Hybrid networking — VPN, Direct Connect, Transit Gateway, PrivateLink

15 timed scenario questions (~24 min, ~96 sec each). Reinforces night-21-hybrid-networking.md. Theory night — no lab deploy. Answer without peeking at night-21-quiz-answers.json first.

1. 1.Resort HQ (192.168.0.0/16) must reach saa-study-gsa-vpc (10.0.0.0/16) this week over the public internet with encrypted tunnels. No dedicated fiber yet. Fastest AWS hybrid option?

   A.AWS Site-to-Site VPN — IPSec to a virtual private gateway or Transit GatewayB.AWS Direct Connect with a 10 Gbps dedicated port ordered this week for this workloadC.VPC peering between the data center LAN CIDR and the VPC CIDR for this workloadD.AWS PrivateLink interface endpoint installed in the on-prem rack for this workload

2. 2.Leadership requires consistent sub-10 ms jitter and 5 Gbps sustained throughput from on-prem ETL to Aurora in private subnets. Public internet variability is unacceptable. Primary link?

   A.Site-to-Site VPN with accelerated VPN as the only hybrid path for this workloadB.AWS Direct Connect private virtual interface to the VPC or Transit GatewayC.NAT Gateway in the public subnet with port forwarding to Aurora for this workloadD.Internet Gateway attached to the database subnet route table for this workload

3. 3.You already have Direct Connect as the primary hybrid path. The exam asks for resilience when the DX circuit fails. Standard companion service?

   A.Replace DX with a second Internet Gateway attached to the VPC for this workloadB.VPC peering to a second Direct Connect location in another Region for this workloadC.Site-to-Site VPN as backup terminating on the same Transit Gateway or VGWD.Public VIF only — drop the private VIF during DX circuit outages for this workload

4. 4.Twelve VPCs across three accounts must all reach on-prem 172.16.0.0/12 and a shared inspection VPC. Full mesh VPC peering is rejected. Hub design?

   A.One Site-to-Site VPN per VPC to duplicate customer gateway devicesB.PrivateLink interface endpoint in every spoke VPC for each resource for this workloadC.Inter-Region VPC peering only — with no hybrid on-prem connectivityD.Transit Gateway with attachments per VPC and centralized route tables

5. 5.VPC A peers with VPC B. VPC B peers with VPC C. Apps in VPC A must reach RDS in VPC C by private IP. Will peering alone work?

   A.No — VPC peering is non-transitive; need A↔C peering or a Transit Gateway pathB.Yes — peering is transitive across three VPCs automatically by default for this workloadC.Yes — if all three VPCs are configured with the same CIDR block for this workloadD.No — peering only works when all VPCs are in one AWS account for this workload

6. 6.A third-party ski-analytics API runs in the vendor's AWS account. Your Fargate tasks in saa-study-gsa-vpc must call it without traversing the public internet. Vendor offers AWS PrivateLink. Pattern?

   A.Site-to-Site VPN from your VPC to the vendor's corporate office networkB.Interface VPC endpoint in your subnets to the vendor NLB endpoint serviceC.VPC peering between 10.0.0.0/16 and the vendor VPC with merged routesD.S3 Gateway endpoint in the private subnet route table for the API for this workload

7. 7.Fargate tasks in Night 9 private subnets upload pipeline artifacts to S3 without NAT charges for that traffic. Which Night 8 pattern still applies — not PrivateLink to a third party?

   A.AWS PrivateLink to a partner-published S3 endpoint service elsewhereB.Direct Connect public VIF as the only supported option for S3 accessC.S3 Gateway VPC endpoint associated with the private subnet route tableD.Client VPN attached on each Fargate task ENI for S3 uploads for this workload

8. 8.On-prem and AWS both use 10.0.0.0/16. You attempt Site-to-Site VPN to saa-study-gsa-vpc. BGP never installs usable routes. Root cause?

   A.VPN requires exactly one tunnel — delete the second tunnel immediately for this workloadB.Virtual private gateway must be placed in a public subnet to work for this workloadC.Direct Connect is mandatory whenever on-prem and VPC CIDRs match for this workloadD.Overlapping CIDR blocks — hybrid routing cannot distinguish identical prefixes

9. 9.Direct Connect private VIF terminates on a Direct Connect Gateway. Multiple VPCs in us-east-1 must receive on-prem routes. Common next hop from DX Gateway?

   A.Transit Gateway — DX Gateway associates with TGW for multi-VPC hybrid hubB.Internet Gateway attached in each VPC for on-prem route distributionC.NAT Gateway in every Availability Zone as the hybrid next hop for this workloadD.AWS PrivateLink endpoint service published once per spoke VPC for this workload

10. 10.Compare encryption defaults on the exam. Which statement is correct?

    A.Direct Connect encrypts all traffic with IPSec by default on every VIF for this workloadB.Site-to-Site VPN uses IPSec; DX is private — add VPN over DX if encryption isC.Transit Gateway encrypts all inter-VPC traffic with CMKs by default for this workloadD.VPC peering traffic crosses the public internet unless PrivateLink is on

11. 11.Night 16 Aurora must accept PostgreSQL only from on-prem BI hosts (192.168.50.0/24) and Lambda in the same VPC — not the internet. Hybrid is already up via TGW. Security control?

    A.Enable Aurora public accessibility and restrict NACL to 192.168.50.0/24 for this workloadB.Attach an Internet Gateway to the DB subnet for on-prem BI traffic for this workloadC.Aurora security group: allow TCP 5432 from on-prem CIDR and from the Lambda SGD.Replace hybrid connectivity with CloudFront origin for port 5432 for this workload

12. 12.Two dev teams need bidirectional private IP connectivity between vpc-dev (10.2.0.0/16) and vpc-staging (10.3.0.0/16) in the same Region. No SaaS endpoint service involved. Simplest fit?

    A.AWS PrivateLink with staging publishing every EC2 as an endpoint serviceB.Site-to-Site VPN between the two VPCs over the public internetC.Direct Connect hosted connection between dev and staging accounts onlyD.VPC peering with reciprocal routes for each other's CIDR blocks

13. 13.A shared-services account owns a Transit Gateway. Spoke VPCs in other accounts must attach. Which AWS feature shares the TGW without moving the VPCs?

    A.AWS Resource Access Manager (RAM) share of the Transit Gateway across accountsB.AWS Organizations SCP that copies Transit Gateway route tables to spokes for this workloadC.VPC peering from every spoke VPC to the management account only for this workloadD.AWS PrivateLink gateway endpoint published for the Transit Gateway for this workload

14. 14.night-21-hybrid-networking.md is a theory night with $0 deploy. What hands-on artifact should you produce tonight?

    A.Run night-21-lab-vpn-setup.ps1 to create a customer gateway in the accountB.Three paper diagrams: on-prem→VPC hybrid, multi-VPC TGW hub, SaaS viaC.Delete saa-study-gsa-vpc to avoid NAT charges before Week 3 reviewD.Enable Aurora public accessibility for Site-to-Site VPN testing for this workload

15. 15.Remote engineers on laptops need encrypted access to resources in saa-study-gsa-vpc — not a data-center site link. Service?

    A.Site-to-Site VPN with one IPSec tunnel configured per engineer laptopB.Direct Connect hosted connection provisioned for each remote engineerC.AWS Client VPN (or similar remote-access VPN) — per-user, not Site-to-SiteD.VPC peering from corporate hotel Wi-Fi networks into the study VPC for this workload