Question

A company connects its multi-VPC environment using an AWS Transit Gateway. The primary connection to the corporate datacenter is a $1\text{ Gbps}$ AWS Direct Connect (DX) connection using a Transit Virtual Interface (Transit VIF) through a Direct Connect Gateway (DXGW). A Site-to-Site VPN is configured directly to the Transit Gateway as a backup path. The on-premises database subnet resides in the CIDR block `$172.16.100.0/24$`, which belongs to the larger corporate network range of `$172.16.0.0/12$`. During a routine audit, a SysOps administrator notices that database-bound traffic is routing over the VPN tunnel instead of the DX connection, even though the DX connection is fully operational and has low utilization. In the Transit Gateway route table, the administrator identifies a propagated route for `$172.16.0.0/12$` pointing to the DXGW and a propagated route for `$172.16.100.0/24$` pointing to the VPN attachment.

Which two actions should the SysOps administrator take to ensure that traffic to the database subnet primarily uses the Direct Connect connection and only fails over to the VPN if the Direct Connect connection becomes unavailable? (Select TWO.)