Site-to-Site VPN vs dedicated interconnect

WHAT THIS TESTS The interviewer wants a clear comparison of hybrid connectivity along the dimensions that actually drive the decision: latency consistency, bandwidth, cost, security, and time to provision.

A GOOD ANSWER COVERS A Site-to-Site VPN establishes an encrypted IPsec tunnel between your on-premises gateway and a cloud VPN gateway over the public internet. It is inexpensive, can be provisioned in hours, and encrypts data in transit, but because it rides the public internet it has variable latency, jitter, and throughput capped by both the internet path and tunnel limits. A dedicated interconnect, such as AWS Direct Connect or Azure ExpressRoute, is a private circuit provisioned through a partner that bypasses the public internet entirely. It delivers consistent low latency, high and predictable bandwidth up to many gigabits, and stronger SLAs, which matters for large data transfers, latency-sensitive workloads, and compliance that disfavors public transit. The tradeoffs are higher recurring cost and a lead time of weeks because physical cross-connects must be installed. A common production pattern uses the dedicated link as primary and a VPN as an encrypted, cheaper failover. Note that ExpressRoute and Direct Connect are not encrypted by default at the circuit level, so you may layer encryption on top for sensitive data.

COMMON WRONG ANSWERS Claiming the dedicated link is always better and ignoring its cost and weeks-long provisioning. Assuming Direct Connect or ExpressRoute is automatically encrypted. Treating VPN throughput and latency as equivalent to a private circuit.

LIKELY FOLLOW-UPS How do you achieve redundancy on a dedicated link? How is encryption added over ExpressRoute? What bandwidth justifies the cost crossover?

ONE CONCRETE EXAMPLE A nightly 10 TB analytics sync to the cloud saturates and stalls over a VPN, so the team provisions a 10 Gbps Direct Connect for predictable throughput and keeps the existing VPN as an encrypted failover path.