SOA-C02 Networking and Content Delivery Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Create a NAT gateway in a public subnet and route private subnet traffic to it.

  Why it's wrong here

  Although a NAT gateway in a public subnet can provide outbound internet access, it would force S3 traffic to traverse the internet gateway, breaking the private connectivity assumption and incurring NAT gateway hourly charges plus data transfer costs for every object retrieval or upload. NAT gateways are also AZ-scoped and require one per AZ for high availability, adding even more cost and complexity. This solution fails the 'fully private and cost-effective' requirement because the traffic is not contained within the AWS network.

• ✓

  Create an S3 Gateway Endpoint and add a route in the private subnet route table pointing to it.

  Why this is correct

  An S3 Gateway Endpoint is a free, highly available gateway object attached to a VPC that uses a prefix list to route S3 traffic from a private subnet without going over the internet. You must add a route in the private subnet's route table with the destination as the S3 prefix list and the target as the gateway endpoint; traffic stays entirely inside the AWS network. This is the recommended pattern for private subnets because it requires no NAT gateway, no IGW, and no data transfer charges.

• ✗

  Create an S3 Interface Endpoint and assign a security group.

  Why it's wrong here

  An S3 Interface Endpoint creates a private ENI with an IP address in your subnet and is backed by AWS PrivateLink, but it is metered per hour and per gigabyte of data processed, making it significantly more expensive than a Gateway Endpoint for high-volume S3 access. It also requires a security group to control access, adding management overhead that a Gateway Endpoint does not require. For a simple private-subnet-to-S3 connection, this is over-engineered and costlier than necessary.

• ✗

  Use AWS PrivateLink to connect to S3.

  Why it's wrong here

  AWS PrivateLink is the underlying service that enables interface endpoints, so using PrivateLink to connect to S3 is effectively the same as deploying an interface endpoint. This approach incurs hourly endpoint charges and per-GB data processing fees, and it requires additional configuration such as security groups and endpoint policies. Because S3 supports Gateway Endpoints, which are free and purely private, using PrivateLink is an unnecessarily expensive and complex alternative for this scenario.

Go deeper

Related to this question