CCNA Design Cost Questions

Reserved Instances or Savings Plans provide significant discounts for the steady baseline of 10 tasks, ensuring predictable capacity and cost. Spot Instances handle the variable additional tasks at up to 90% discount, and their interruptible nature is acceptable for the spike capacity. This combination minimizes cost while maintaining baseline availability.

HTTP APIs cost substantially less per million requests than REST APIs while preserving the request-response contract for clients. Because the API is only invoked during the nightly batch window, the pay-per-request model means near-zero cost during the 22 idle hours, and the lower per-request price directly reduces spend without altering client behavior.

S3 Glacier Deep Archive is the lowest-cost S3 storage class and is intended for data retained for long periods that is rarely, if ever, accessed. Its standard retrieval time is within 12 hours, which matches the stated tolerance, and it is well suited to seven-year compliance retention of immutable backup files, making it the most cost-effective fit.

Spot provides significantly lower pricing than On-Demand for EC2 capacity. Because the workload is designed to tolerate interruption (checkpointing + resubmission from the last checkpoint), the team can safely accept Spot interruptions. Resubmission from durable checkpoints preserves correctness while still capturing the cost advantage of Spot.

The right cost-optimization review here is to ask whether the batch analytics job truly needs a NAT gateway in every Availability Zone or whether one per AZ is sufficient. A NAT gateway is a zonal resource, and the standard high-availability pattern is to deploy one per AZ and route each AZ's private subnets to its local gateway; having two NAT gateways in the same AZ adds no resiliency because an AZ failure affects both, and the second gateway only doubles the hourly and per-GB costs. If the batch job is not required to be highly available or can tolerate an AZ outage, a single NAT gateway per AZ (or even one total) could be enough, which is exactly what should be evaluated before paying for four gateways.

A Compute Savings Plan lets you commit to a specific dollar-per-hour amount for a one- or three-year term in a given region, and the discount automatically applies to any EC2 instance family or size in that region. This is ideal for an Auto Scaling group with steady 24/7 API traffic because it captures predictable usage while preserving the flexibility to scale or change instance families without renegotiating the commitment. Usage above the committed amount simply runs at normal on-demand rates, so you still receive the lower rate on the bulk of your steady baseline.

Spot Instances offer spare EC2 compute capacity at up to a 90% discount compared to On-Demand, with the tradeoff that AWS can reclaim this capacity with a two-minute warning for other customers' workloads. Because the batch analytics job runs nightly, lasts several hours, and can be interrupted and resumed, it is exactly the kind of fault-tolerant, flexible workload that Spot was designed for. Using Spot Instances dramatically reduces compute costs while accommodating the job's tolerance for interruptions, making it the correct answer for a cost-optimized architecture.

Spot Instances let you bid on spare EC2 capacity at steep discounts — often 60-90% off On-Demand prices. Since the batch analytics job runs for several hours each night and can be interrupted and resumed, it is exactly the type of fault-tolerant workload AWS designed Spot Instances for. You can use Spot with a checkpointing strategy to save intermediate results, making it the most cost-effective choice.

Spot capacity is typically the lowest-cost EC2 option and can be reclaimed by AWS with interruption notices. Because the workload is explicitly restartable and checkpoints to durable storage, interruptions do not break correctness. Since there is no requirement to reserve capacity, the variable workload aligns well with Spot’s spare-capacity model.

A gateway VPC endpoint for Amazon S3 works by adding a prefix-list route to the VPC route table, directing S3-destined traffic from private subnets over the AWS backbone to the regional S3 endpoint. It requires no NAT gateway, no internet gateway, and no hourly charge, eliminating the per-GB NAT data processing fees on large media downloads. This is the correct cost-optimization mechanism for private-subnet access to S3.

Switching from gp2 to gp3 decouples IOPS and throughput from volume capacity, so you pay only for the storage size needed rather than provisioning extra gigabytes to reach a performance tier. This directly cuts the per-GB cost of the test servers' volumes while preserving equivalent baseline performance and full snapshot recovery options.

NAT gateways are provisioned per Availability Zone, and the standard high-availability pattern is one NAT gateway per AZ, not multiple in the same AZ. If the batch analytics job runs in only one AZ or its required private subnets are all within a single AZ, a second NAT gateway in that same AZ provides no additional resilience while doubling the hourly and data-processing charges. The cost optimization is to confirm that each AZ contains at least one private subnet needing egress; if not, the NAT gateway count should be reduced to one per AZ with active private workloads.

For public assets, Authorization should not vary the cache key. Removing it from the cache key allows CloudFront to reuse cached objects across requests, and not forwarding it to the origin avoids unnecessary origin variation and request overhead.

S3 Glacier Instant Retrieval is designed for long-lived archive data that is rarely accessed but requires millisecond retrieval. It costs less than S3 Standard-IA for long-term storage and meets the requirement that documents remain immediately retrievable for seven years. A lifecycle policy can transition objects after the active 90-day period.

VPC endpoints provide private connectivity from your VPC to supported AWS services without traversing the public internet or a NAT Gateway. For example, you can use a gateway endpoint for S3 (and interface endpoints for other services where supported), which avoids NAT Gateway hourly and data-processing charges.

A Standard Reserved Instance is ideal for a steady, always-on instance that will not change family or Region. It provides a significant discount over On-Demand in exchange for a one- or three-year commitment, and it requires no architectural change. This directly lowers the monthly compute bill while preserving availability.

RDS read replicas serve read-only traffic on separate instances, letting the team offload read-heavy queries and shrink the primary instance. This directly addresses the cost driver, which is an oversized primary handling both reads and writes, and it works within a single Region while the Multi-AZ standby continues to provide high availability for failover.

S3 Intelligent-Tiering continuously monitors access at the object level and automatically shifts objects between frequent, infrequent, and optional archive-access tiers based on recent usage, all without retrieval fees and without requiring lifecycle transitions. It charges only a small monthly automation/monitoring fee per object, which is economical when access behavior is unknown. This idle-tier management matches unpredictable workloads precisely, unlike the fixed tiering of Standard-IA or the constant high cost of Standard.

A gateway VPC endpoint for S3 installs a prefix list route (e.g., com.amazonaws.region.s3) in the VPC route table, causing S3-bound traffic to be sent directly to S3 over the AWS private network instead of through the NAT gateway. Because the data path no longer passes through the NAT gateway, the per-GB NAT data processing charge for those large downloads is eliminated. The endpoint itself is free, highly available, and requires only route table updates plus an optional endpoint policy to control access, making this the correct cost optimization.

S3 Glacier Deep Archive is designed for long-term retention of data accessed less than once per year, offering the lowest storage cost of any S3 class while maintaining eleven nines of durability. Retrieval takes up to 12 hours, which fits the acceptable latency stated for rare legal audits. For 50 TB held seven years with almost no access, this class minimizes spend without sacrificing durability.