SCS-C02 Infrastructure Security Practice Question
A company wants to allow an EC2 instance to access a DynamoDB table without traversing the internet. Which AWS feature should be used?
⚠ Common exam trap
A common mix-up: candidates confuse Gateway Endpoints with Interface Endpoints (for services like S3 or DynamoDB) or mistakenly think VPC Peering or NAT Gateway can provide private access to DynamoDB, but only Gateway Endpoints support DynamoDB without internet traversal.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
VPC Gateway Endpoint for DynamoDB
A VPC Gateway Endpoint for DynamoDB allows EC2 instances within a VPC to access DynamoDB without traversing the internet. It uses AWS PrivateLink to route traffic through the AWS network, ensuring low latency and enhanced security by keeping traffic within the AWS backbone.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
VPC Peering
Why it's wrong here
VPC Peering connects two VPCs to route traffic between their private IP ranges, typically for EC2-to-EC2 communication. It does not create any route to DynamoDB, because DynamoDB is a managed service with a public API endpoint and is not hosted inside your VPC. Peering only links VPCs, so it cannot expose DynamoDB as a resource; you'd still need an endpoint or internet path. Therefore, VPC peering is not a mechanism for an EC2 instance to reach DynamoDB privately.
- ✗
ClassicLink
Why it's wrong here
ClassicLink was a feature that linked EC2-Classic instances to a VPC using the VPC security groups, but EC2-Classic is deprecated and no longer available for new accounts. Even when it existed, ClassicLink only provided a private connection between an EC2-Classic instance and a VPC; it had no ability to reach an AWS service like DynamoDB. DynamoDB's endpoint is separate and requires a gateway endpoint, interface endpoint, or internet access, none of which ClassicLink provides. Hence, ClassicLink is unrelated to the stated requirement.
- ✗
NAT Gateway
Why it's wrong here
A NAT Gateway enables instances in a private subnet to initiate outbound traffic to the internet, and that traffic can indeed reach DynamoDB's public endpoint. However, it does so by routing the packets through an Internet Gateway to DynamoDB's public DNS, meaning the connection traverses the public network and is not private. This would work in a pinch but violates the typical security requirement for private connectivity and can incur data transfer costs. Since the question asks how to 'allow an EC2 instance to access DynamoDB' in the most correct way, a NAT gateway is not the intended answer when a VPC gateway endpoint exists.
- ✓
VPC Gateway Endpoint for DynamoDB
Why this is correct
A VPC Gateway Endpoint for DynamoDB is a logical gateway object added to the VPC route table, allowing instances to reach DynamoDB via AWS's private network without attaching an internet gateway or NAT device. It works by adding an entry to the route table that points DynamoDB's prefix list to the endpoint, and it supports IAM policies on the endpoint itself to restrict access. This is the recommended, private, and cost-effective solution for an EC2 instance to access DynamoDB securely and is the correct answer.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SCS-C02 question from scratch — 1,205 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.