A customer has two local data centers that need to establish VPN connections to an AWS VPC. You plan to use AWS VPN CloudHub to manage these multiple VPN connections. In the future, you may want to add more Site-to-Site VPN connections in CloudHub. To establish redundant connections, each local data center needs twoSite-to-Site VPN connections so that the service is not impacted even if one Customer Gateway becomes unavailable. How many Virtual Private Gateways and Customer Gateways does this scenario need?

Answer options:

A.2 Virtual Private Gateway and 4 Customer Gateways.
B.2 Virtual Private Gateway and 2 Customer Gateways.
C.1 Virtual Private Gateway and 4 Customer Gateways.
D.1 Virtual Private Gateway and 2 Customer Gateways.

Correct Answer – C
VPN CloudHub operates on a simple hub-and-spoke model to manage multiple AWS Site-to-Site VPN connections. The VPN CloudHub architecture is as follows.
A common Virtual Private Gateway is required and each VPG supports ten IPsec VPN connections. Besides, for each local data center, a redundant Site-to-Site VPN connection should be established to ensure connectivity if one Customer Gateway becomes unavailable. Two Customer Gateways are required for each local data center, and 4 Customer Gateways are needed in total. References can be found in:
https://docs.aws.amazon.com/vpc/latest/userguide/vpn-connections.html,
https://docs.aws.amazon.com/vpn/latest/s2svpn/VPN_CloudHub.html,
https://docs.aws.amazon.com/vpn/latest/s2svpn/VPNConnections.html,
https://aws.amazon.com/vpn/faqs/
Option A is incorrect: Because one Virtual Private Gateway is enough for this scenario.
Option B is incorrect: Because 4 Customers Gateways are required to provide high availability.
Option C is CORRECT: Please check the above explanations.
Option D is incorrect: Because each data center needs two Site-to-Site VPN connections and two Customer Gateways.