N10-009 Question 39
Single answerCloud connectivity options: VPN, Direct ConnectA company is migrating a latency-sensitive ERP system to a public cloud provider. The system transfers large database replication streams continuously between the on-premises data center and the cloud. Leadership requires more consistent performance than the public internet can provide and wants to reduce exposure to internet congestion. However, the company also wants a secondary path that can be brought up quickly if the primary private connection fails. Which solution best meets these requirements?
- A
Use a site-to-site VPN over the internet as the primary connection because it provides the lowest latency and guaranteed bandwidth for replication traffic
- B
Use a dedicated private connection such as Direct Connect as the primary path, and use a site-to-site VPN as the backup path
- C
Use two separate site-to-site VPN tunnels over different ISPs because VPNs provide the same performance consistency as a private dedicated circuit
- D
Use only a dedicated private connection such as Direct Connect, because private circuits automatically encrypt all traffic and eliminate the need for any backup design
Show answer and explanation
Correct answer: B
Explanation
For cloud connectivity, a site-to-site VPN is typically faster to deploy and lower cost, but it traverses the public internet and is therefore subject to variable latency, jitter, and congestion. A dedicated private connection such as AWS Direct Connect, Azure ExpressRoute, or similar services is intended for more predictable throughput and latency characteristics between on-premises infrastructure and the cloud provider. In real-world enterprise designs, organizations often use the dedicated circuit as the primary connection for steady-state production traffic and a VPN as a backup or supplemental path. Provider documentation and networking best practices consistently note that dedicated private connectivity improves performance consistency but does not automatically encrypt traffic, so encryption requirements should be evaluated separately.
- A. Incorrect.
This is incorrect. A site-to-site VPN uses the public internet, so while it can encrypt traffic and be deployed relatively quickly, it does not provide guaranteed bandwidth or the same level of consistent latency as a dedicated private connection. A common misconception is that encryption or tunneling improves performance predictability; it does not.
- B. Correct.
This is correct. A dedicated private cloud connection, commonly referred to as Direct Connect or similar provider offerings, is designed to provide more predictable performance and avoid many issues associated with internet transit, such as variable latency and congestion. Using a site-to-site VPN as a secondary path is a common best practice because it can be implemented quickly and provides failover if the primary dedicated link is unavailable.
- C. Incorrect.
This is incorrect. Two VPNs over different ISPs may improve resiliency compared with a single internet path, but they still rely on internet-based transport and generally do not match the consistency of a dedicated private connection for high-volume, latency-sensitive replication traffic. This option reflects the misconception that redundancy alone provides the same performance characteristics as private connectivity.
- D. Incorrect.
This is incorrect. A dedicated private connection can improve consistency and reduce dependence on the public internet, but it does not inherently mean traffic is encrypted. Depending on the provider and design, additional encryption may still be required for sensitive data. It is also poor design to assume no backup path is needed for a critical workload.