Q75 — AWS SAA-C03 Ch.16

Question 75 of 100 | ← Chapter 16

Q1275. A company has an application that runs on Amazon EC2 instances within a private subnet in a VPC. The instances access data in an Amazon S3 bucket in the same AWS Region. The VPC contains a NAT gateway in a public subnet to access the S3 bucket. The company wants to reduce costs by replacing the NAT gateway without compromising security or redundancy.Which solution meets these requirements?

Correct Answer: C. Replace the NAT gateway with a gateway VPC endpoint.

Explanation

The correct solution must reduce costs while maintaining security and redundancy for EC2 instances accessing an S3 bucket in the same AWS Region. Let's evaluate each option:Correct Answer: C. Replace the NAT gateway with a gateway VPC endpoint.Why Option C is Best:Cost Efficiency:NAT gateways incur hourly charges + data transfer costs (~$0.045/GB for outbound traffic). Gateway VPC endpoints for S3 have no additional cost (only a small charge per GB of data processed via the endpoint, but this is typically cheaper than NAT gateway fees).Security & Redundancy:Gateway VPC endpoints provide private, secure access to S3 without traversing the public internet. Highly available by default (AWS manages redundancy across Availability Zones). No need for an internet gateway or NAT gateway for S3 access.Simplified Architecture:Removes the need for a public subnet + NAT gateway for S3 traffic. Traffic stays within the AWS backbone, improving latency and security.Why Other Options Fail:A. Replace the NAT gateway with a NAT instance.Cost Savings Are Limited:NAT instances (EC2-based) may be cheaper for very low traffic, but they require manual scaling, patching, and redundancy management.Not as reliable as gateway endpoints (no built-in AZ failover).Still Incur EC2 Costs:Running an EC2 instance 24/7 may not be cheaper than a NAT gateway for moderate/high traffic.B. Replace the NAT gateway with an internet gateway.Insecure & Incorrect Use Case:An internet gateway provides public internet access, but the goal is to avoid exposing EC2 instances to the internet.Does not reduce costs (still requires NAT for private subnet instances to access S3). D. Replace the NAT gateway with an AWS Direct Connect connection.Overkill & Expensive:Direct Connect is for hybrid cloud connectivity (on-premises to AWS), not for S3 access within the same Region.High setup and maintenance costs (dedicated network circuits).Key Comparison:RequirementGateway VPC Endpoint (C)Other OptionsReduces Costs(No NAT gateway fees) (NAT instance = EC2 costs; IGW/Direct Connect = no savings) Maintains Security(Private AWS network) (IGW = public internet exposure) Ensures Redundancy(AWS-managed AZ failover) (NAT instance = manual HA setup) Simplifies Architecture(No public subnet needed) (NAT instance = management overhead)Conclusion:Option C (Gateway VPC Endpoint) is the only solution that:Eliminates NAT gateway costs while keeping traffic private.Maintains high availability without manual intervention.Optimizes performance by using AWS's internal network.Final Answer: C