Soru

A financial services company is establishing a multi-account, multi-region AWS environment. In the primary Region (`us-east-1`), they have deployed a central AWS Transit Gateway (TGW) to interconnect $15$ spoke VPCs. To connect their main on-premises data center to AWS, they deploy a $10\text{ Gbps}$ AWS Direct Connect (DX) connection terminating at a Direct Connect Gateway (DXGW) associated with the TGW. For high availability, they also configure an IPsec AWS Site-to-Site VPN terminating directly on the same TGW as a backup. The network team requires symmetric routing: all traffic between AWS and the on-premises data center must utilize the DX connection during normal operation, failing over to the VPN only if the DX link becomes unavailable. The on-premises network uses the prefix $10.0.0.0/8$, which must be reachable from AWS, and on-premises systems must reach resources in the AWS VPCs. The solution must minimize administrative overhead and rely on dynamic routing protocols where possible. Which TWO configurations will achieve this routing policy while preventing asymmetric traffic flows? (Select TWO.)