ANS-C01 VPC Gateway Endpoint Practice Question
A security engineer is troubleshooting connectivity between an EC2 instance in a private subnet and an S3 bucket. The instance has a VPC gateway endpoint for S3, and the route table has a route to the endpoint. The security group for the instance allows all outbound traffic. However, the instance cannot access the S3 bucket. What is the most likely cause?
⚠ Common exam trap
Many assume that an 'allow all' outbound security group rule is sufficient for accessing S3 via a gateway endpoint, but the destination must be the prefix list ID.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The security group outbound rule does not allow traffic to the S3 prefix list.
Although the security group allows all outbound traffic to 0.0.0.0/0, this rule does not apply to traffic destined for the S3 prefix list when using a VPC gateway endpoint. Gateway endpoints require a security group rule that explicitly allows HTTPS traffic to the S3 prefix list ID. Without this rule, traffic is blocked. Option A is correct. Option B is incorrect because the VPC endpoint is indeed associated with the route table. Option C is incorrect because a NAT gateway is not needed for S3 access via the endpoint. Option D is incorrect because the bucket policy is not the issue; the security group rule is missing.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The security group outbound rule does not allow traffic to the S3 prefix list.
Why this is correct
Correct: The security group must have an outbound rule allowing HTTPS traffic to the S3 prefix list ID. The default 'all traffic' rule does not suffice.
- ✗
The VPC endpoint is not associated with the route table.
Why it's wrong here
Incorrect: The VPC endpoint is already associated with the route table, as stated in the scenario.
- ✗
The route table does not have a route to a NAT gateway.
Why it's wrong here
Incorrect: A NAT gateway is not required for S3 access when using a VPC gateway endpoint.
- ✗
The S3 bucket policy does not allow access from the VPC endpoint.
Why it's wrong here
Incorrect: The bucket policy may need to allow access from the VPC endpoint, but the most likely cause given the all-outbound security group is the missing prefix list rule.
Visual reference
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.