A records center still on premises must move multi-terabyte nightly batches into AWS with consistent high bandwidth. Leadership also wants a resilient backup path if the primary link fails. Which hybrid design fits?

A records center still on premises that must move multi-terabyte nightly batches into AWS needs consistent high bandwidth and a resilient backup path. AWS Direct Connect provides dedicated connectivity with more predictable throughput than best-effort internet alone, fitting large nightly civic transfers. Pairing Direct Connect with an AWS Site-to-Site VPN as backup gives encrypted failover if the primary interconnect fails, satisfying leadership’s resilience requirement without relying on a single physical path.

Relying only on consumer broadband without encryption or redundancy fails both consistency and resilience goals for multi-terabyte municipal batches. Amazon CloudFront is a content delivery network for viewers/origins—not the exclusive hybrid interconnect from a records center into AWS. Shipping only USB drives monthly and disabling network paths cannot meet nightly batch SLAs and removes operational agility for urgent records pulls.

Exam caveat: Direct Connect is not encrypted by itself in the same way a VPN is; many designs run VPN over Direct Connect or use MACsec where available, and the exam often pairs DX for bandwidth with VPN for backup/encryption narratives. Also plan for DX location redundancy if the RPO/RTO demands it beyond a single VPN backup.

Operational check: measure nightly throughput on Direct Connect versus requirements; fail the DX path in a drill and confirm Site-to-Site VPN carries critical batches (even if slower); monitor BGP status and CloudWatch; and document escalation when the records center’s batch window is at risk.