ANS-C01 Question 138
Select 2Your company has deployed an application in a VPC that is connected to your on-premises network using a Direct Connect connection. You want to ensure that traffic from your VPC routes to your on-premises network only when the Direct Connect connection is available, but if the Direct Connect connection fails, the traffic should route over a VPN connection as a backup. Which solution meets this requirement?
- A
Configure a static route in the VPC route table for the Direct Connect connection with a lower priority and another static route for the VPN connection with a higher priority.
- B
Use Border Gateway Protocol (BGP) over the Direct Connect connection and configure static routing for the VPN connection with a higher administrative distance.
- C
Configure BGP for both the Direct Connect and VPN connections, and adjust the BGP AS_PATH attribute to prioritize the Direct Connect route.
- D
Use static routes for both the Direct Connect and VPN connections, and adjust the route metrics to ensure the Direct Connect route has a lower metric.
- E
Enable Active-Active routing mode for the VPN and Direct Connect connections to balance traffic between them.
Show answer and explanation
Correct answers: B, C
Explanation
To meet the requirement of using the Direct Connect connection as the primary route and failing over to the VPN connection only when the Direct Connect connection is unavailable, you need dynamic routing. BGP is a dynamic routing protocol that supports failover. Using BGP over Direct Connect and either static routing with a higher administrative distance for the VPN or BGP with adjusted AS_PATH attributes ensures proper prioritization and automatic failover.
- A. Incorrect.
Incorrect: Static routes do not support dynamic failover. If the Direct Connect connection goes down, the route would not shift automatically to use the VPN.
- B. Correct.
Correct: Using BGP over Direct Connect and static routing with a higher administrative distance for the VPN allows for dynamic failover. BGP dynamically adjusts routing when the Direct Connect connection fails.
- C. Correct.
Correct: Configuring BGP for both connections and using the AS_PATH attribute to prioritize the Direct Connect route ensures that traffic uses the Direct Connect connection until it becomes unavailable, at which point traffic will failover to the VPN.
- D. Incorrect.
Incorrect: Static routes alone cannot support dynamic failover and require manual intervention to change routing in case of a failure.
- E. Incorrect.
Incorrect: Active-Active mode is not supported in this scenario as you want failover, not load balancing, between the connections.