SAA-C03 Design Secure Architectures Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Add an internet gateway to the VPC and route private subnet traffic through it.

  Why it's wrong here

  Adding an internet gateway (IGW) and routing private-subnet traffic through it would make the instances effectively public or at least give them direct internet egress, violating the requirement that they remain in private subnets. An IGW is used for bidirectional communication with the public internet, and it does not provide any private or encrypted path specifically to S3. While you could combine an IGW with a NAT device to allow outbound-only access, that adds cost and complexity and still sends traffic over the internet. The correct private-connectivity mechanism is a gateway VPC endpoint, which keeps S3 traffic within the AWS network without requiring an IGW or NAT.

  When this WOULD be correct

  If the requirement were to provide internet access to instances in private subnets (e.g., for general web downloads) and a NAT gateway was not allowed due to cost, but internet traffic was acceptable, then adding an internet gateway and routing private subnet traffic through it (with appropriate NAT) would be correct.

• ✓

  Use an Amazon S3 gateway VPC endpoint in the route tables for the private subnets.

  Why this is correct

  A gateway VPC endpoint for S3 keeps traffic between the VPC and S3 on the AWS network without using the public internet or a NAT gateway. This is the standard private-connectivity pattern for S3 access from private subnets. It also simplifies the architecture and reduces NAT-related cost while preserving access to the bucket from workloads that must remain nonpublic.

• ✗

  Use a security group rule that allows outbound traffic to the S3 public IP range.

  Why it's wrong here

  A security group rule permitting outbound traffic to the S3 public IP range only authorizes the traffic path; it does not establish a private, non-internet route. Security groups are stateful virtual firewalls that filter traffic at the instance level, but they have no effect on how packets are routed. Without a gateway VPC endpoint or NAT device, the instance's route table would still send S3-destined traffic to the internet gateway, defeating the private-subnet requirement. Moreover, S3 public IP ranges are shared and dynamic, making this approach both insecure and operationally brittle.

• ✗

  Create a VPC peering connection to the S3 service VPC.

  Why it's wrong here

  VPC peering connects your VPC to another customer-controlled VPC over the AWS backbone; it cannot connect to a managed AWS service like S3 because S3 is not exposed as a peer VPC. Amazon S3 is a regional service with publicly routable endpoints, so there is no S3 service VPC available for peering. Peering also does not support transitive routing, and even if you attempted to reach S3 via a peered VPC, that VPC would still need an internet path or a gateway endpoint. This option is based on a fundamental misunderstanding of how AWS service connectivity works.

  When this WOULD be correct

  When connecting two separate VPCs (e.g., in different accounts or regions) to allow private IP communication between instances, such as for database replication or shared services, without using the internet or a VPN.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SAA-C03 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official SAA-C03blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question