CLF-C02 Security and Compliance Practice Question
A company runs a three-tier application where Amazon EC2 instances in a private subnet must retrieve database credentials from AWS Secrets Manager without traversing the public internet. The instances have no public IP addresses, and the security team wants to avoid managing NAT gateway costs for this traffic. Which action should the company take?
⚠ Common exam trap
The trap here is assuming any private-subnet workload needs a NAT gateway for AWS service calls, when interface endpoints remove that need entirely.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an interface VPC endpoint for Secrets Manager using AWS PrivateLink
AWS PrivateLink interface endpoints create private connectivity to supported AWS services from within a VPC. For Secrets Manager, an interface endpoint lets private instances call the service API over the Amazon network without NAT, internet gateways, or public IP addresses, which satisfies both the no-public-internet rule and the cost concern.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create an interface VPC endpoint for Secrets Manager using AWS PrivateLink
Why this is correct
An interface VPC endpoint powered by AWS PrivateLink places an elastic network interface in the subnet and routes Secrets Manager API calls privately within the VPC. Traffic never leaves the Amazon network, no internet gateway or NAT device is needed, and security groups control access, satisfying both the privacy and cost requirements.
- ✗
Deploy a NAT gateway in the private subnet and update the route table
Why it's wrong here
A NAT gateway would let private instances reach Secrets Manager over the internet, but the company explicitly wants to avoid NAT gateway costs for this traffic. NAT gateways also charge hourly and per gigabyte processed, so this option contradicts the cost constraint.
- ✗
Attach an internet gateway to the VPC and add a route for the private subnet
Why it's wrong here
An internet gateway requires the subnet to be public and instances to have public IP addresses or an elastic IP, which conflicts with the stated design and exposes traffic to the public internet. It also does not address the desire to avoid internet-bound traffic for credentials.
- ✗
Store the credentials in an encrypted Amazon S3 bucket and read them with the AWS CLI
Why it's wrong here
Moving credentials to S3 does not solve private connectivity, because S3 access from a private subnet would still require a gateway or interface endpoint or internet egress. It also weakens secret rotation and auditing compared with Secrets Manager, so it does not meet the requirement.
Visual reference
Go deeper
Related to this question
About these practice questions
This CLF-C02 question is part of Courseiva's 993-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.