SAA-C03 Design Secure Architectures Practice Question
An application runs on EC2 instances in private subnets in a VPC. There is no NAT gateway. The instances need to download objects from S3 over HTTPS and also call DynamoDB. The security group outbound rules allow TCP 443 to the VPC endpoint addresses. After deployment, the app times out when connecting to S3, but it can reach DynamoDB. Which single change is most likely to restore S3 connectivity?
⚠ Common exam trap
Watch out — candidates often assume a security group egress rule to 0.0.0.0/0 is sufficient, forgetting that private subnets without a NAT Gateway have no internet path, so the traffic is silently dropped.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a Gateway VPC endpoint for S3 and associate it with the private subnet route tables that contain the instances.
The application runs in private subnets without a NAT Gateway, so it cannot reach the internet. A Gateway VPC Endpoint for S3 allows private subnet instances to access S3 over the AWS network without internet connectivity. The security group already permits outbound TCP 443 to the endpoint addresses, so the missing piece is the route table association that directs S3 traffic to the endpoint.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a Gateway VPC endpoint for S3 and associate it with the private subnet route tables that contain the instances.
Why this is correct
S3 connectivity without NAT typically requires a Gateway VPC endpoint. For a gateway endpoint, you must update the route tables to direct S3 traffic to the endpoint. If DynamoDB works but S3 times out, it often means DynamoDB has the required endpoint while S3 is missing or not routed via the correct route tables.
- ✗
Replace the security group egress rule to allow all outbound traffic to 0.0.0.0/0 on TCP 443.
Why it's wrong here
Allowing 0.0.0.0/0 does not create a route to the S3 service without NAT. Security groups do not override routing; if traffic is not routed through the S3 VPC endpoint, the connection will still time out.
- ✗
Add an Internet Gateway to the VPC and route the private subnet’s 0.0.0.0/0 to the IGW.
Why it's wrong here
Adding an Internet Gateway and public routing would defeat the purpose of using private subnets without NAT and increases exposure. The correct solution is service-specific private connectivity using a VPC endpoint for S3.
- ✗
Switch from network ACLs to security groups by removing the existing NACL allow rules for ephemeral ports.
Why it's wrong here
If DynamoDB works, NACL rules are likely not the blocker for outbound traffic in general. Also, the primary requirement for reaching S3 without NAT is routing via the S3 endpoint. NACL changes would be unnecessary if endpoint routing is already correct.
Visual reference
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAA-C03 question from scratch — 302 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAA-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAA-C03 exam.