SOA-C02 Direct Connect private VIF Practice Question
A company has an on-premises data center connected to AWS via an AWS Direct Connect private virtual interface (VIF). The SysOps administrator needs to ensure that all traffic between the on-premises network and Amazon S3 in the same AWS Region stays within the AWS network and does not traverse the internet. Which solution should the administrator implement?
⚠ Common exam trap
It's easy for candidates to confuse public VIF with private VIF, thinking a public VIF is required for AWS service access, but Gateway Endpoints allow private VIF to access S3 without internet exposure.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a Direct Connect gateway and a private VIF with VPC endpoints for S3
A private VIF with VPC endpoints for S3 (Gateway Endpoints) ensures that traffic from on-premises to S3 stays within the AWS network. The private VIF provides connectivity to the VPC, and the Gateway Endpoint routes S3 traffic through the AWS backbone without traversing the internet. This combination meets the requirement of keeping traffic within the AWS network.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use a Direct Connect gateway and a public VIF with a route to S3 prefix lists
Why it's wrong here
A public VIF attaches to the AWS public zone, providing connectivity only to AWS public endpoints such as the S3 endpoints that resolve to public IP addresses. Even if you configure routes to S3 prefix lists, the traffic traverses the AWS public edge rather than remaining within a private network, so it does not satisfy a strict ‘no internet’ or ‘fully private’ requirement. This option also omits VPC endpoints, which are necessary to privatise S3 access from a Direct Connect private VIF.
- ✓
Use a Direct Connect gateway and a private VIF with VPC endpoints for S3
Why this is correct
A private VIF creates a dedicated private network connection between your on-premises data center and a VPC, while a VPC Gateway Endpoint for S3 privately connects the VPC to S3 without traversing the internet. Traffic from on-premises flows via the private VIF into the VPC and then through the Gateway Endpoint directly to S3 over AWS's internal network, successfully meeting the requirement for high-bandwidth, fully private S3 access. This is the recommended AWS architecture for private S3 connectivity over Direct Connect.
- ✗
Use a VPN connection over Direct Connect to access S3
Why it's wrong here
A VPN connection over Direct Connect establishes an encrypted tunnel for private IP traffic, typically between an on-premises network and a Virtual Private Cloud (VPC). This fails for S3 because Amazon S3 is a public service accessed via public endpoints, and a VPN over Direct Connect does not provide a mechanism to privatise S3 traffic to keep it entirely within the AWS network. This option is tempting as VPNs offer an encrypted layer over Direct Connect, making them suitable for securing sensitive data paths to resources *within a VPC* or for meeting specific compliance requirements.
- ✗
Use a Transit Gateway with a private VIF and route S3 traffic through a NAT instance
Why it's wrong here
A Transit Gateway can route traffic between VPCs and on-premises networks via a private VIF, but it does not itself create any path to S3; you would still need an S3 endpoint or an egress path. Using a NAT instance forces S3 traffic through an instance that forwards it to public S3 endpoints over the internet, so data leaves the AWS private network and incurs NAT instance management, scaling, and transfer costs. This approach fails the ‘keep traffic private’ objective and introduces unnecessary operational complexity, making it incorrect.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every SOA-C02 question from scratch — 247 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.