Hybrid Network Connectivity — AWS SysOps Administrator (SOA-C03)
Connectivity Language Steers the Answer Before You Choose
SOA-C03 hybrid connectivity questions embed the answer in the scenario's wording. "Consistent bandwidth," "low latency," and "dedicated connection" point to Direct Connect. "Quickly establish," "cost-effective," and "encrypted over the internet" point to Site-to-Site VPN. When both requirements appear — consistent primary path plus encrypted backup — the scenario is testing whether you select Direct Connect as primary and VPN as failover, not as equivalent alternatives.
What This Pattern Tests
The exam describes hybrid connectivity and tests VPN vs. dedicated link. Site-to-Site VPN runs encrypted over the public internet — 1.25 Gbps per tunnel, variable latency, deployable in minutes. Direct Connect provides a dedicated physical connection — 1 Gbps or 10 Gbps, consistent latency, takes weeks to provision. Direct Connect + VPN gives encrypted dedicated connectivity. The trap is recommending Direct Connect for a "need connectivity by tomorrow" requirement (VPN is immediate) or VPN for a "consistent sub-10ms latency for database replication" requirement (internet routing adds variable latency).
Decision Axis
Bandwidth requirement, latency consistency, and deployment timeline determine VPN (fast, variable) vs. Direct Connect (slow to deploy, consistent).
Associated Traps
Decision Rules
Whether the deployment timeline constraint (72 hours) acts as a hard filter that disqualifies Direct Connect before bandwidth optimization is considered, making Site-to-Site VPN the only viable option when throughput is below the VPN ceiling and time-to-live connectivity is the dominant constraint.
Whether to enable Virtual Private Gateway route propagation on the existing VPC route table versus provisioning AWS Direct Connect to replace the VPN — where tunnel-state evidence and route-table evidence together disqualify the DX path and confirm that the route propagation toggle is the correct immediate fix.
Speed-of-deployment is a hard filter that must be applied before bandwidth or latency optimization: Direct Connect provisioning lead time (weeks) disqualifies it regardless of its performance advantages, making Site-to-Site VPN the only option that satisfies all three constraints simultaneously.
Domain Coverage
Difficulty Breakdown