CLF-C02 Cloud Technology and Services Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Internet Gateway

  Why it's wrong here

  An Internet Gateway is a horizontally scaled, redundant VPC component that enables communication between a VPC and the public internet. It is used to allow instances with public IPs to reach the internet and for inbound traffic from the internet. However, for private connectivity to AWS services like S3 or DynamoDB, using an Internet Gateway would force traffic to traverse the public internet, which defeats the purpose of a VPC endpoint's private, low-latency connection. Thus, it is incorrect because it relies on an internet path rather than eliminating it.

• ✗

  NAT Gateway

  Why it's wrong here

  A NAT Gateway enables instances in a private subnet to initiate outbound traffic to the internet (e.g., for software updates) while preventing unsolicited inbound connections from the internet. Although it might be used to reach AWS services, the traffic still goes over the public internet rather than over the AWS private network. VPC endpoints provide a private connection that does not depend on any internet path, is more secure, and avoids internet-related data transfer charges. Therefore, it is wrong because it still uses an internet route instead of a fully private one.

• ✓

  VPC Endpoints

  Why this is correct

  VPC endpoints allow you to privately connect your VPC to supported AWS services and VPC endpoint services using private IP addresses, without requiring an Internet Gateway, NAT device, VPN, or AWS Direct Connect connection. Traffic between your VPC and the AWS service stays entirely within the AWS network, never crossing the public internet, which reduces exposure and improves performance. For S3 and DynamoDB, you use either gateway endpoints or interface endpoints depending on the service, but the core benefit remains private, secure, and simplified access. This is the correct choice because it directly addresses the need for private connectivity.

• ✗

  VPC Peering

  Why it's wrong here

  VPC peering is a networking connection between two VPCs that enables you to route traffic between them using private IPv4 or IPv6 addresses. It is used to interconnect your own VPCs (or VPCs owned by other AWS accounts) for workloads, but it does not provide any connectivity to AWS managed services like S3 or DynamoDB. Those services are not hosted in your VPC; they are AWS-owned and accessed via public endpoints or VPC endpoints, not via peering connections. Thus, it is wrong because it only connects VPCs to other VPCs, not to AWS services.

Go deeper

Related to this question