A service runs in private subnets. It must call AWS APIs (for example, S3 and Secrets Manager). The team currently sends all outbound traffic through a NAT Gateway, and NAT charges have become a major cost driver. The workload must not traverse the public internet. What change most directly reduces NAT Gateway cost while maintaining private connectivity to those AWS services?

Continue using the NAT Gateway but reduce CloudWatch log retention to 1 day.

Reducing log retention can lower CloudWatch storage costs, but it does not reduce NAT Gateway data processing charges for outbound API calls from the workload.

Launch a bastion host in a public subnet and force private instances to use SSH tunneling for API calls.

SSH tunneling adds complexity and does not inherently remove NAT data charges. The bastion would still require outbound connectivity paths, which typically still involve NAT if access is not otherwise endpoint-based.

Switch to public subnets and attach security groups with the same rules to limit inbound access.

Moving to public subnets changes the exposure model and does not satisfy the requirement to avoid traversing the public internet. It also may not reduce NAT-related billing in the intended way.

What does this SAA-C03 question test?

CIDR notation defines the prefix length.

What is the correct answer to this question?

The correct answer is: Replace the NAT Gateway route with VPC endpoints: use a Gateway VPC endpoint for S3 and an Interface VPC endpoint for Secrets Manager. — To reduce NAT Gateway cost, route traffic from the private subnets to AWS services through VPC endpoints instead of through NAT. For this scenario, use a Gateway VPC endpoint for S3 and an Interface VPC endpoint for Secrets Manager. Instances can then reach these services over the AWS private network, eliminating the need for outbound internet traversal via NAT for those API calls. Changes to log retention or network tunneling do not directly address the billed NAT egress/processing for the service API traffic. Lowering CloudWatch log retention affects monitoring costs but does not change NAT Gateway usage for API calls. Bastion + SSH tunneling introduces overhead and typically still relies on egress connectivity that can include NAT. Changing to public subnets contradicts the explicit requirement to avoid public internet traversal and does not target the NAT billing root cause.

What should I do if I get this SAA-C03 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.