A company runs an application on EC2 instances in private subnets. The instances must access Amazon S3, and the team currently routes all outbound traffic to the internet through a NAT Gateway. Monthly NAT Gateway charges increased significantly, even though the application only needs to call S3 (not access other public internet services). Which change will most directly reduce NAT Gateway charges while keeping S3 access working?

Enable S3 Transfer Acceleration on the bucket to reduce the number of S3 calls that go through the NAT Gateway.

S3 Transfer Acceleration changes how clients connect to S3 at the edge (typically for publicly addressed buckets and internet clients). It does not change the network path used by EC2 instances in private subnets. Without an S3 VPC endpoint, the instances’ traffic to S3 will still be routed to the NAT Gateway for reaching the public S3 endpoints.

Switch the EC2 instances to public subnets so S3 calls can use direct internet routing without NAT.

Moving instances to public subnets changes the network exposure model and does not align with the stated requirement to keep the application in private subnets. Even if S3 connectivity works, this does not directly target NAT cost drivers for private-subnet S3 access and may increase security and management overhead.

Increase the NAT Gateway TCP idle timeout so fewer connections are billed separately for S3 traffic.

NAT Gateway billing is based on gateway uptime (per-hour) and the amount of data processed (per-GB), not on how long TCP connections remain idle. Adjusting timeouts does not eliminate or significantly reduce the NAT data-processing charges for S3 traffic; routing S3 through a VPC endpoint is the effective approach.

What does this SAA-C03 question test?

CIDR notation defines the prefix length.

What is the correct answer to this question?

The correct answer is: Create a gateway VPC endpoint for S3 and update the private route tables so S3 traffic uses the endpoint instead of the NAT Gateway. — A gateway VPC endpoint for S3 allows EC2 instances in private subnets to reach S3 without traversing the NAT Gateway. By updating the private route tables to send S3-destined traffic to the endpoint, S3 API requests stay within AWS and no longer incur NAT Gateway data-processing (and uptime) charges for that traffic. This is the most direct cost optimization for the scenario where NAT is used only for S3 access. Transfer Acceleration does not change routing from private subnets; without an S3 VPC endpoint, traffic still goes to NAT. Public subnets alter security posture and do not address the underlying objective of avoiding NAT for private-subnet S3 access. NAT timeout changes do not affect the primary NAT metering dimensions (per-hour and per-GB), so they won’t materially reduce charges for S3 traffic.

What should I do if I get this SAA-C03 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.