A regional library consortium already uses AWS Direct Connect for catalog syncs into one Region and must remain connected if the Direct Connect circuit fails. Which hybrid design provides resilient private connectivity?
Select an answer to reveal the explanation.
Short Explanation
Treat Direct Connect like the main fiber into the library network and Site-to-Site VPN like the backup generator. When the dedicated circuit drops, the VPN keeps catalog syncs moving. One lonely DX link with no backup is a single point of failure waiting to happen.
Full Explanation
Professional hybrid designs commonly combine AWS Direct Connect for primary private connectivity with an IPsec Site-to-Site VPN as a resilient failover path. Routing can prefer the Direct Connect prefix advertisements and fall back to the VPN when the circuit or virtual interface is unavailable. A single Direct Connect path without backup fails closed during circuit loss; public-only syncs abandon private hybrid requirements; and VPC peering alone does not restore on-premises connectivity.