ANS-C01 Network Security, Compliance and Governance Practice Question

A company has a VPC with public and private subnets. An application running in a private subnet needs to access an S3 bucket to read and write data. The security team wants to ensure that traffic to S3 does not traverse the internet. Which solution should the team implement?

⚠ Common exam trap

AWS often tests the misconception that a NAT gateway is required for private subnet outbound traffic, but for AWS services like S3, a gateway VPC endpoint provides private connectivity without internet egress.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Create a gateway VPC endpoint for S3 and add a route to the endpoint in the private subnet route table.

A gateway VPC endpoint for S3 allows instances in a private subnet to access S3 privately using AWS's internal network, without traversing the internet. By adding a route to the endpoint's prefix list in the private subnet route table, traffic destined for S3 is directed through the endpoint, which uses AWS PrivateLink to provide highly available, redundant connectivity.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Establish a VPN connection to AWS and route S3 traffic through the VPN.
Why it's wrong here
Establishing a VPN connection to AWS is designed for securing traffic between an on-premises network or remote users and a VPC, not for private access from an instance *within* a VPC's private subnet to AWS S3. Routing S3 traffic through a VPN from within the VPC would still traverse the internet or be misconfigured. This option is tempting because VPNs do provide secure, private network extensions, but they are typically used to connect external networks *into* a VPC, not to provide private access *from* a VPC to AWS service endpoints like S3.
✗
Configure a NAT gateway in the public subnet and update the private subnet route table with a default route pointing to the NAT gateway.
Why it's wrong here
This routes traffic through the internet, not private.
✓
Create a gateway VPC endpoint for S3 and add a route to the endpoint in the private subnet route table.
Why this is correct
Gateway endpoints provide private access to S3 without traversing the internet.
✗
Attach an internet gateway to the VPC and add a route to the S3 prefix list in the private subnet route table.
Why it's wrong here
This would route traffic through the internet gateway, which is not private.

Visual reference

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

ANS-C01 Network Security, Compliance and Governance Practice Question

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question