A company runs Amazon EC2 instances in private subnets. Those instances only need to access Amazon S3 (read/write) and Amazon DynamoDB. The VPC currently routes all outbound traffic through a NAT Gateway, increasing monthly cost. What change most directly reduces NAT Gateway usage for these AWS services?

Keep the NAT Gateway but disable any cross-region routing settings for the route table entries that point to the NAT Gateway.

Cross-region routing settings do not prevent the traffic from still being sent to the NAT Gateway. If the route still points to NAT, NAT charges still apply.

Create interface VPC endpoints for all services (including S3) and route S3 traffic to the interface endpoint network interfaces (ENIs).

S3 does not use interface VPC endpoints. S3 uses Gateway VPC endpoints (and requires appropriate prefix-list route entries). Using the wrong endpoint type won’t address the NAT path.

Add an IAM policy that denies requests unless they originate from the public subnet, so the application sends fewer requests through the NAT Gateway.

IAM does not control whether traffic traverses the NAT Gateway at the network layer. Even if requests are denied, the EC2 instances will still attempt outbound connectivity through the existing NAT routes (and you would also likely break the application).

What does this SAA-C03 question test?

CIDR notation defines the prefix length.

What is the correct answer to this question?

The correct answer is: Remove the NAT Gateway path for S3 and DynamoDB by creating S3 Gateway VPC endpoints and DynamoDB Gateway VPC endpoints, and updating the private subnet route tables to route S3/DynamoDB traffic to those endpoints. — Use Gateway VPC endpoints for S3 and DynamoDB. By creating an S3 Gateway endpoint and a DynamoDB Gateway endpoint and then updating the private subnet route tables (using the endpoint’s prefix lists) so that S3 and DynamoDB traffic is routed to those endpoints, the instances can reach these services without sending the traffic to the internet. That means the requests do not pass through the NAT Gateway, reducing both the NAT Gateway hourly charge and the per-GB data processing charges. Interface endpoints are not the correct mechanism for S3, and IAM changes do not alter the underlying network path. Keeping the NAT Gateway path (even with other routing settings changed) still sends S3/DynamoDB traffic to NAT, so NAT charges continue. Interface endpoints don’t apply to S3, so they won’t remove NAT usage for S3. IAM denial rules can break functionality and do not change whether network traffic uses the NAT route.

What should I do if I get this SAA-C03 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.