SOA-C02 Practice Question: S3 Gateway VPC endpoint to prevent S3 traffic…
EC2 instances in private subnets need to access S3 buckets. Currently the instances use a NAT Gateway to reach S3 over the internet. The team wants to keep S3 traffic private (within the AWS network) and reduce NAT Gateway data processing costs. What is the correct solution?
⚠ Common exam trap
Test-takers frequently confuse Gateway VPC endpoints with Interface VPC endpoints, assuming both incur costs, but S3 Gateway endpoints are free and designed specifically for S3 and DynamoDB, while Interface endpoints are for other AWS services and have associated charges.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an S3 Gateway VPC endpoint and add it to the private subnet's route table; S3 traffic will bypass the NAT Gateway
An S3 Gateway VPC endpoint allows EC2 instances in private subnets to access S3 privately using AWS’s internal network, bypassing the NAT Gateway entirely. This eliminates NAT data processing costs and keeps traffic within the AWS backbone, as the endpoint is added to the private subnet’s route table with a prefix list for S3, directing traffic directly to S3 without internet routing.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create an S3 Gateway VPC endpoint and add it to the private subnet's route table; S3 traffic will bypass the NAT Gateway
Why this is correct
After the Gateway endpoint is created and the route table updated, the AWS networking layer automatically routes S3 API calls from instances in those subnets through the private endpoint path. The NAT Gateway processes zero S3 bytes, eliminating the per-GB data processing cost for S3 traffic. No code changes are required.
- ✗
Create an S3 Interface VPC endpoint in the private subnet to route S3 traffic privately
Why it's wrong here
S3 Interface endpoints (PrivateLink) assign private IP addresses in the subnet and use ENIs. They incur an hourly endpoint cost and per-GB data processing charge. For the goal of reducing cost, the Gateway endpoint (free) is the correct choice. Interface endpoints are used when DNS resolution to private IPs is required (e.g., on-premises access via Direct Connect).
- ✗
Add a route in the private subnet's route table directing all traffic (0.0.0.0/0) to an Internet Gateway
Why it's wrong here
Adding a 0.0.0.0/0 route to an Internet Gateway (IGW) in the private subnet's route table would reclassify that subnet as public, giving every instance a direct path to the internet without any NAT device. This exposes instances to unsolicited inbound traffic, defeating the isolation that a private subnet is designed to provide. It also fails to reduce S3 costs: any S3 traffic that leaves through the IGW would incur data transfer charges for internet egress, and the NAT Gateway would still process other outbound traffic, so the per-GB NAT charges for S3 remain unless the endpoint is used. The correct way to keep instances private while making S3 accessible without NAT is a Gateway VPC endpoint, not an IGW route.
- ✗
Use S3 Transfer Acceleration to route traffic over AWS edge locations instead of NAT
Why it's wrong here
S3 Transfer Acceleration uses CloudFront edge locations to accelerate uploads from clients over the internet by routing through the nearest AWS edge. It does not prevent traffic from traversing the internet — it actually uses the internet as the ingress path to the edge. It also adds cost per GB.
Visual reference
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This SOA-C02 question is part of Courseiva's 1,169-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SOA-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company has an application running on EC2 instances in a VPC. The application needs to access an S3 bucket in the same AWS region. Which configuration provides the MOST secure and cost-effective access?
easy- A.Make the S3 bucket publicly accessible and use the public endpoint from the EC2 instances.
- B.Set up a NAT Gateway in a public subnet and route traffic from the EC2 instances through it to the S3 endpoint.
- ✓ C.Create a VPC Gateway Endpoint for S3 and update the route tables for the private subnets.
- D.Create an Internet Gateway and route traffic from the EC2 instances through it to a public S3 endpoint.
Why C: A VPC Gateway Endpoint for S3 allows EC2 instances in private subnets to access S3 directly over the AWS network without traversing the internet, eliminating the need for a NAT Gateway or Internet Gateway. This provides the most secure and cost-effective access by keeping traffic within the AWS backbone and avoiding data transfer costs associated with NAT Gateways or public endpoints.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.