SOA-C02 Networking and Content Delivery Practice Question

An application running on EC2 instances sends large amounts of data to an S3 bucket. The SysOps administrator wants to reduce data transfer costs while ensuring the traffic stays within AWS. What is the most cost-effective solution?

⚠ Common exam trap

Test-takers frequently confuse Gateway VPC Endpoints with Interface Endpoints or assume that S3 Transfer Acceleration is cheaper for large data volumes, when in fact Gateway Endpoints are free and provide the most cost-effective private connectivity within a region.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Create a VPC Endpoint for S3 (Gateway type) and use it from the EC2 instances.

A VPC Endpoint for S3 (Gateway type) allows EC2 instances to access S3 over the AWS private network without traversing the public internet, eliminating data transfer costs for traffic within the same region. Since the traffic stays within AWS, this is the most cost-effective solution as it avoids NAT Gateway, Direct Connect, or S3 Transfer Acceleration charges.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Set up an AWS Direct Connect connection.
Why it's wrong here
Direct Connect is a dedicated physical network connection from on-premises to AWS, with monthly port hourly charges and additional per-gigabyte data transfer fees. It is unnecessary here because the EC2 instances are already inside AWS, so a VPC endpoint provides private, free connectivity to S3 without the expense or long provisioning lead time.
✗
Use S3 Transfer Acceleration.
Why it's wrong here
S3 Transfer Acceleration routes uploads through AWS edge locations to reduce latency over long distances, but it is designed for clients on the public internet. For EC2 instances in the same region as the bucket, it provides no benefit and incurs additional per-gigabyte transfer costs, so it is not an appropriate replacement for a private, free VPC endpoint.
✓
Create a VPC Endpoint for S3 (Gateway type) and use it from the EC2 instances.
Why this is correct
A Gateway VPC Endpoint for S3 allows EC2 instances in a private subnet to reach S3 without an internet gateway, NAT device, or public IP address. It is free of charge, has no data processing fees, and works by adding a service prefix list to the route table, which keeps S3 traffic on AWS's private network. This makes it the most direct and cost-effective solution for large data transfers from EC2.
✗
Route traffic through a NAT Gateway in a public subnet.
Why it's wrong here
A NAT Gateway in a public subnet charges per hour and per gigabyte of data processed, and it still requires an internet gateway and routing traffic out to the public internet. This would not keep S3 traffic private and would create higher costs than a gateway VPC endpoint. For applications within the VPC, NAT is an expensive and unnecessary detour for S3 access.

Visual reference

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

SOA-C02 Networking and Content Delivery Practice Question

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question