Reply To: Request for clarification. Possible bad answer Set 3

[Nikee-TutorialsDojo]

Hello Everyone,

Thanks for raising this. The cost concern is valid because AWS Transit Gateway does introduce additional charges. However, there is an important detail in the correct option: it does not require another Direct Connect connection. The company continues using its existing Direct Connect connection and adds a Direct Connect gateway and Transit Gateway to extend that connectivity to VPCs across multiple AWS accounts.

AWS specifically documents this architecture as a way to use a single Direct Connect connection for multiple VPCs. The Transit Gateway provides centralized routing, and it can be shared across AWS accounts using AWS Resource Access Manager (AWS RAM). This makes it scalable as additional accounts and VPCs are added without creating a separate Direct Connect or VPN connection for each one.

The AWS VPN CloudHub option may initially appear cheaper, but it is intended primarily for connecting multiple remote networks or branch offices through Site-to-Site VPN connections. Each VPN connection also has its own hourly and data-transfer costs. More importantly, VPN CloudHub would require additional VPN connections and management as the environment grows.

There is also an important requirement in the scenario: consistent and dedicated access to the on-premises DNS and Active Directory services. Direct Connect provides the existing dedicated network path, while Site-to-Site VPN connectivity traverses the internet. Therefore, replacing or supplementing this architecture with separate VPN connections would not make the best use of the dedicated connection that the company already has.

For exam questions like this, it helps to identify three things:

1. What already exists? An established Direct Connect connection.
2. What needs to scale? Connectivity to multiple new AWS accounts.
3. What minimizes repeated resources? A centralized Direct Connect gateway + Transit Gateway architecture.

So, “cost-effective” here does not necessarily mean selecting the service with the lowest individual hourly price. It means meeting all requirements while avoiding separate connections and additional management for every new AWS account.

Therefore, Direct Connect Gateway + Transit Gateway is the best answer because it reuses the existing dedicated connection and provides centralized, scalable cross-account connectivity with less operational overhead.

Hope this clears the confusion you have. If you have any further questions, please don’t hesitate to contact us.

Regards,
Nikee @ Tutorials Dojo