Get Your CertSAP-C02PlayCompete
‹ All SAP-C02 questions

SAP-C02 Practice Question 43: Egress Architecture Cost

AWS Certified Solutions Architect – Professional (SAP-C02) · Test 5 · question 3 of 10

Hybrid Networkingmedium

A company runs 60 spoke VPCs that are already attached to a transit gateway in a shared network account. Each spoke VPC runs its own NAT gateway in each of two Availability Zones, so 120 NAT gateways are billed by the hour.

A cost analysis shows that 57 of the VPCs send only a few gigabytes a month to the internet, mostly operating system patching, so their bill is almost entirely NAT gateway hourly charges. The remaining three VPCs are media transcoding environments that each push roughly 300 TB a month out to the internet, and for them the per-gigabyte processing charge dwarfs the hourly charge.

All VPCs must keep outbound internet access, no workload may become directly reachable from the internet, and the network team wants the lowest total cost. What should the solutions architect recommend?

Select one answer
Show answer and explanation

Answer:

  • C. Build a central egress VPC in the network account with one NAT gateway per Availability Zone, send the 57 low-volume VPCs' default routes to it through the transit gateway, and leave local NAT gateways in the three transcoding VPCs

AWS documents both halves of this trade-off. Deploying a NAT gateway in every spoke VPC "can become cost prohibitive because you pay an hourly charge for every NAT gateway you deploy", and centralizing NAT gateways in an egress VPC reached over the transit gateway is the recommended way to cut that cost, which is the right answer for the 57 VPCs whose bill is almost all hourly charge. But AWS also warns that centralizing through a transit gateway adds a Transit Gateway data processing charge on every byte, and that "in some edge cases when you send huge amounts of data through NAT gateway from a VPC, keeping the NAT local in the VPC to avoid the Transit Gateway data processing charge might be a more cost-effective option". Three VPCs each sending 300 TB a month are exactly that edge case. Splitting the estate by traffic profile is what makes this the lowest-cost design.

Option A applies the right pattern indiscriminately. Pulling the three transcoding VPCs into the central egress path adds transit gateway data processing to roughly 900 TB a month, which can easily cost more than the six NAT gateway hours it saves.

Option B trades a managed service for instances the team must patch, monitor, and scale. AWS recommends NAT gateways over NAT instances for availability and bandwidth, and a NAT instance's throughput is capped by its instance type, a poor fit for 300 TB a month.

Option D removes the NAT layer by putting workloads directly on the internet edge with public IP addresses, which the requirements forbid, and it does not reduce data transfer charges anyway.

Reference: Using the NAT gateway for centralized IPv4 egress

Practice Test 5 ›

Study guides for SAP-C02

Which AWS certification should you get? 2026 roadmapWhich AWS certification to get first, by role and experience, with each exam's status in October 2026, what is changing, and prices in USD and INR.
SAP-C02 vs SAP-C03, the Solutions Architect Professional updateWhat changes when AWS replaces SAP-C02 with SAP-C03, the key dates, who should still sit SAP-C02, and how to study through the switch without wasted work.
AWS disaster recovery strategies, RTO and RPOBackup and restore, pilot light, warm standby and active/active on AWS, how RTO and RPO pick between them, and the services each strategy uses.
IAM users, roles and policies on AWSHow IAM users, roles, identity-based and resource-based policies, cross-account access, SCPs and permissions boundaries fit together for AWS exams.
SQS vs SNS vs EventBridge on AWSWhen to use an SQS queue, an SNS topic or an EventBridge bus, plus fan-out, FIFO ordering, visibility timeouts and dead-letter queues for AWS exams.
VPC endpoints vs NAT gateways on AWSWhen to use gateway endpoints, interface endpoints (PrivateLink) or a NAT gateway for private subnets, and the cost and security trade-offs exams test.