SAA-C03 Design Cost-Optimized Architectures Practice Question
A media processing workflow in private subnets downloads large amounts of data from S3 through a NAT gateway. NAT data processing charges are high. What should the architect use to reduce cost? The design must avoid adding custom operational scripts.
⚠ Common exam trap
A common mix-up: candidates confuse Gateway VPC endpoints with Interface VPC endpoints, assuming both incur costs, or mistakenly think NAT gateways are required for all private subnet outbound traffic, missing the S3-specific optimization.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Gateway VPC endpoint for Amazon S3
A Gateway VPC endpoint for Amazon S3 allows instances in private subnets to access S3 directly over the AWS network without traversing a NAT gateway. This eliminates NAT data processing charges because traffic stays within the AWS backbone, reducing costs significantly for large data downloads.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
S3 Object Lambda
Why it's wrong here
S3 Object Lambda lets you add custom code to process data returned from S3 GETs, but it operates at the request/response layer, not the network path. It does not remove the need for traffic to traverse a NAT gateway, nor does it affect data processing charges. In fact, it adds per-request Lambda costs and can increase latency, making it the opposite of a cost-saving network solution.
- ✗
AWS Shield Advanced
Why it's wrong here
AWS Shield Advanced is a Distributed Denial of Service (DDoS) protection service that provides enhanced detection and mitigation for sophisticated attacks, along with cost protection against scaling incurred during an attack. It does not modify the network architecture or reduce NAT gateway data processing charges for normal traffic. Its purpose is security posture, not cost optimization for VPC-to-S3 connectivity.
- ✓
Gateway VPC endpoint for Amazon S3
Why this is correct
A gateway VPC endpoint for Amazon S3 is a free resource that you attach to a subnet's route table, enabling instances to reach S3 via private IP addresses. Traffic to S3 through a gateway endpoint does not traverse an internet gateway or NAT gateway, thereby eliminating the NAT data processing charge. It is the recommended and most cost-effective way to access S3 from private subnets when no internet connectivity is required.
- ✗
A larger NAT gateway
Why it's wrong here
NAT gateways are managed services billed by hourly usage and data processing per GB; they scale automatically to support increased throughput, so choosing a larger size is not even a configurable option—all NAT gateways support up to 100 Gbps. Even if you could select a larger size, it would increase the hourly cost without affecting the per-GB processing charge, making it more expensive, not cost-optimized. The only way to avoid NAT processing costs is to bypass the NAT gateway entirely.
Visual reference
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 935 original SAA-C03 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAA-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAA-C03 exam.