SOA-C02 Cost and Performance Optimization Practice Question
A SysOps administrator is troubleshooting a cost overrun in an AWS account. The cost explorer shows that data transfer costs have significantly increased. The architecture includes an Application Load Balancer (ALB) internet-facing, EC2 instances in private subnets, and an S3 bucket for static assets. Which action will MOST effectively reduce data transfer costs?
⚠ Common exam trap
The trap is focusing on NAT Gateway hourly charges or CloudFront caching while overlooking that S3 data transfer through NAT Gateway incurs data processing and egress costs; SOA-C02 often tests whether candidates know that Gateway Endpoints for S3 are free and eliminate those costs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement a VPC Gateway Endpoint for S3 so that traffic from EC2 to S3 stays within the AWS network.
Implementing a VPC Gateway Endpoint for S3 allows EC2 instances in private subnets to access S3 without traversing the NAT Gateway or internet, eliminating data transfer costs associated with NAT Gateway data processing and internet egress. This is the most effective cost reduction because S3 traffic is often a major contributor to data transfer charges in such architectures.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable Amazon CloudFront to cache static assets and reduce direct requests to the ALB.
Why it's wrong here
CloudFront can reduce ALB load by serving cached static objects from edge locations, but it only lowers request volume and data transfer at the origin; it does not reduce the data transfer charges incurred when EC2 instances access S3 through a NAT Gateway or Internet Gateway. The cost overrun persists because the underlying egress traffic and NAT data processing fees remain unchanged.
- ✓
Implement a VPC Gateway Endpoint for S3 so that traffic from EC2 to S3 stays within the AWS network.
Why this is correct
VPC Gateway Endpoints for S3 are horizontally scaled, redundant VPC components that require no additional cost—they are free to use and carry no hourly or per-GB charges. When added to the route table, traffic destined for S3 is directed via prefix lists to stay inside the AWS network, bypassing the NAT Gateway for both data transfer and NAT processing fees. This directly cuts the most common source of S3-related cost overruns from EC2 instances in private subnets.
- ✗
Replace the NAT Gateway with a NAT instance to reduce hourly charges.
Why it's wrong here
Switching from a NAT Gateway to a self-managed NAT instance eliminates the NAT Gateway hourly and per-GB data processing fees, but it simply shifts the cost to EC2 instance hours, AMI sizes, and the same internet egress data charges. A NAT instance also lacks managed redundancy, so you must implement an HA pair with health checks and route table updates, which adds administrative overhead. Since the real problem is paying for internet-bound traffic to S3, this change still does not keep the traffic within AWS and does nothing to lower data processing or ALB-related charges.
- ✗
Change the ALB to internal (private) and use AWS Direct Connect for user access.
Why it's wrong here
Making the ALB internal and requiring Direct Connect for user access replaces a relatively inexpensive internet-facing endpoint with a dedicated network connection that charges monthly port hours and per-GB data transfer. Internet users would lose connectivity unless they are connected via Direct Connect, and the ALB still processes the same amount of traffic, so its LCU charges remain unchanged. This architectural change increases cost and operational complexity without addressing the underlying S3 egress costs.
Visual reference
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This SOA-C02 question is part of Courseiva's 1,169-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.