Q61 — AWS SAA-C03 Ch.12

Question 61 of 100 | ← Chapter 12

Q861. A company is expanding a secure on-premises network to the AWS Cloud by using an AWS Direct Connect connection. The on-premises network has no direct internet access. An application that runs on the on-premises network needs to use an Amazon S3 bucket.Which solution will meet these requirements MOST cost-effectively?

• A. Create a public virtual interface (VIF). Route the AWS traffic over the public VIF.
• B. Create a VPC and a NAT gateway. Route the AWS traffic from the on-premises network to the NAT gateway.
• C. Create a VPC and an Amazon S3 interface endpoint. Route the AWS traffic from the on-premises network to the S3 interface endpoint. ✓
• D. Create a VPC peering connection between the on-premises network and Direct Connect. Route the AWS traffic over the peering connection.

Correct Answer: C. Create a VPC and an Amazon S3 interface endpoint. Route the AWS traffic from the on-premises network to the S3 interface endpoint.

Explanation

To meet the requirements of expanding a secure on-premises network to the AWS Cloud using an AWS Direct Connect connection and allowing an application to access an Amazon S3 bucket in the most cost-effective manner, the recommended solution is:C. Create a VPC and an Amazon S3 interface endpoint. Route the AWS traffic from the on-premises network to the S3 interface endpoint.Here's why:Option C suggests creating a VPC and an Amazon S3 interface endpoint. This solution allows the application running on the on-premises network to securely access the Amazon S3 bucket over the Direct Connect connection without requiring direct internet access.By creating a VPC and an S3 interface endpoint, the on-premises network can establish a private connection to Amazon S3. This connection is secure and does not require the data to traverse the public internet. The traffic from the on-premises network can be routed directly to the S3 interface endpoint over the Direct Connect connection, ensuring a secure and cost-effective transfer of data.Option A suggests creating a public virtual interface (VIF) and routing the AWS traffic over the public VIF. This option would require the on-premises network to have direct internet access, which is not desired according to the requirements. Additionally, routing traffic over a public VIF would require additional security measures to ensure data confidentiality.Option B suggests creating a VPC and a NAT gateway to route the AWS traffic from the on-premises network. While a NAT gateway provides internet access for resources in a private subnet, it is not the most cost-effective solution for accessing an S3 bucket over Direct Connect. The NAT gateway would introduce additional costs and complexity.Option D suggests creating a VPC peering connection between the on-premises network and Direct Connect. However, VPC peering is intended for private connectivity between VPCs within AWS and does not directly address the requirement of accessing an S3 bucket from the on-premises network.In summary, the recommended solution is to create a VPC and an Amazon S3 interface endpoint and route the AWS traffic from the on-premises network to the S3 interface endpoint. This solution provides a secure and cost-effective way to access an S3 bucket over the Direct Connect connection without the need for direct internet access.