SAP-C02 Practice Question 38: NAT Data Processing Charges
AWS Certified Solutions Architect – Professional (SAP-C02) · Test 4 · question 8 of 10
A cost review shows that NAT gateway data processing charges have become the third largest line item on a company's bill. Investigation finds that EC2 instances and containers in private subnets across 12 VPCs send roughly 200 TB per month to Amazon S3 and Amazon DynamoDB, and all of that traffic is routed through the NAT gateways in each VPC's public subnets.
The workloads must stay in private subnets with no route to an internet gateway. The finance team wants the S3 and DynamoDB share of the NAT charges removed, and asks for an option that does not add a new hourly or per-gigabyte charge of its own. Other outbound traffic, such as operating system package updates, must keep working as it does today.
What should the solutions architect do?
Show answer and explanation
Answer:
Gateway endpoints provide connectivity to Amazon S3 and DynamoDB without an internet gateway or a NAT device, and AWS states plainly that there is no additional charge for using them, which is the constraint that decides this question. When the endpoint is associated with a route table, a route to the service's AWS-managed prefix list is added automatically, and because routing uses longest prefix match, that route takes precedence over the 0.0.0.0/0 route to the NAT gateway for traffic to that service in the same Region. The 200 TB stops being processed by the NAT gateway. Everything else, such as package updates, still matches the default route and keeps flowing through NAT unchanged, and the instances remain in private subnets.
Option A trades a NAT charge for a much bigger problem: it puts workloads that are required to stay private on the public internet, and it exposes them directly rather than reducing data processing cost in any principled way.
Option C works technically and keeps traffic private, but interface endpoints are AWS PrivateLink endpoints billed per endpoint-hour and per gigabyte processed. At 200 TB a month across 12 VPCs that replaces one per-gigabyte charge with another, which is what the finance team explicitly ruled out.
Option D swaps a managed service for instances the team must patch, monitor, and scale, and a NAT instance's throughput is capped by its instance type. The data still crosses a NAT device, so the architectural cause of the charge is untouched.
Reference: Gateway endpoints