A bank uses one AWS Direct Connect path for production and wants traffic to fall back to an internet VPN only when that private path fails. Which design matches?
Select an answer to reveal the explanation.
Short Explanation
You keep the private road as the one you actually drive, and you keep a public detour for the day it closes. You prefer Direct Connect and let the internet VPN take over only when that private path fails. Unplugging Direct Connect makes the backup your only road.
Full Explanation
The resiliency design is a preferred private path plus a backup that is ready, not a backup that replaces the private path on a normal day. Direct Connect carries production while it is up. Routing, usually BGP preference, installs the internet VPN only when the Direct Connect routes withdraw. Making the internet VPN the only path abandons the private connection the bank already has. Two static defaults on the VPN, with no route toward Direct Connect, never use the private port. An east-west security group filters inside the VPC. It does not monitor a Direct Connect port or move routes onto a VPN. Exam caveat: the VPN backup is encrypted internet, not a second private location. It satisfies a port failure and it does not meet a requirement that forbids the public internet even during a failure. Operational check: with Direct Connect up, the VPC prefix should point at the private virtual interface. Shut that BGP session and the prefix should move to the VPN tunnel.