A company runs an intranet application on premises. The company wants to configure a cloud backup of the application. The company has selected AWS Elastic Disaster Recovery for this solution. The…

A VPC with private subnets provides isolated network segments for the application and replication servers, while a Virtual Private Gateway (VPG) is necessary to terminate the AWS Direct Connect connection to the VPC, and NAT gateways enable outbound communication from private subnets for EDR service interactions without exposing the application.

Public subnets and an Internet Gateway would expose the application to the internet and route replication traffic over it, directly violating the requirements for private access and replication.

While an AWS Site-to-Site VPN provides private connectivity over the internet, Direct Connect (D) is generally preferred for its dedicated bandwidth, which better meets the requirement of not consuming all available network bandwidth for other applications.

An AWS Direct Connect connection establishes a dedicated private network connection between the on-premises network and AWS, ensuring replication traffic does not traverse the public internet and provides consistent, high bandwidth, addressing both privacy and bandwidth requirements.

Selecting to use private IP addresses for data replication during the replication servers' configuration ensures that the replication traffic flows exclusively over the private network connection (e.g., Direct Connect) and avoids the public internet.

While ensuring launched servers do not have public IP addresses meets the requirement for the application not to be internet-accessible, launching into private subnets (as set up in A) inherently prevents public IP assignment by default, making A, D, and E more foundational and direct steps for the overall solution.