Get Your CertSAP-C02PlayCompete
‹ All SAP-C02 questions

SAP-C02 Practice Question 44: Internal API Network Isolation

AWS Certified Solutions Architect – Professional (SAP-C02) · Test 5 · question 4 of 10

Design for New Solutionsmedium

An insurer exposes an internal claims API through a regional Amazon API Gateway REST API. Access is currently limited by a resource policy that allows a list of public IP addresses: the corporate data centre's NAT address and the egress addresses of three AWS accounts. Last month the corporate NAT address changed during a firewall replacement and the API was unreachable for half a day, and a security review objected that the API resolves on the public internet at all.

The replacement must make the API callable only from inside the company's VPCs and from the on-premises data centre over AWS Direct Connect, must not be resolvable or reachable from the public internet, and must let the security team restrict which specific VPC endpoints are allowed to invoke it. The API's Lambda integrations and its stages must not have to be rebuilt.

What should the solutions architect do?

Select one answer
Show answer and explanation

Answer:

  • A. Redeploy the API as a private REST API, create an interface VPC endpoint for execute-api and associate it with the API, and attach a resource policy that allows invocation only from the approved endpoints using an aws:SourceVpce condition

A private API in API Gateway is callable only from within an Amazon VPC, through an interface VPC endpoint powered by AWS PrivateLink. AWS states that you can also use Direct Connect to reach a private API from an on-premises network over that connection, and that in all cases traffic to a private API is isolated from the public internet and never leaves the Amazon network, which covers both connectivity requirements and the security review's objection at once. AWS's own best practice for narrowing access further is to add aws:SourceVpc or aws:SourceVpce conditions to the API's resource policy, which is exactly the per-endpoint control the security team asked for. Associating the VPC endpoint with the API creates the Route 53 alias record that lets callers invoke it by name, and only the endpoint type changes; integrations and stages are untouched.

Option B leaves the API on the public internet and keeps the brittle IP allow-list that caused the outage; it only moves the list into AWS WAF.

Option C confuses authentication with network isolation. An edge-optimized API is still publicly resolvable and reachable, so the endpoint remains exposed to the internet no matter how good the authorizer is.

Option D inverts the direction of a VPC link. A VPC link lets API Gateway reach *private integrations* inside a VPC; it does not make the API's own endpoint private, so an HTTP API with a VPC link is still invoked over a public endpoint. Private APIs are also supported only for REST APIs.

Reference: Private REST APIs in API Gateway

Practice Test 5 ›

Study guides for SAP-C02

Which AWS certification should you get? 2026 roadmapWhich AWS certification to get first, by role and experience, with each exam's status in October 2026, what is changing, and prices in USD and INR.
SAP-C02 vs SAP-C03, the Solutions Architect Professional updateWhat changes when AWS replaces SAP-C02 with SAP-C03, the key dates, who should still sit SAP-C02, and how to study through the switch without wasted work.
AWS disaster recovery strategies, RTO and RPOBackup and restore, pilot light, warm standby and active/active on AWS, how RTO and RPO pick between them, and the services each strategy uses.
IAM users, roles and policies on AWSHow IAM users, roles, identity-based and resource-based policies, cross-account access, SCPs and permissions boundaries fit together for AWS exams.
SQS vs SNS vs EventBridge on AWSWhen to use an SQS queue, an SNS topic or an EventBridge bus, plus fan-out, FIFO ordering, visibility timeouts and dead-letter queues for AWS exams.
VPC endpoints vs NAT gateways on AWSWhen to use gateway endpoints, interface endpoints (PrivateLink) or a NAT gateway for private subnets, and the cost and security trade-offs exams test.