title: Why doesn't a software VPN take advantage of an already existing Direct Connect connection?
body: <p><a href="https://d1.awsstatic.com/training-and-certification/docs-advnetworking-spec/AWS_Certified_Advanced_Networking_Specialty_SampleExam.pdf" rel="nofollow noreferrer">The official sample of AWS Advanced Networking Speciality</a> questions contains a question about the most cost-effective connection between your
  on-premises data centre and AWS ensuring confidentiality and integrity of the data in transit to your VPC (the question <strong>#7</strong>).</p>
  
  <p>The correct answer implies establishing of the managed VPN connection between the customer gateway appliance and the virtual private gateway <strong>over the Direct Connect connection</strong>.</p>
  
  <p>However one of the possible options in the list of answers offers a <a href="https://docs.aws.amazon.com/whitepapers/latest/aws-vpc-connectivity-options/software-vpn-network-to-amazon.html" rel="nofollow noreferrer">software VPN solution</a> ("<em>Set up an IPsec tunnel between your customer gateway and a software VPN on Amazon EC2 in the
  VPC</em>"). The explanation why this answer is incorrect says that:</p>
  
  <blockquote>
    <p>it would not take
    advantage of the already existing Direct Connect connection</p>
  </blockquote>
  
  <p>My question is: why would not this software VPN connection take advantage of the already existing DC connection? What's the principal difference here?</p>