Place instances in private subnets but use NAT gateways so traffic to S3 and Secrets Manager goes through the internet; restrict security groups to instance-to-instance only.

NAT still routes traffic through the internet path and contradicts the cost and private-connectivity requirement. Restricting instance-to-instance rules does not prevent public service access through NAT.

Use public subnets with instances that have no security group rules; rely on AWS services to reject unauthorized traffic.

Public subnets plus missing security controls violates baseline security. Relying on AWS service rejection does not provide explicit network segmentation or deterministic access control.

Create an S3 bucket policy that allows requests from the application instances’ private IP addresses and enable public access to Secrets Manager via the default service endpoint.

Bucket policy cannot safely replace network-level private connectivity. Secrets Manager still requires private endpoint configuration or NAT/IGW routing for private subnets; public access contradicts requirements.

What does this SAA-C03 question test?

CIDR notation defines the prefix length.

What is the correct answer to this question?

The correct answer is: Add a VPC gateway endpoint for S3 and an interface VPC endpoint for Secrets Manager; keep instances in private subnets and configure security group rules attached to the endpoints to allow inbound traffic only from the application subnets. — The cleanest private pattern is to avoid NAT by using VPC endpoints. S3 is reachable through a gateway VPC endpoint, which adds private routing within the VPC. Secrets Manager requires an interface VPC endpoint (private link ENIs) so that calls stay within the AWS network. You then attach restrictive security group rules to the interface endpoint to allow inbound connections only from the application subnets’ CIDR ranges or specific instance security groups. This meets cost constraints and enforces network segmentation for only the needed AWS service access. Why others are wrong: Option A uses NAT gateways, which violates the “without routing through the public internet” and “without exposing to NAT gateways due to cost” requirements. Option C places instances in public subnets with no security group restrictions, breaking segmentation and increasing exposure risk. Option D attempts to solve access with S3 bucket policy and assumes public service access, which does not ensure private routing for Secrets Manager from private subnets.

What should I do if I get this SAA-C03 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.