A broker must keep a private AWS path up if an entire Direct Connect location fails. One dedicated connection exists at a single location today. What adds that location resiliency?
Select an answer to reveal the explanation.
Short Explanation
Two lanes on one bridge do not help when the whole bridge is closed. You add a second Direct Connect connection at a different location and let routing use either one. Stretching a keepalive on the only connection does not create a second building.
Full Explanation
A single Direct Connect location is a shared failure for every connection that lands only there. Location resiliency means a second connection at a different Direct Connect location, with BGP or equivalent routing so traffic moves when the first location is unavailable. A second IPsec tunnel inside an internet VPN connection improves that internet VPN. It is not the private path this broker is using, and it does not add a second Direct Connect location. A longer BGP keepalive only changes how slowly the single session is declared down. It does not give the traffic another place to go. An east-west security group segments subnets inside a VPC. It has no effect on the loss of a Direct Connect building. Exam caveat: the second location still needs its virtual interfaces mapped to the same gateways or a transit gateway that can fail over. A lit cross-connect with no virtual interface does not forward the VPC. Operational check: the two connections should show different locations, and withdrawing the first location's BGP routes should leave the VPC prefix reachable through the second.