CLF-C02 Cloud Technology and Services Practice Question
A company runs a web application on Amazon EC2 instances in a private subnet. The application needs to access Amazon S3 to store and retrieve objects, but the company wants to ensure that traffic between the EC2 instances and S3 does not traverse the public internet. Which solution should the company implement?
⚠ Common exam trap
The trap here is thinking that a NAT gateway keeps traffic private, but it actually routes traffic through the public internet, whereas a VPC endpoint provides a private connection.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an Amazon S3 gateway VPC endpoint and update the route table for the private subnet.
An Amazon S3 gateway VPC endpoint enables private connectivity between a VPC and Amazon S3, ensuring that traffic does not leave the AWS network. By associating the endpoint with the private subnet's route table, instances can access S3 securely and cost-effectively. The other options either route traffic over the public internet or are intended for different use cases.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Attach an Elastic IP address to each EC2 instance and allow outbound traffic to S3.
Why it's wrong here
Attaching an Elastic IP address to an EC2 instance in a private subnet would require the instance to have a route to the internet, typically via an internet gateway, which would expose the instance to the public internet. This does not keep traffic private and introduces security risks. It also does not guarantee that S3 traffic stays off the public internet.
- ✗
Configure a NAT gateway in a public subnet and route S3 traffic through it.
Why it's wrong here
A NAT gateway allows instances in a private subnet to access the internet, but traffic to S3 would still traverse the public internet. This does not meet the requirement of keeping traffic off the public internet. Additionally, NAT gateways incur data processing charges, and using them for S3 access is less secure and less cost-effective than a VPC endpoint.
- ✗
Use AWS Direct Connect to establish a private connection to Amazon S3.
Why it's wrong here
AWS Direct Connect provides a dedicated private network connection from on-premises to AWS, but it is not used for traffic between EC2 instances and S3 within AWS. It is designed for hybrid connectivity and would not address the requirement for private subnet instances to access S3 without internet traversal. It is also more complex and costly than a VPC endpoint.
- ✓
Create an Amazon S3 gateway VPC endpoint and update the route table for the private subnet.
Why this is correct
An Amazon S3 gateway VPC endpoint provides a private connection between a VPC and Amazon S3, allowing instances in private subnets to access S3 without traversing the public internet. By adding the endpoint to the route table of the private subnet, traffic to S3 is routed through the endpoint. This meets the security requirement and is cost-effective.
Visual reference
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 993 original CLF-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.