Q61 — AWS SAA-C03 Ch.14

Question 61 of 100 | ← Chapter 14

Q1061. A company runs an application in a private subnet behind an Application Load Balancer (ALB) in a VPC. The VPC has a NAT gateway and an internet gateway. The application calls the Amazon S3 API to store objects.According to the company's security policy, traffic from the application must not travel across the internet.Which solution will meet these requirements MOST cost-effectively?

Correct Answer: B. Configure an S3 gateway endpoint. Update the VPC route table to use the endpoint.

Explanation

To ensure that traffic from the application to Amazon S3 does not travel across the internet while being cost-effective, the best solution is:B. Configure an S3 gateway endpoint. Update the VPC route table to use the endpoint.Explanation:\1. S3 Gateway Endpoint: - An S3 gateway endpoint allows private connections between your VPC and Amazon S3 without the need for an internet gateway, NAT device, VPN connection, or AWS Direct Connect connection. This ensures that the traffic remains within the AWS network.\2. Cost-Effective: - Using a gateway endpoint incurs no additional charges beyond the standard S3 data transfer rates, making it a cost-effective solution compared to setting up additional gateways or NAT devices.\3. Security Compliance: - By using the S3 gateway endpoint, the application’s traffic is routed directly to S3 without crossing the public internet, thereby complying with the company's security policy.Evaluation of Other Options:A. Configure an S3 interface endpoint: - While an interface endpoint would also allow private access to S3, it is generally more costly than a gateway endpoint, especially for S3, as it uses Elastic Network Interfaces (ENIs) and is subject to additional charges.C. Configure an S3 bucket policy to allow traffic from the Elastic IP address: - This option does not prevent the traffic from going over the internet; instead, it allows traffic from a specific IP address. It does not meet the requirement to avoid internet traversal.D. Create a second NAT gateway: - This solution would still route traffic through the internet, as NAT gateways are used to allow outbound internet access for resources in a private subnet. It also incurs additional costs for running another NAT gateway.Conclusion:Option B is the most suitable and cost-effective solution to ensure that traffic from the application to Amazon S3 remains within the AWS network and complies with security policies.