SAA-C03 Design Secure Architectures Practice Question
A company has a VPC with a CIDR block of 10.0.0.0/16. The company wants to allow its EC2 instances in a private subnet to access Amazon S3 without traversing the public internet. The company also wants to minimize data transfer costs. Which solution should a solutions architect recommend?
⚠ Common exam trap
The trap here is assuming that an interface VPC endpoint is required for private S3 access, when a gateway endpoint is the cost-effective and recommended solution for S3.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a gateway VPC endpoint for Amazon S3 and update the route tables for the private subnets to use the endpoint.
A gateway VPC endpoint for Amazon S3 is the correct choice because it provides private connectivity from the VPC to S3 without using the public internet and is free of charge. Updating the route tables ensures that traffic to S3 is directed through the endpoint, meeting both the private access and cost minimization requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure an AWS Site-to-Site VPN connection to an on-premises data center that has a direct connection to Amazon S3.
Why it's wrong here
A Site-to-Site VPN connection routes traffic through an on-premises data center, which is unnecessary and adds latency and cost. It does not provide direct private access to Amazon S3 from the VPC. This solution is overly complex and does not minimize data transfer costs; it would likely increase them due to VPN and on-premises infrastructure.
- ✓
Create a gateway VPC endpoint for Amazon S3 and update the route tables for the private subnets to use the endpoint.
Why this is correct
Gateway VPC endpoints for Amazon S3 provide private connectivity without requiring an internet gateway or NAT device. They are free of charge and do not incur data processing fees. Updating the route tables to direct S3 traffic to the gateway endpoint ensures that traffic stays within the AWS network, meeting both the private access and cost minimization requirements.
- ✗
Create an interface VPC endpoint for Amazon S3 in the VPC and update the route tables to use the endpoint.
Why it's wrong here
Interface VPC endpoints for Amazon S3 are powered by AWS PrivateLink and enable private connectivity, but they incur hourly charges and data processing fees. They are not the most cost-effective option for S3 access when a gateway endpoint is available. Gateway endpoints are free and designed specifically for S3 and DynamoDB.
- ✗
Attach an internet gateway to the VPC and configure a NAT gateway in a public subnet to allow outbound traffic to Amazon S3.
Why it's wrong here
Using an internet gateway and NAT gateway allows outbound internet access, but traffic to Amazon S3 would traverse the public internet. NAT gateways incur hourly and data processing charges, increasing costs. This solution does not meet the requirement to avoid the public internet and is more expensive than a gateway endpoint.
Visual reference
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAA-C03 question from scratch — 935 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SAA-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAA-C03 exam.