Get Your CertSAA-C03PlayCompete
‹ All SAA-C03 questions

SAA-C03 Practice Question 3: S3 Gateway VPC Endpoint

AWS Certified Solutions Architect – Associate (SAA-C03) · Test 1 · question 3 of 10

Network Securitymedium

EC2 instances in the private subnets of a VPC write roughly 8 TB of logs per month to an S3 bucket in the same Region. That traffic currently exits through a NAT gateway, and the NAT gateway's data-processing charges have become the largest line item on the VPC bill.

A new standard requires that traffic from the VPC to Amazon S3 reach the service without an internet gateway or a NAT device. Which change satisfies the standard at the lowest cost?

Select one answer
Show answer and explanation

Answer:

  • A. Create a gateway VPC endpoint for Amazon S3 and associate it with the private subnets' route tables

A gateway VPC endpoint gives a VPC reliable connectivity to Amazon S3 and DynamoDB without an internet gateway or a NAT device. When you create it you select route tables, and AWS adds a route whose destination is the service's AWS-managed prefix list and whose target is the endpoint. Every instance in a subnet associated with one of those route tables then reaches S3 over the endpoint. Crucially for the cost requirement, there is no additional charge for gateway endpoints; the 8 TB stops flowing through the NAT gateway and stops being billed for data processing.

Option B does keep the traffic off the internet gateway and NAT device, so it satisfies the standard, but it is the expensive way to do it. Interface endpoints are billed per endpoint per Availability Zone per hour and per GB of data processed, so at 8 TB a month across multiple AZs they cost substantially more than the free gateway endpoint. Interface endpoints for S3 earn their keep when you need to reach the bucket from on-premises over Direct Connect or VPN, something a gateway endpoint cannot do, which is not a requirement here.

Option C removes the NAT charge but fails the standard: instances in a public subnet reach S3 through the internet gateway, and giving log-writing workers public IP addresses makes them reachable from the internet, which is a clear security regression.

Option D changes nothing architecturally. A NAT instance still routes to an internet gateway, so the standard is still violated, and you have swapped a managed, horizontally scaled service for a single EC2 instance that is both a bandwidth bottleneck at 8 TB/month and a single point of failure.

Reference: Gateway endpoints

Practice Test 1 ›

Study guides for SAA-C03

AWS Developer Associate exam guide: DVA-C02 to DVA-C03AWS Developer Associate exam: DVA-C02 ends 30 November 2026 and DVA-C03 starts 1 December. What changes, which to sit, format, price and study plan.
AWS interview questions: scenarios, freshers to experiencedAWS interview questions on EC2, Lambda, S3, databases, VPC and IAM, by level, with four scenarios worked end to end and the facts old answers get wrong.
AWS Security Specialty: is it worth it, and what's testedAWS Security Specialty (SCS-C03): who it's worth it for, the six domains, new question types, price, and how it compares with CISSP.
SAA-C03 exam guide: what's on it and how to passSAA-C03 exam guide for 2026: the four domains, 65 questions in 130 minutes, price in USD and INR, the October 2026 guide update and a study plan.
AWS Service Control Policies Explained: SCPs and DenialsAWS service control policies explained: how SCPs cap permissions, why admins still get access denied, inheritance, deny vs allow lists and the exam traps.
Business Automation Examples: McDonald's to Step FunctionsBusiness automation examples from McDonald's, KFC, Ford and Toyota, the four moves they share, what to automate first, and AWS Step Functions.
How AI Is Changing Software Jobs: Where to PrepareHow AI is changing software jobs: what history shows, the evidence on junior developers, what Klarna learned, new AI roles and five domains to prepare for.
How AWS Certification Exams Work: Scoring and RenewalHow AWS certification exams work: levels, booking, question types, unscored questions, scaled scores, pass marks, validity and how recertification works.
How Netflix Uses AWS: Control Plane, CDN and ChaosHow Netflix uses AWS: the 2008 outage behind the move, control plane vs Open Connect, chaos engineering, multi-Region design and what it teaches for exams.
What Is Amazon RDS? Multi-AZ, Read Replicas and BackupsWhat is Amazon RDS? Engines, Multi-AZ, read replicas, backups, RDS Proxy, Aurora and pricing explained, with the traps that AWS exams set around each one.
What Is AWS Lambda? Triggers, Concurrency and Cold StartsWhat is AWS Lambda? How functions run, cold starts, triggers vs event source mappings, concurrency, layers, aliases, pricing and the exam traps.
What jobs can you get with AWS Cloud Practitioner?What jobs can you get with AWS Cloud Practitioner (CLF-C02)? The roles it helps with, the ones it won't land on its own, and what to add next.
AWS CloudOps Engineer Associate (SOA-C03) exam guideAWS Certified CloudOps Engineer – Associate (SOA-C03) replaced SysOps Administrator. Format, cost, the five domains, what changed and how to prepare.
Which AWS certification should you get? 2026 roadmapWhich AWS certification to get first, by role and experience, with each exam's status in October 2026, what is changing, and prices in USD and INR.
What Is AWS Glue? Data Catalog, Crawlers and ETL JobsWhat is AWS Glue? The Data Catalog, crawlers, ETL jobs and DPUs, workflows, streaming, job bookmarks, Flex and Data Quality, plus the traps AWS exams set.
AWS Edge Locations and CloudFront, ExplainedHow AWS edge locations work: CloudFront POPs, regional edge caches, the request path, edge location vs Region, and the Global Accelerator exam trap.
What Is Amazon EC2? Instances, AMIs, EBS and Auto ScalingAmazon EC2 explained: instances, AMIs, instance types, security groups, EBS, Auto Scaling groups and pricing options, with the traps AWS exams set.
Amazon S3 storage classes and lifecycle rulesHow S3 storage classes, Intelligent-Tiering and lifecycle rules work, with the retrieval fees and minimum durations that AWS exam questions turn on.
AWS disaster recovery strategies, RTO and RPOBackup and restore, pilot light, warm standby and active/active on AWS, how RTO and RPO pick between them, and the services each strategy uses.
IAM users, roles and policies on AWSHow IAM users, roles, identity-based and resource-based policies, cross-account access, SCPs and permissions boundaries fit together for AWS exams.
SQS vs SNS vs EventBridge on AWSWhen to use an SQS queue, an SNS topic or an EventBridge bus, plus fan-out, FIFO ordering, visibility timeouts and dead-letter queues for AWS exams.
The AWS shared responsibility model explainedWhat AWS secures and what you secure on EC2, RDS, Lambda and S3, how the line moves with each service, and how Cloud Practitioner questions test it.
VPC endpoints vs NAT gateways on AWSWhen to use gateway endpoints, interface endpoints (PrivateLink) or a NAT gateway for private subnets, and the cost and security trade-offs exams test.