A company has established hybrid connectivity using an AWS Transit Gateway. The Transit Ga… — AWS Certified SysOps Administrator - Associate

A company has established hybrid connectivity using an AWS Transit Gateway. The Transit Gateway is attached to three VPCs. To connect to the on-premises network (CIDR $172.31.0.0/16$ ), the company uses a primary $10\text{ Gbps}$ AWS Direct Connect connection with a Transit Virtual Interface (Transit VIF) terminated on a Direct Connect Gateway. As a backup, they have configured an AWS Site-to-Site VPN connection attached directly to the Transit Gateway. Both connections are advertising the $172.31.0.0/16$ prefix via dynamic BGP, and both attachments have route propagation enabled in the Transit Gateway route table. During a maintenance window, a SysOps administrator needs to temporarily force all outbound traffic destined for the on-premises network to use the Site-to-Site VPN backup path. Which action will achieve this goal with the least administrative effort?

A
Configure BGP AS Path prepending on the on-premises router to prepend its Autonomous System Number (ASN) three times for the prefix advertised over the Direct Connect connection.
Add a static route for $172.31.0.0/16$ pointing to the Site-to-Site VPN attachment in the Transit Gateway route table.Answer
C
Configure the on-premises router to advertise a lower Multi-Exit Discriminator (MED) value for the prefix over the Site-to-Site VPN connection than over the Direct Connect connection.
D
Create a private hosted zone in Amazon Route 53 and configure a routing policy to resolve the on-premises IP addresses to the VPN gateway endpoint.

Answer

Add a static route for the on-premises network prefix (

172.31.0.0/16

) pointing to the Site-to-Site VPN attachment in the Transit Gateway route table.

The correct answer is to add a static route in the Transit Gateway route table pointing to the VPN attachment. In AWS Transit Gateway routing logic, static routes always take precedence over propagated routes. Since both the Direct Connect Gateway and Site-to-Site VPN connections propagate the same prefix dynamically, the Transit Gateway naturally prefers the Direct Connect Gateway attachment. Adding a static route overrides this default preference and immediately forces traffic to the VPN attachment.

Step-by-Step Solution

Analyze the current route propagation and selection behavior in the AWS Transit Gateway route table.

The Transit Gateway receives the

172.31.0.0/16

prefix via dynamic BGP from both the Direct Connect Gateway and the Site-to-Site VPN. By default, Transit Gateway route tables prefer Direct Connect Gateway attachments over VPN attachments for identical prefixes.

This establishes why traffic is currently routing over the Direct Connect connection and why standard propagation favors this path.

Evaluate the viability of manipulating BGP attributes (AS Path prepending and MED) on the on-premises router.

BGP path selection attributes are only compared among routes of the same attachment type (e.g., between two VPN connections). They cannot override the Transit Gateway's built-in preference of Direct Connect over VPN.

This rules out BGP attribute tuning as a solution for different attachment types.

Apply the route precedence rules for Transit Gateway route tables.

In a Transit Gateway route table, static routes always take precedence over propagated routes. Adding a static route for

172.31.0.0/16

pointing to the VPN attachment will immediately override the propagated Direct Connect route.

This is the most effective and lowest-effort way to temporarily redirect the traffic.

Key Concept

AWS Transit Gateway route evaluation order and precedence rules, where static routes override propagated routes, and Direct Connect Gateway propagated routes are preferred over VPN propagated routes.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic