ANS-C01 Network Design Practice Question
A company has a VPC with an internet gateway and a NAT Gateway. The private subnet route table has a default route to the NAT Gateway. The company wants to enable instances in the private subnet to access an S3 bucket in the same region without traversing the internet. Which TWO actions should the company take?
⚠ Common exam trap
A common mix-up: candidates confuse gateway endpoints with interface endpoints, incorrectly assuming S3 requires an interface endpoint, or they think the NAT Gateway must be removed entirely, when in fact the NAT Gateway should remain for other outbound traffic and only the S3-specific route needs to be added via the gateway endpoint.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add a route to the S3 prefix list via the gateway endpoint in the private subnet route table.
Adding a route to the S3 prefix list via the gateway endpoint directs traffic destined for S3 through the VPC endpoint, keeping it within the AWS network. Option C is correct because a gateway VPC endpoint for S3 provides a private, scalable connection to S3 without requiring internet access or a NAT Gateway. Together, these actions allow private subnet instances to access S3 privately and efficiently.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Remove the default route to the NAT Gateway from the private subnet route table.
Why it's wrong here
Removing default route would break outbound internet access.
- ✓
Add a route to the S3 prefix list via the gateway endpoint in the private subnet route table.
Why this is correct
This enables private access.
- ✓
Create a gateway VPC endpoint for S3.
Why this is correct
Gateway endpoint provides private access to S3.
- ✗
Add a route to the S3 prefix list via the NAT Gateway in the private subnet route table.
Why it's wrong here
This would still use NAT, not private.
- ✗
Create an interface VPC endpoint for S3.
Why it's wrong here
Gateway endpoint is more cost-effective for S3.
Visual reference
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on ANS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company has a VPC with public and private subnets. The public subnet has a NAT gateway for outbound internet access from private subnets. The private subnets have EC2 instances that need to access an S3 bucket in the same region. The company wants to minimize data transfer costs and avoid traversing the internet. What is the MOST cost-effective solution?
hard- A.Configure an S3 bucket policy that restricts access to the VPC's public IP addresses.
- ✓ B.Create a VPC Gateway Endpoint for S3 and attach a policy allowing access from the private subnets.
- C.Route traffic to the NAT gateway and then to the S3 bucket using a VPC peering connection.
- D.Create a VPC Interface Endpoint for S3 and associate with the private subnets.
Why B: A VPC Gateway Endpoint for S3 allows private subnet instances to access S3 over the AWS network without traversing the internet or a NAT gateway, eliminating data transfer costs for the NAT gateway and avoiding internet egress charges. This is the most cost-effective solution because gateway endpoints are free and use prefix lists in the route table to direct traffic to S3 via the AWS backbone.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.