ANS-C01 VPC Gateway Endpoint Practice Question
An application running on EC2 instances in a private subnet needs to send logs to Amazon CloudWatch Logs. Which step is essential to allow this communication without traversing the internet?
⚠ Common exam trap
The trap is that candidates may assume CloudWatch Logs only supports Interface Endpoints like many other AWS services, but in fact CloudWatch Logs supports Gateway Endpoints as well, which are often preferred for private connectivity without ENIs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a VPC Gateway Endpoint for CloudWatch Logs and update the route table.
Amazon CloudWatch Logs supports both VPC Gateway Endpoints and VPC Interface Endpoints (PrivateLink). However, a Gateway Endpoint is more efficient as it does not require an Elastic Network Interface (ENI) and is accessed via route table entries, making it a simpler and more cost-effective solution for this scenario. Therefore, Option B is the appropriate choice.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a VPC Interface Endpoint for CloudWatch Logs and attach it to the subnet.
Why it's wrong here
Interface Endpoints are used for services that require PrivateLink; CloudWatch Logs supports Gateway Endpoint.
- ✓
Create a VPC Gateway Endpoint for CloudWatch Logs and update the route table.
Why this is correct
Provides private connectivity to CloudWatch Logs.
- ✗
Assign a public IP to the EC2 instance and route directly to the internet.
Why it's wrong here
Exposes the instance to the internet.
- ✗
Attach a NAT Gateway to the private subnet and route traffic to the internet.
Why it's wrong here
Unnecessary cost and complexity.
Visual reference
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.