1.5 - Hybrid and cloud connectivity
Cloud+ CV0-004 objective 1.5 covers connecting on-premises sites and clouds together. A dedicated interconnect link gives a bank a private, high-bandwidth connection from its data center to the cloud that avoids the public internet and offers predictable bandwidth. Because a single interconnect can fail, a good design adds a backup VPN tunnel for resilience. When only a few VPCs need to talk directly and traffic is light, direct VPC peering is the simplest choice. But a design that must scale to hundreds of VPCs across accounts with centralized inspection and routing calls for a transit gateway hub instead of many point-to-point peerings. Expect scenario questions that describe a bandwidth guarantee, a small number of VPCs, a need for redundancy, or large-scale central routing and ask which connectivity option fits best.
Private, predictable-bandwidth link to the cloud = dedicated interconnect (add a backup VPN). A few VPCs, light traffic = direct VPC peering. Hundreds of VPCs, central routing = transit gateway hub.
Practice questions
1. A bank needs a private, high-bandwidth link from its datacenter to the cloud that bypasses the public internet. Choose:
- A site-to-site VPN tunnel
- A dedicated interconnect link (correct answer)
- A public API endpoint
- A NAT gateway route
A dedicated interconnect (direct connect) is a private physical circuit giving consistent bandwidth and lower latency than a VPN over the internet, ideal for heavy hybrid traffic.
2. Over a dedicated interconnect, which protocol dynamically exchanges routes between on-prem and the cloud?
- OSPF area routing
- Static route entries
- BGP route exchange (correct answer)
- RIP hop counting
BGP is the standard for advertising and learning routes across a cloud interconnect, so networks converge automatically as prefixes change on either side.
3. Only three VPCs need to talk directly and traffic between them is light. The simplest connectivity is:
- A transit gateway hub
- A dedicated interconnect
- Direct VPC peering (correct answer)
- A public API gateway
For a small number of VPCs with light traffic, direct peering is simplest and cheapest; a transit gateway only pays off once the mesh grows large enough to be unmanageable.
4. VPC-A peers with VPC-B and VPC-B peers with VPC-C. Can VPC-A reach VPC-C automatically through B?
- Yes, peering is transitive
- Yes, if BGP is enabled
- Yes, over the internet
- No, peering is non-transitive (correct answer)
VPC peering is non-transitive: A cannot route through B to reach C. Full connectivity needs direct A-C peering or a transit gateway acting as a shared hub.
5. Over an interconnect running BGP, two circuits exist and one should carry traffic only if the primary fails. Achieve this by:
- Advertising both equally
- Prepending AS-path on the backup (correct answer)
- Disabling the backup circuit
- Using static routes only
AS-path prepending makes the backup route look longer and thus less preferred, so BGP uses the primary until it fails, then falls back automatically to the backup.
6. A dedicated interconnect gives predictable bandwidth, but the design also needs an encrypted fallback if the circuit fails. Add:
- A second bucket
- A larger instance
- More read replicas
- A backup VPN tunnel (correct answer)
Pairing a dedicated interconnect with a backup VPN over the internet keeps connectivity if the private circuit fails, blending predictable performance with a resilient fallback.