ANS-C01 Network Security, Compliance and Governance Practice Question
A company has a VPC with an internet gateway and wants to restrict outbound traffic from a private subnet to only allow traffic to specific AWS services, such as S3 and DynamoDB. Which solution should be used?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create VPC endpoints for S3 and DynamoDB, and attach a policy to the endpoints to restrict access.
VPC endpoints (Gateway endpoints for S3 and DynamoDB) allow private subnet instances to access these AWS services without traversing the internet, and endpoint policies can restrict access to specific services and actions. Option A is incorrect because security groups cannot filter by destination service; they filter by IP address, and AWS services use dynamic IP ranges. Option B is incorrect because a NAT gateway allows all outbound traffic to the internet, not just to specific services, and would not restrict to only S3 and DynamoDB. Option C is incorrect because an internet gateway would allow unrestricted outbound traffic to the internet, not just to specific AWS services.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure a security group on the instances in the private subnet to allow outbound traffic only to the IP ranges of the AWS services.
Why it's wrong here
IP ranges for AWS services can change and security groups cannot filter by service name.
- ✗
Use a NAT gateway in the public subnet and add a route to it in the private subnet.
Why it's wrong here
A NAT gateway allows all outbound internet traffic, not just to specific services.
- ✗
Attach an internet gateway to the VPC and add a route to it in the private subnet.
Why it's wrong here
This would give direct internet access to the private subnet, which is not desired.
- ✓
Create VPC endpoints for S3 and DynamoDB, and attach a policy to the endpoints to restrict access.
Why this is correct
VPC endpoints provide private connectivity to AWS services and can be restricted with policies.
Visual reference
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.