Question 1,273 of 247
VPC Gateway Endpoint: Secure and Cost-Effective S3 Access
A company has an application running on EC2 instances in a VPC. The application needs to access an S3 bucket in the same AWS region. Which configuration provides the MOST secure and cost-effective access?
Quick Answer
The correct answer is to create a VPC Gateway Endpoint for S3 and update the route tables for the private subnets. This configuration is both secure and cost-effective because it allows EC2 instances in private subnets to access S3 directly over the AWS backbone network, completely bypassing the public internet and eliminating the need for a NAT Gateway or Internet Gateway. On the AWS Certified SysOps Administrator Associate SOA-C02 exam, this scenario tests your understanding of how to optimize data transfer costs while maintaining security—a common trap is choosing a NAT Gateway or VPC Interface Endpoint, which incur per-hour and per-GB charges, whereas a Gateway Endpoint is free and uses prefix lists in route tables. Remember the memory tip: Gateway Endpoints are for S3 and DynamoDB only, and they require a route table entry, not a security group.
⚠ Common exam trap
Watch out — candidates often confuse VPC Gateway Endpoints with VPC Interface Endpoints (powered by AWS PrivateLink), but for S3, a Gateway Endpoint is the correct and most cost-effective choice because it does not require an Elastic Network Interface or incur hourly charges, unlike an Interface Endpoint.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a VPC Gateway Endpoint for S3 and update the route tables for the private subnets.
A VPC Gateway Endpoint for S3 allows EC2 instances in private subnets to access S3 directly over the AWS network without traversing the internet, eliminating the need for a NAT Gateway or Internet Gateway. This provides the most secure and cost-effective access by keeping traffic within the AWS backbone and avoiding data transfer costs associated with NAT Gateways or public endpoints.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Make the S3 bucket publicly accessible and use the public endpoint from the EC2 instances.
Why it's wrong here
Publicly accessible bucket poses security risk.
- ✗
Set up a NAT Gateway in a public subnet and route traffic from the EC2 instances through it to the S3 endpoint.
Why it's wrong here
NAT Gateway adds cost and complexity, and still uses internet path.
- ✓
Create a VPC Gateway Endpoint for S3 and update the route tables for the private subnets.
Why this is correct
Gateway Endpoint provides private, secure, and free connectivity to S3 within the same region.
- ✗
Create an Internet Gateway and route traffic from the EC2 instances through it to a public S3 endpoint.
Why it's wrong here
This requires internet access and public IP, increasing security risk and cost.
Visual reference
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SOA-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. EC2 instances in private subnets need to access S3 buckets. Currently the instances use a NAT Gateway to reach S3 over the internet. The team wants to keep S3 traffic private (within the AWS network) and reduce NAT Gateway data processing costs. What is the correct solution?
easy- ✓ A.Create an S3 Gateway VPC endpoint and add it to the private subnet's route table; S3 traffic will bypass the NAT Gateway
- B.Create an S3 Interface VPC endpoint in the private subnet to route S3 traffic privately
- C.Add a route in the private subnet's route table directing all traffic (0.0.0.0/0) to an Internet Gateway
- D.Use S3 Transfer Acceleration to route traffic over AWS edge locations instead of NAT
Why A: An S3 Gateway VPC endpoint allows EC2 instances in private subnets to access S3 privately using AWS’s internal network, bypassing the NAT Gateway entirely. This eliminates NAT data processing costs and keeps traffic within the AWS backbone, as the endpoint is added to the private subnet’s route table with a prefix list for S3, directing traffic directly to S3 without internet routing.
Last reviewed: Jun 24, 2026
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.