SAA-C03 Design Secure Architectures Practice Question
A company wants to ensure that its internal applications can access Amazon S3 without the traffic ever leaving the AWS network or passing through the public internet. What should they implement to achieve this securely?
⚠ Common exam trap
The trap is choosing NAT Gateway or VPN because they provide connectivity, but the question's key constraint — traffic never leaving the AWS network — rules them out; only a VPC Gateway Endpoint satisfies that requirement for S3.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a VPC Gateway Endpoint for Amazon S3 and update the route tables.
A VPC Gateway Endpoint for Amazon S3 provides a private, logical connection between a VPC and S3 that keeps traffic on the AWS backbone and never traverses the public internet. Updating route tables to direct S3-bound traffic to the gateway endpoint ensures instances in private subnets reach S3 privately.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure a NAT Gateway in a public subnet to route S3 traffic.
Why it's wrong here
A NAT Gateway allows instances in a private subnet to connect to the internet, including S3. However, this traffic technically travels over the internet to reach the public S3 endpoints. It does not meet the requirement of keeping traffic entirely within the AWS private network as VPC Endpoints do.
- ✗
Use an AWS Direct Connect connection between the VPC and S3.
Why it's wrong here
AWS Direct Connect provides a dedicated physical network connection from an on-premises data center to AWS. While it can provide private access to AWS services, it is an expensive and complex solution for internal VPC-to-S3 traffic, which is better handled by VPC Endpoints within the AWS cloud.
- ✓
Create a VPC Gateway Endpoint for Amazon S3 and update the route tables.
Why this is correct
A Gateway Endpoint for S3 is a cost-effective and highly available way to provide private access to S3. It does not require a NAT gateway or public IP addresses. By adding a route to the VPC route table, all traffic to S3 is automatically routed through the private endpoint.
- ✗
Set up a VPN connection between the private subnet and the S3 service.
Why it's wrong here
AWS VPN is used to securely connect an on-premises network to an AWS VPC. It is not designed or used for connecting a VPC to other AWS services like S3. VPC Endpoints are the native and recommended mechanism for private communication between VPC resources and AWS regional services.
Visual reference
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
About these practice questions
This SAA-C03 question is part of Courseiva's 149-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SAA-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAA-C03 exam.