A company hosts application servers in private subnets. They must access Amazon S3 and read secrets from AWS Secrets Manager, but they want to avoid internet egress. They currently use a NAT gateway and see high NAT-related costs. What change most directly reduces cost while keeping traffic on the AWS network?

Keep the NAT gateway and reduce instance size to lower NAT throughput charges

Reducing instance size might reduce some traffic, but it does not directly eliminate NAT gateway usage. NAT costs can remain high if the application still sends requests through NAT.

Switch Secrets Manager to use S3 as a storage backend so both services can use the S3 endpoint only

Secrets Manager is a managed secrets service and does not provide an option to “swap” storage to S3 for direct endpoint sharing. This would change the application and introduces unnecessary redesign risk.

Move the private subnets to public subnets and attach an Internet Gateway to eliminate NAT

Using public subnets with an Internet Gateway removes NAT, but it allows internet-routed traffic, which violates the requirement to avoid internet egress and can increase exposure.

What does this SAA-C03 question test?

CIDR notation defines the prefix length.

What is the correct answer to this question?

The correct answer is: Create a Gateway VPC endpoint for S3 and an Interface VPC endpoint for Secrets Manager, then route requests via those endpoints instead of NAT — To avoid NAT gateway costs while keeping traffic on the AWS network, the team should use VPC endpoints for the required services. S3 supports a Gateway VPC endpoint, and Secrets Manager supports an Interface VPC endpoint. With these endpoints configured and route traffic sent through them, requests from private subnets to S3 and Secrets Manager are routed privately within AWS infrastructure instead of through the NAT gateway, directly reducing NAT-related charges. Simply resizing instances does not remove the NAT gateway path, so NAT charges may not meaningfully decrease. Re-architecting secrets storage around S3 is unnecessary and does not address the service connectivity requirement. Moving to public subnets with an Internet Gateway avoids NAT but breaks the “avoid internet egress” constraint and increases security risk.

What should I do if I get this SAA-C03 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.