An education agency hosts a private competition in AWS. Each participating school uses a known centrally managed IP addressing scheme. Schools access the competition over Site-to-Site VPNs using BGP. All traffic must be encrypted in transit, only authorized endpoints may connect, and school firewalls block ICMP. The agency needs a cost-effective way to notify schools when their connectivity fails so they can take corrective action on-premises. Which combination of measures satisfies these needs most economically? (Choose two.)

The first correct option leverages CloudWatch metrics for VPN tunnel state, which are readily available and directly indicate connectivity health. Setting up a CloudWatch alarm with SNS is a cost-effective, automated way to notify schools when tunnels are down. The second correct option addresses the BGP aspect of the VPN. When BGP routes are not propagated into the VPC route table, it signifies a routing issue, even if the tunnels are technically up. A Lambda function checking for these routes and sending an SNS notification provides a crucial, complementary check for full connectivity, especially given the BGP requirement. The Lambda ping option fails because school firewalls block ICMP. The CloudWatch dashboard is less cost-effective for automated notifications. VPC Reachability Analyzer is a diagnostic tool, not designed for continuous, automated monitoring and notification in this scenario.