On-prem needs private connectivity to 30 VPCs across regions via a single Direct Connect link, with full VPC-to-VPC segmentation control. Which architecture scales?
A.Private VIF per VPC to its VGW — one VIF per VPC
VGW per VPC can't route VPC-to-VPC and hard-limits VIF/VGW associations — doesn't scale.
B.Transit VIF to a Direct Connect gateway associated with a Transit Gateway
Correct. Transit VIF + TGW is the hub design for many VPCs and segmentation.
C.Public VIF to AWS public endpoints, then VPC peering
Public VIFs reach public endpoints only — they can't carry private VPC traffic.
D.DX gateway with private VIFs to each VPC's virtual private gateway
DX gateway + private VIFs reaches VPCs but bypasses TGW — no transit segmentation between VPCs.
Why this answer
A transit VIF to DX gateway + TGW carries private traffic to many VPCs across regions and lets TGW route tables enforce segmentation. Private VIF + VGW works too but TGW is required for the segmentation control and scales better for 30+ VPCs.
Correct answer: B · Last reviewed 2026-10-26
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Hybrid Connectivity practice session.
Practice Hybrid Connectivity