CCSP Private Endpoint Practice Question
A cloud security architect needs to allow an application in a VPC to access a cloud database service without traversing the public internet. Which feature should be implemented?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Private Endpoint (Service Endpoint)
Private Endpoint (also known as Service Endpoint or Private Link) enables private connectivity to cloud services without internet exposure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
VPN Connection
Why it's wrong here
A VPN Connection tunnels traffic between remote networks or on-premises sites and the VPC over the internet; it does not provide private connectivity to a cloud database service within the same provider. It is tempting because VPNs are commonly used for secure private access, but a VPC endpoint is the correct mechanism here.
- ✗
Internet Gateway
Why it's wrong here
An Internet Gateway provides public internet connectivity for VPC resources, so traffic to the database service would traverse the public internet, directly contradicting the requirement. It is tempting because it is the default egress path for public subnets, but private access to a cloud database service requires a VPC endpoint instead.
- ✓
Private Endpoint (Service Endpoint)
Why this is correct
A Private Endpoint (Service Endpoint) maps the database service into the VPC's private address space, so traffic never traverses the public internet. This satisfies the constraint by keeping connectivity on the cloud provider's private backbone rather than via NAT or internet gateway.
- ✗
NAT Gateway
Why it's wrong here
A NAT Gateway allows instances in private subnets to initiate outbound traffic to the internet while remaining unreachable inbound, so database traffic still traverses the public internet. It is tempting because it is the standard egress solution for private subnets, but the requirement demands private connectivity via a VPC endpoint.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CCSP question from scratch — 934 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.