An engineering team runs application servers in private subnets. The instances must download patches and software packages from Amazon S3, but the company does not want the traffic to traverse the internet or a NAT gateway. Which design should they use?

Add an internet gateway to the VPC and route private subnet traffic through it.

An internet gateway exposes the VPC to the public internet and does not keep traffic private.

Use a security group rule that allows outbound traffic to the S3 public IP range.

Security groups control traffic, but they do not create private connectivity to S3 or prevent internet traversal by themselves.

Create a VPC peering connection to the S3 service VPC.

Amazon S3 is not accessed through customer-managed VPC peering connections, so this is not a valid design.

What does this SAA-C03 question test?

CIDR notation defines the prefix length.

What is the correct answer to this question?

The correct answer is: Use an Amazon S3 gateway VPC endpoint in the route tables for the private subnets. — An S3 gateway VPC endpoint is the right answer because it allows private subnet resources to reach S3 without leaving the AWS private network or using a NAT gateway. This is the preferred pattern when the requirement is private access to S3 and reduced operational cost. Security groups and route tables still matter, but the endpoint is what actually provides private service connectivity. Why others are wrong: An internet gateway makes the traffic public, which violates the requirement. A security group can permit outbound traffic, but it cannot replace a private endpoint or remove the need for internet routing. VPC peering is not how you connect to an AWS-managed service like S3, so that option is invalid.

What should I do if I get this SAA-C03 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.