Based on the exhibit, a company wants EC2 instances in private subnets to access Amazon S3 without using a NAT gateway, and bucket access must be allowed only when requests come through the approved VPC endpoint. Which design is the most appropriate?

Use an interface VPC endpoint for S3 only, because gateway endpoints cannot be used with bucket policies.

Gateway endpoints are the standard and recommended private-connectivity mechanism for S3 from EC2 instances in VPCs, and they can absolutely be combined with S3 bucket policies. The claim that gateway endpoints cannot be used with bucket policies is incorrect. In fact, aws:SourceVpce is a common condition key used specifically to restrict access to a particular endpoint.

Add a NAT gateway and remove the bucket policy condition because the NAT route will automatically secure the S3 traffic.

A NAT gateway provides outbound internet access for private subnets, but it does not keep S3 traffic private in the way a VPC endpoint does. It also does not enforce endpoint-based authorization. This option fails both requirements: it introduces internet egress and removes the access control that limits the bucket to the approved endpoint.

Move the bucket policy restriction to a security group attached to the S3 bucket so only the VPC endpoint can reach it.

Security groups do not apply to S3 because S3 is a managed regional service, not an ENI-backed resource in your VPC. S3 access is controlled with IAM, bucket policies, endpoint policies, and condition keys such as aws:SourceVpce. The correct enforcement point is the bucket policy, not a security group.

What does this SAA-C03 question test?

CIDR notation defines the prefix length.

What is the correct answer to this question?

The correct answer is: Use the S3 gateway VPC endpoint and keep the bucket policy that denies requests unless aws:SourceVpce matches the approved endpoint. — The right design is an S3 gateway endpoint paired with a bucket policy that denies requests unless they come from the approved VPC endpoint ID. Gateway endpoints are the native private-connectivity mechanism for S3 from EC2 private subnets, and the aws:SourceVpce condition ensures the bucket can only be accessed through that path. This keeps traffic off the public internet and removes the need for a NAT gateway. An interface endpoint is not required for this S3 use case, and gateway endpoints absolutely work with bucket policies. A NAT gateway would violate the no-internet requirement and add unnecessary cost. Security groups do not apply to S3 as a service resource. The exhibit already points to the correct pattern: gateway endpoint plus source-endpoint restriction.

What should I do if I get this SAA-C03 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.