Q92 — AWS SAA-C03 Ch.14

Question 92 of 100 | ← Chapter 14

Q1092. A company runs workloads in 20 private VPCs. Each VPC has interface VPC endpoints for many AWS services. The company wants to optimize costs for its network architecture. The company must not use public IP addresses.Which solution will meet these requirements?

Correct Answer: B. Replace the interface VPC endpoints from each workload VPC with gateway endpoints. Update the VPC route tables to route traffic bound for the AWS services to the gateway endpoints.

Explanation

B OR C.To optimize costs for a network architecture that involves 20 private VPCs, each with interface VPC endpoints for many AWS services, while ensuring that public IP addresses are not used, let's evaluate each option:A. Create a NAT gateway in each workload VPC. Remove the interface VPC endpoints. Update the VPC route tables to add a default route to the NAT gateway.This solution would not optimize costs because NAT gateways are typically more expensive than VPC endpoints.Removing interface VPC endpoints and routing traffic through NAT gateways would also introduce latency and potential performance degradation.NAT gateways require public IP addresses, which contradicts the requirement to not use public IP addresses.B. Replace the interface VPC endpoints from each workload VPC with gateway endpoints. Update the VPC route tables to route traffic bound for the AWS services to the gateway endpoints.Gateway endpoints are cost-effective and do not require public IP addresses. They provide direct, private connectivity to AWS services without traversing the public internet. This solution would optimize costs and maintain the private network architecture. C. Create interface VPC endpoints and a transit gateway in a new central VPC. Use the transit gateway to connect the workload VPCs to the central VPC. Remove the interface VPC endpoints from the workload VPCs. Set up private hosted zones in the workload VPCs to direct traffic to the central VPC.This solution introduces complexity and potential points of failure with the transit gateway and central VPC. It does not optimize costs, as it retains the use of interface VPC endpoints (albeit in a central VPC). Setting up private hosted zones and managing DNS routing adds complexity. D. Create gateway endpoints in a new central VPC. Use VPC peering to connect the workload VPCs to the central VPC. Remove the interface VPC endpoints from workload VPCs. Set up private hosted zones in the workload VPCs to direct traffic to the central VPC.This solution is similarly complex and introduces additional points of failure. Gateway endpoints in a central VPC do not directly benefit the workload VPCs unless traffic is explicitly routed through the central VPC, which adds latency.VPC peering and private hosted zones add complexity and potential for misconfiguration. Given the requirements to optimize costs, maintain a private network architecture, and avoid using public IP addresses, the most suitable solution is:B. Replace the interface VPC endpoints from each workload VPC with gateway endpoints. Update the VPC route tables to route traffic bound for the AWS services to the gateway endpoints.This solution directly addresses the cost optimization and private network requirements, providing a simple and effective way to manage traffic to AWS services without introducing unnecessary complexity or cost.