CLF-C02 Cloud Technology and Services Practice Question
A SaaS company wants to expose their service to AWS customers through the AWS Marketplace and allow customers to access it privately without traversing the public internet. Which technology enables this?
⚠ Common exam trap
Many candidates confuse AWS PrivateLink with VPC Peering, thinking peering provides private connectivity between accounts, but they miss that PrivateLink is specifically designed for exposing services to multiple customer VPCs without requiring full VPC mesh or routing tables.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS PrivateLink
AWS PrivateLink enables private connectivity between VPCs and AWS services without traversing the public internet. By creating a VPC Endpoint powered by PrivateLink, the SaaS company can expose their service via an internal Network Load Balancer (NLB) in their own VPC, and customers can access it privately using Elastic Network Interfaces (ENIs) in their VPCs. This ensures traffic stays within the AWS network, meeting the requirement for private, non-internet-based access through the AWS Marketplace.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Amazon VPC Peering
Why it's wrong here
VPC Peering creates a one-to-one relationship between exactly two VPCs and does not support transitive peering, so a provider would have to build and manage a separate peering connection for every customer VPC. Each peering pair requires explicit CIDR routes and security rules, and thousands of such connections quickly become unmanageable. Peering also lacks a distinct service-abstraction boundary because it allows network-level connectivity between the whole VPCs, not a controlled single-point service endpoint.
- ✓
AWS PrivateLink
Why this is correct
PrivateLink lets a service provider attach an endpoint service to a Network Load Balancer in its VPC and then publish that service to external accounts using a service name. Customers create an interface VPC endpoint, which places an elastic network interface with a private IP in their selected subnets, so traffic reaches the provider's NLB entirely over the AWS network. Because the connection is initiated through the endpoint and never traverses the public internet, it is the correct mechanism for private, secure, one-to-many service consumption across thousands of customer VPCs.
- ✗
AWS Direct Connect
Why it's wrong here
AWS Direct Connect is a dedicated physical connection between a customer's on-premises data center and AWS, using VLANs and virtual interfaces to reach public or private resources. It addresses how an individual enterprise links its own network to AWS; it does not let a service provider privately publish an application to thousands of separate customer VPCs. At best, Direct Connect gives one customer a private path into AWS, but it offers no endpoint-based multi-tenant service exposure, so it cannot fulfill the stated requirement.
- ✗
AWS Transit Gateway
Why it's wrong here
Transit Gateway is a regional network transit router that lets customers interconnect numerous VPCs and on-premises networks with a single gateway object. While it provides Layer 3 routing through route tables, it exposes entire networks to one another rather than publishing a specific service through a controlled, endpoint-based interface. A provider using Transit Gateway would need every consumer VPC attached and routable to the gateway, which is untenable for scaling a third-party service across thousands of independent VPC accounts.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CLF-C02 question from scratch — 988 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.