A city utility must connect on-premises SCADA historians to an analytics VPC with consistent low latency and dedicated bandwidth for continuous telemetry. Which hybrid connectivity approach best fits these requirements?
Select an answer to reveal the explanation.
Short Explanation
SCADA telemetry wants a private lane with predictable speed, not a ride-share trip across the public internet. Direct Connect gives that dedicated path into AWS. A lone Site-to-Site VPN can work as backup, but it is not the primary answer when dedicated bandwidth and steady latency are must-haves.
Full Explanation
When a city utility must stream continuous SCADA historian telemetry into an analytics VPC with consistent low latency and dedicated bandwidth, AWS Direct Connect is the hybrid connectivity pattern that matches those non-functional requirements. Direct Connect provisions a private circuit from the on-premises or co-location environment into the AWS Region hosting analytics, so historian flows stay off the variable public internet path and can be sized for sustained transfer rates. Architects then route the private prefixes into the analytics VPC through a Direct Connect gateway and Transit Gateway or virtual private gateway design appropriate to the account layout, keeping OT-derived data on an enterprise-controlled path.
Relying solely on an internet-based Site-to-Site VPN accepts encrypted but shared public-path behavior; VPN remains excellent for backup or modest volumes, yet it does not by itself guarantee the dedicated capacity and steady latency the utility specified for continuous feeds. Publishing historians through a public Network Load Balancer and pulling over the open internet expands the attack surface of OT-adjacent systems and still depends on internet performance rather than a private circuit. Using only VPC peering between AWS accounts is conceptually wrong for hybrid on-premises connectivity: peering connects AWS networks to each other and does not replace Direct Connect or VPN for reaching historians that still live outside AWS.
Exam caveat: SAP-C02 often pairs Direct Connect as primary with Site-to-Site VPN as failover; do not confuse “encrypted VPN” with “dedicated bandwidth,” and do not treat VPC peering as a hybrid on-premises answer. Operational check: validate the Direct Connect virtual interface state, confirm BGP or static routes for historian subnets appear in the analytics path, measure transfer latency and throughput under load, and document the VPN or secondary circuit plan so a single DX failure does not strand telemetry.