A large corporation has several branch offices and applications are deployed in AWS. The branch offices and the AWS VPC need to communicate with each other. The connectivity should be secure, cost-effective, and based on existing internet connections. Which of the following methods would you choose?

Answer options:

A.Configure an AWS Direct Connect with hardware VPNs to establish secure network connections between remote sites and AWS VPC.B.Launch an EC2 instance with the VPN software installed to establish IPSec VPN connections.
C.Use AWS VPN CloudHub to enable the communication between the branch offices and the VPC.D.For each branch office, create a Virtual Private Gateway in AWS VPC to establish a software VPN connection.

Correct Answer: C
Option A is incorrect because although hardware VPNs can provide secure connections, Direct Connect should not be used as it is not cost-effective and not based on existing internet connections.
Option B is incorrect because this option uses a single EC2 instance that may have availability issues. It also does not provide the connectivity between branch offices.
Option C is CORRECT because AWS VPN CloudHub provides secure connections based on existing internet. AWS VPN CloudHub uses an Amazon VPC virtual private gateway with multiple customer gateways to provide the connectivities. It operates on a simple hub-and-spoke model as the following snapshot:
Option D is incorrect because there is no need to create a Virtual Private Gateway for each branch office. With AWS VPN CloudHub, a VPC only needs a single Virtual Private Gateway. Other than that, a hardware VPN is established with Virtual Private Gateway instead of a software VPN.
References:
https://docs.aws.amazon.com/whitepapers/latest/aws-vpc-connectivity-options/aws-vpn-cloudhub.html
https://docs.aws.amazon.com/vpn/latest/s2svpn/VPN_CloudHub.html, https://docs.aws.amazon.com/whitepapers/latest/aws-vpc-connectivity-options/aws-managed-vpn.html