An application runs in private subnets and must access Amazon S3, Amazon DynamoDB, and AWS Secrets Manager. The security team wants the traffic to stay on the AWS network and the finance team wants to eliminate NAT Gateway charges. Which three changes should they make? Select three.

Place the instances in public subnets with an internet gateway.

Public subnets increase exposure and do not solve the cost goal in a better way. They also violate the requirement to keep traffic private where possible.

Keep the NAT Gateway and add a proxy instance for service access.

A proxy instance adds more management work and does not remove the NAT Gateway cost. It is a poor fit when AWS-native VPC endpoints can satisfy the requirement directly.

What does this SAA-C03 question test?

CIDR notation defines the prefix length.

What is the correct answer to this question?

The correct answer is: Create gateway VPC endpoints for S3. — The most cost-effective way to keep this private is to replace NAT-based access with VPC endpoints. S3 and DynamoDB use gateway endpoints, which are low-cost and route traffic privately. Secrets Manager requires an interface endpoint, which also keeps traffic within AWS networking. Together, these endpoints eliminate unnecessary NAT charges while preserving private connectivity for the application. Putting instances in public subnets increases exposure and is not needed. Keeping the NAT Gateway and adding a proxy still leaves the NAT cost in place and adds operational overhead. AWS-native endpoints are the cleaner and cheaper solution for the services in the scenario.

What should I do if I get this SAA-C03 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.