A containerized service runs in private subnets and retrieves secrets from AWS Secrets Manager and configuration parameters from AWS Systems Manager Parameter Store on startup. A NAT Gateway is currently used only for these AWS API calls, and the security team wants to eliminate that recurring charge. Which two endpoints should be added? Select two.

Create a gateway VPC endpoint for Amazon S3 instead.

An S3 gateway endpoint is useful when workloads need private access to S3, but this startup path is for Secrets Manager and Parameter Store. Adding S3 endpoints would not remove the NAT charges described in the scenario.

Add an Internet Gateway and send the traffic through public subnets.

That would expose the service to the internet and does not reduce outbound traffic cost. The requirement is to keep the workload private and remove the need for NAT while still reaching AWS services.

Replace the NAT Gateway with a NAT instance.

A NAT instance can sometimes reduce cost, but it still requires an egress path and adds patching, scaling, and availability management. It does not eliminate the AWS API traffic cost the way the right VPC endpoints do.

What does this SAA-C03 question test?

CIDR notation defines the prefix length.

What is the correct answer to this question?

The correct answer is: Create an interface VPC endpoint for AWS Secrets Manager. — Interface VPC endpoints for Secrets Manager and Systems Manager are the right fix because both services are accessed through AWS APIs from private subnets. Using those endpoints keeps the traffic on the AWS network and eliminates the need to send those calls through the NAT Gateway. That directly reduces recurring NAT charges while preserving private connectivity and security. Why others are wrong: An S3 endpoint does not address Secrets Manager or Parameter Store traffic. Moving the workloads to public subnets does not reduce the traffic cost and weakens isolation. A NAT instance still leaves you with egress traffic and operational overhead, so it does not remove the recurring cost in the cleanest way.

What should I do if I get this SAA-C03 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.