, and traffic to the VPC continues. Why is that flow expected to survive?
Select an answer to reveal the explanation.
Short Explanation
You get two tunnels in one AWS Site-to-Site VPN connection, so the healthy tunnel can keep forwarding traffic when the other goes down. That built-in resilience keeps your flow going; AWS does not silently switch it to ExpressRoute, and the virtual private gateway does not use OSPF to reroute it.
Full Explanation
An AWS Site-to-Site VPN connection has two tunnels to AWS endpoints. If one tunnel fails while the other remains up, traffic routed through the healthy tunnel can continue, providing resilience within that single connection. AWS does not automatically move the down tunnel’s packets onto ExpressRoute; that would require the customer to have built and preferred that path. Neither tunnel is merely a keepalive: both can carry user traffic, and the healthy tunnel is carrying it here. The virtual private gateway does not run OSPF, so it cannot reroute the VPC prefix through an OSPF adjacency. Instead, failover within the connection relies on the second IPsec tunnel and the static route or BGP route that directs traffic to it. Exam caveat: two tunnels in one connection still share the campus internet path and customer gateway, so they do not protect against loss of that whole path; a second VPN connection over another provider can. Practical check: confirm that the AWS console shows one tunnel up and one down, and that the campus routing table still directs the VPC prefix toward the healthy tunnel.