A regional library consortium already uses AWS Direct Connect for catalog syncs into one Region and must remain connected if the Direct Connect circuit fails. Which hybrid design provides resilient private connectivity?
Select an answer to reveal the explanation.
Short Explanation
Treat Direct Connect like the main fiber into the library network and Site-to-Site VPN like the backup generator. When the dedicated circuit drops, the VPN keeps catalog syncs moving. One lonely DX link with no backup is a single point of failure waiting to happen.
Full Explanation
Professional hybrid resilience for a regional library consortium that already depends on AWS Direct Connect for catalog syncs pairs that dedicated circuit with an AWS Site-to-Site VPN backup. Direct Connect remains the preferred primary path for private, higher-capacity connectivity into the Region, while the IPsec VPN provides an alternate encrypted path if the circuit, device, or virtual interface fails. Dynamic routing can prefer Direct Connect-advertised prefixes and fail over to the VPN when those prefixes withdraw, so catalog synchronization continues without waiting for a truck roll or a fully public redesign.
Disabling all VPN options and relying on a single Direct Connect circuit leaves a hard single point of failure; AWS does not magically heal every circuit outage onto an alternate private path you never built. Replacing Direct Connect entirely with public HTTPS pulls from S3 may move bytes, but it abandons the private hybrid posture the consortium already invested in and exposes sync traffic to internet path variability and a different security boundary. Peering library VPCs together with removable-media overnight syncs does nothing to keep on-premises catalogs connected when the hybrid link dies and cannot meet continuous or timely sync expectations.
Exam caveat: a single Direct Connect connection—even into a multi-AZ VPC—does not equal hybrid path diversity; resilience questions expect DX plus VPN or multiple DX locations/connections depending on the stem. Operational check: confirm both DX and VPN tunnels are up, verify route preference favors Direct Connect, simulate DX withdrawal or interface down, and observe catalog sync traffic fail over to the VPN within the recovery objective before restoring the primary circuit.