A hospital has two campus routers and wants an AWS VPN path to survive the failure of either router. One VPN connection on one router exists today. What should they add?
Select an answer to reveal the explanation.
Short Explanation
Two tunnels on one router still die when that router dies. You put a second customer gateway and a second VPN connection on the other campus router, so AWS still has a path when the first router is gone. Stretching a keepalive does not build that second router.
Full Explanation
Resiliency against a campus router failure needs a second device that actually terminates a VPN. AWS represents that device as another customer gateway and another VPN connection. The second hospital router then has its own tunnels and its own BGP session. A second tunnel on the same router protects an AWS endpoint or a single tunnel failure. It does not survive the router itself rebooting or losing power. A longer BGP keepalive only delays detection of the one session. It does not give AWS a second router to use. An east-west security group filters inside the VPC. It does not advertise campus routes or replace a dead customer gateway. Exam caveat: both routers should advertise the campus prefixes in a controlled way so a failure withdraws only the dead router's paths. Two routers advertising the same prefix with no preference can blackhole if one is half-down. Operational check: shut the first campus router and confirm the VPC prefix remains reachable through the second router's tunnels.