SAA-C03 Practice Question 51: PrivateLink Endpoint Service

This is exactly the AWS PrivateLink provider pattern. The provider fronts the service with a Network Load Balancer, registers it as a VPC endpoint service, and grants named AWS principals permission to connect. Each consumer then creates an interface VPC endpoint, which places an endpoint network interface in the consumer's own subnets. Traffic never touches the internet, and because the connection terminates on the endpoint network interface rather than being routed between the two VPCs, overlapping CIDR blocks are irrelevant. The consumer can reach the endpoint service and nothing else in the provider VPC, which is precisely the isolation requirement.

Option A fails on two counts. VPC peering does not work at all between VPCs with overlapping CIDR blocks, and a peering connection makes the whole peered address range routable, so isolation would depend entirely on security groups and route tables. Several hundred peering connections is also well past what is manageable.

Option C has the same overlapping-CIDR problem, since a transit gateway route table needs unique, non-overlapping destinations to route between attachments. It also puts every customer on a shared routing domain, which is the opposite of the one-way, service-only access being asked for.

Option D puts customer traffic on the public internet, which the requirement rules out. Filtering by published public IP ranges is also brittle: customer egress addresses change, and NAT gateway addresses are not stable identities to build an access model on.

Reference: Share your services through AWS PrivateLink