SAA-C03 Design Secure Architectures Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Create a Gateway VPC endpoint for Secrets Manager.

  Why it's wrong here

  Gateway VPC endpoints operate by adding route table entries with prefix lists, and AWS only supports them for Amazon S3 and DynamoDB. Secrets Manager is not a service that offers a gateway endpoint; it uses an interface endpoint backed by AWS PrivateLink. Attempting to create a gateway endpoint for Secrets Manager is impossible, and it would not provide the private connectivity required to keep traffic off the public internet.

• ✓

  Create an Interface VPC endpoint (AWS PrivateLink) for Secrets Manager and associate security groups for the endpoint.

  Why this is correct

  An interface VPC endpoint for Secrets Manager creates elastic network interfaces (ENIs) with private IPs inside your subnets, enabling direct, private access to the service over the AWS backbone. You can attach security groups to the endpoint to enforce inbound and outbound traffic controls, and endpoint policies further restrict which secrets or actions are allowed. This fully satisfies the requirement to avoid internet egress because no traffic leaves the AWS network.

• ✗

  Use a Transit Gateway attachment to route traffic to the public internet for Secrets Manager.

  Why it's wrong here

  A Transit Gateway attachment is designed for interconnecting VPCs, VPN connections, and Direct Connect gateways; it does not, by itself, provide a path to Secrets Manager. To reach the public internet via Transit Gateway, you would still need an internet gateway, a NAT gateway, or a virtual appliance, which would force traffic through the public internet. That contradicts the requirement, and Transit Gateway offers no built-in private connectivity to Secrets Manager.

• ✗

  Deploy a NAT gateway and allow outbound HTTPS traffic to Secrets Manager.

  Why it's wrong here

  Deploying a NAT gateway and allowing outbound HTTPS would route Secrets Manager traffic through the public internet, because a NAT gateway provides outbound-only internet access via the VPC's internet gateway. Although HTTPS encrypts the session, the traffic still traverses public infrastructure, violating the explicit need to avoid public internet egress. Moreover, a NAT gateway does not create a private connection to Secrets Manager; it only grants internet access, which is not the correct architectural solution.

Go deeper

Related to this question