A data-processing application runs in private subnets and needs to read objects from Amazon S3 and write items to Amazon DynamoDB. The team currently routes all outbound traffic through a NAT Gateway, and monthly networking charges are rising. Which two changes will most directly reduce cost while keeping traffic on the AWS network? Select two.

Add a second NAT Gateway in another Availability Zone.

A second NAT Gateway increases availability, but it also increases fixed hourly and data processing charges. It does not solve the core cost problem because the traffic still leaves the private subnets through NAT.

Move the instances into public subnets so they can reach AWS services directly.

Public subnets require internet exposure or public routing for the instances, which increases risk and is not needed for private service access. It also does not preserve the original private-subnet design objective.

Send private subnet traffic to S3 and DynamoDB through an Internet Gateway route.

An Internet Gateway is for public internet routing, not private service access from private subnets. That design would expose traffic unnecessarily and would not eliminate the operational cost of NAT Gateway usage.

What does this SAA-C03 question test?

CIDR notation defines the prefix length.

What is the correct answer to this question?

The correct answer is: Add an S3 gateway VPC endpoint to the private route tables. — S3 and DynamoDB are both supported by gateway VPC endpoints, which let private subnet resources access those services without traversing a NAT Gateway. That cuts monthly networking charges immediately because you avoid NAT hourly charges and NAT data processing fees. It also keeps the traffic on the AWS network and preserves the private-subnet design. This is the most direct cost reduction for the scenario. Adding another NAT Gateway increases redundancy, not savings. Moving workloads to public subnets creates exposure and does not reduce service-access cost in a meaningful way. An Internet Gateway is not the right path for private-service access from private subnets. The correct answer is to use the service endpoints that are specifically designed to avoid NAT for S3 and DynamoDB.

What should I do if I get this SAA-C03 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.