SAP-C02
Deep Dive
Most enterprise migrations go through a hybrid phase where on-premises and cloud resources coexist. The SAP-C02 tests designing highly available hybrid connectivity with Direct Connect, Outposts, Local Zones, and hybrid DNS patterns.
Contents
Cloud Bursting
The app normally runs on-premises. During demand spikes, it automatically bursts into AWS. Requires low latency between on-prem and AWS.
Low-latency Direct Connect, VPN as backup, hybrid DNS for routing.
Lift-and-Extend
App partially migrated to AWS. The DB stays on-premises. Or the reverse: an on-prem app accesses managed AWS services (RDS, S3).
Storage Gateway, Direct Connect, VPN, Route 53 hybrid DNS.
Full Hybrid Steady State
Permanent workloads in both environments due to compliance, ultra-low latency, or regulation. AWS and on-premises treated as first-class citizens.
AWS Outposts, redundant Direct Connect, Transit Gateway, Shared VPCs.
AWS Direct Connect provides dedicated private network connections between on-premises and AWS. Unlike VPN (which uses the internet), DX uses dedicated physical lines with dedicated bandwidth and consistent latency.
DX connection types
Direct Connect HA patterns
HA Level 1 (Maximum)
2 DX connections at different DX locations + 2 Customer Gateways at different datacenter locations. 4 fully independent physical paths. If an entire DX location fails, the other DX stays active.
HA Level 2 (Standard)
2 DX connections at the SAME DX location with 2 different customer devices. Protects against a single device failure, but not against the entire DX location failing.
DX + VPN Backup
Primary DX + Site-to-Site VPN as fallback. If DX fails, traffic uses VPN (higher latency over the internet). Cheaper than 2 DX links but with degraded performance on failover.
Direct Connect Gateway — connecting DX to multiple regions
Without a DXGW (legacy)
A DX can only connect to VPCs in the SAME region via a Virtual Gateway. For multiple regions you need multiple DX connections.
With a DXGW (recommended)
A single DX + DXGW can connect to up to 20 VGWs (Virtual Private Gateways) across up to 3 different regions. Or, via Transit VIF, connect to multiple TGWs across multiple regions.
AWS Outposts brings AWS infrastructure and services into the customer's own facility. The Outposts rack is literally AWS hardware installed in your datacenter, managed remotely by AWS.
Why use Outposts
Services available on Outposts
Note: Not every AWS service is available on Outposts. S3 on Outposts is a separate service from S3.
Outposts requires connectivity to AWS
Outposts needs reliable connectivity to the parent AWS region for: control plane management, updates, and service sync. If connectivity is lost, existing resources keep running but new resources can't be created or modified.
AWS Local Zones
Extensions of AWS regions placed near major metropolitan areas (cities). They let you run applications with single-digit millisecond latency for users in that city.
AWS Wavelength
AWS infrastructure deployed inside telecom operators' 5G networks. For applications that need single-digit millisecond latency to 5G devices.
| Option | Typical latency | Operated by | Best for |
|---|---|---|---|
| AWS Region | 50–100ms (to remote users) | AWS (own datacenter) | Most workloads, DR, global deployment |
| AWS Local Zone | < 10ms (to a specific city) | AWS (placed near a city) | Low latency for users in a specific city |
| AWS Outposts | < 1ms (on-premises) | AWS (hardware in your DC) | Ultra-low latency, data residency, legacy systems |
| AWS Wavelength | < 10ms (to 5G devices) | Telecom operators | Apps for 5G mobile devices |
Components and limitations
Accelerated VPN — with Global Accelerator
Accelerated Site-to-Site VPN uses AWS Global Accelerator so packets enter the AWS network at the nearest edge location, reducing VPN latency and jitter.
In hybrid environments, DNS resolution is critical — EC2 needs to resolve on-premises names and the datacenter needs to resolve VPC names and AWS service endpoints. Route 53 Resolver manages this with Endpoints and Rules.
Inbound Resolver Endpoint
ENIs in VPC subnets with private IPs. The on-premises DNS can send queries to those IPs to resolve names in the VPC's Private Hosted Zones.
→ On-premises resolves VPC names
Outbound Resolver Endpoint
Route 53 Resolver in the VPC can forward queries for certain domains (via Forward Rules) to the on-premises DNS when EC2 needs to resolve corporate names.
→ EC2 resolves on-premises names
Full hybrid DNS pattern
EC2 queries the Resolver (169.254.169.253) → Forward Rule for corp.example.com → Outbound Endpoint → on-premises DNS. A query from on-premises for vpc.example.com → on-premises DNS has a conditional forwarder → Inbound Endpoint → Route 53 Resolver → Private Hosted Zone.
Trap: "Direct Connect is more secure than VPN because it uses dedicated fiber"
Reality: Direct Connect does not encrypt traffic by default — it's only a private connection, not an encrypted one. For encryption over DX, use MACsec (at the DX layer) or an IPSec VPN over the DX public interface. VPN does encrypt with IPSec.
Trap: "AWS Outposts works with no internet or AWS region connectivity"
Reality: FALSE. Outposts requires connectivity to the AWS control plane in the parent region. Without this connectivity, new resources cannot be created, even though existing ones keep running.
Trap: "Local Zones and Availability Zones are the same thing"
Reality: They're different. AZs are datacenters within an AWS region. Local Zones are region extensions placed in specific cities — they share the region's control plane but are physically located elsewhere for lower latency to that city.
Did you get this topic?
Test what you just learned
A financial company operates in Argentina and has regulatory requirements preventing certain customer data from leaving the country. At the same time, they want to use AWS services like EC2 and RDS for a new application. The nearest AWS region is us-east-1 in Virginia. What is the most appropriate architecture?
Put what you learned to the test with original SAP-C02 exam questions.
Start SAP-C02 mock examUnlimited mock exams with the Pro plan
Log in to track your progress.