Question 449 of 247
VPC Gateway Endpoint for S3: Private Access to S3 from Private Subnets
A company has a VPC with multiple subnets. The SysOps administrator wants to ensure that EC2 instances in a private subnet can access Amazon S3 without going through a NAT Gateway or internet gateway. Which solution meets this requirement?
Quick Answer
The answer is to create a VPC Gateway Endpoint for S3. This is correct because a Gateway Endpoint uses Amazon’s private network to route traffic from your private subnets directly to S3, bypassing the need for a NAT Gateway or internet gateway entirely. It works by adding a prefix list to the route table of your private subnets, directing S3-bound traffic through the endpoint rather than over the public internet. On the AWS Certified SysOps Administrator Associate SOA-C02 exam, this question tests your understanding of cost-effective, private connectivity options—a common trap is confusing Gateway Endpoints with Interface Endpoints, but remember that S3 and DynamoDB are the only services that support Gateway Endpoints, which are free and do not require additional IP addresses. A useful memory tip: Gateway Endpoints are like a private tunnel for S3, while Interface Endpoints are for everything else.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a VPC Gateway Endpoint for S3.
A VPC Gateway Endpoint for S3 allows EC2 instances in a private subnet to access S3 privately without needing a NAT Gateway or internet gateway. Option A is incorrect because a NAT Gateway requires an internet gateway and does not provide private access. Option C is incorrect because S3 Transfer Acceleration is for faster transfers over the internet, not private connectivity. Option D is incorrect because although a VPC Interface Endpoint can also provide private access to S3, the Gateway Endpoint is the recommended solution for S3 due to lower cost and simpler configuration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Set up a NAT Gateway in a public subnet and route traffic through it.
Why it's wrong here
NAT Gateway still requires internet gateway.
- ✓
Create a VPC Gateway Endpoint for S3.
Why this is correct
Gateway Endpoint provides private access to S3.
- ✗
Use S3 Transfer Acceleration.
Why it's wrong here
Transfer Acceleration is for faster uploads, not private access.
- ✗
Create a VPC Interface Endpoint for S3.
Why it's wrong here
Interface Endpoint is possible but more expensive; Gateway Endpoint is better for S3.
Visual reference
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SOA-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A SysOps Administrator is configuring a VPC with a public subnet and a private subnet. The public subnet has an Internet Gateway. An EC2 instance in the private subnet needs to access an S3 bucket. What is the MOST secure way to provide this access?
hard- A.Attach an Internet Gateway to the private subnet.
- ✓ B.Create a VPC Gateway Endpoint for S3 in the private subnet's route table.
- C.Use a VPC peering connection to an S3 bucket.
- D.Create a NAT Gateway in the public subnet and route traffic through it.
Why B: A VPC Gateway Endpoint for S3 allows instances in a private subnet to access S3 privately without traversing the internet, using AWS's internal network. This is the most secure method as it avoids exposing the private subnet to the public internet or requiring a NAT Gateway, and it leverages AWS PrivateLink for direct, low-latency connectivity.
Last reviewed: Jun 20, 2026
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.