SOA-C02 Networking and Content Delivery Practice Question
A company has an Amazon VPC with public and private subnets across two Availability Zones. The company hosts a web application on EC2 instances in the private subnets. The application needs to access an Amazon S3 bucket to upload and download files. The SysOps administrator must ensure that traffic to S3 does not traverse the internet and minimizes data transfer costs. Which solution should the administrator implement?
⚠ Common exam trap
It's easy for candidates to confuse Gateway Endpoints with Interface Endpoints, assuming both are equally suitable for S3, but Gateway Endpoints are free and optimized for S3 and DynamoDB, while Interface Endpoints incur costs and are better for other AWS services.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an S3 VPC Gateway Endpoint in the VPC and associate it with the route tables of the private subnets.
An S3 VPC Gateway Endpoint provides a private, cost-effective connection to S3 from within the VPC without traversing the internet. By associating the endpoint with the route tables of the private subnets, traffic destined for S3 is routed directly through AWS's internal network, avoiding data transfer costs and internet egress charges.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create an S3 VPC Gateway Endpoint in the VPC and associate it with the route tables of the private subnets.
Why this is correct
Gateway Endpoints provide private connectivity to S3 at no additional cost (only standard data transfer rates apply). By adding a route for the S3 prefix list to the private subnet route tables, traffic destined for S3 is routed through the endpoint.
- ✗
Create an S3 VPC Interface Endpoint in the VPC and associate it with the security groups of the private subnets.
Why it's wrong here
An S3 VPC Interface Endpoint is a PrivateLink-based ENI that offers private access, but it incurs hourly charges and per-GB data processing fees, making it more expensive than a Gateway Endpoint for S3. Additionally, security groups cannot be associated with subnets—they are attached to ENIs, and the interface endpoint's security group controls access. Since the question emphasizes cost-effectiveness and private connectivity, the Gateway Endpoint is the correct choice.
- ✗
Set up a NAT Gateway in the public subnets and add a route to the private subnets' route tables pointing to the NAT Gateway for S3 traffic.
Why it's wrong here
A NAT Gateway in public subnets provides outbound internet access, but routing S3 traffic through it sends the traffic over the public internet, which loses the private connectivity that a Gateway Endpoint offers and incurs data transfer charges. NAT Gateway also carries per-hour and per-GB processing costs, making it unnecessarily expensive for S3 access. By contrast, a Gateway Endpoint is free and uses the S3 prefix list in private subnet route tables to keep all S3 traffic within the AWS network.
- ✗
Use AWS PrivateLink with an S3 endpoint service hosted in a different VPC.
Why it's wrong here
AWS PrivateLink is the underlying technology for Interface Endpoints, but S3 is a managed AWS service, not a service you host in your VPC, so you cannot create an endpoint service for S3 in another VPC. Configuring a cross-VPC endpoint service for S3 is not a supported pattern and would require traffic to traverse a peering or transit connection, adding latency and complexity. The correct PrivateLink use case for S3 is an Interface Endpoint in the same VPC, which is still less economical than a Gateway Endpoint for most workloads.
Visual reference
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 247 original SOA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.