Q30 — AWS SAA-C03 Ch.17

Question 30 of 89 | ← Chapter 17

Q1330. A company runs a non-production Oracle database on an Amazon EC2 instance. The database contains 1 TB of data. The EC2 instance runs in a private subnet of a VPC. A backup of the EC2 instance is taken every day and uploaded to an Amazon S3 bucket. The current backup process uses a NAT gateway to access the S3 bucket.The company does not want the backup process to use public IP addresses. Which solution will meet this requirement MOST cost-effectively?

• A. Create a gateway endpoint for Amazon S3 in the VPC. Update the route tables. ✓
• B. Enable S3 Transfer Acceleration on the S3 bucket. Compress the backup files and use multipart uploads.
• C. Create an Amazon CloudFront distribution, and set the S3 bucket as the origin. Upload the backup files to the CloudFront distribution.
• D. Use a third-party tool to mount the S3 bucket as a file share on the EC2 instance operating system. Use the file share as the backup target.

Correct Answer: A. Create a gateway endpoint for Amazon S3 in the VPC. Update the route tables.

Explanation

Correct Answer: ACreate a gateway endpoint for Amazon S3 in the VPC. Update the route tables.Why This Solution Meets the Requirement Most Cost-Effectively? The company wants to avoid using public IP addresses (NAT Gateway) for backups while cost-effectively transferring data from an EC2 instance in a private subnet to an S3 bucket.Key Requirements:No public IP usage (avoid NAT Gateway costs).Cost-effective (minimize additional expenses).Secure & direct access to S3 from a private subnet.Option A is the best choice because:VPC Gateway Endpoint for S3 provides private, direct access to S3 without requiring internet connectivity (no NAT Gateway needed).No additional data transfer costs (unlike Transfer Acceleration or CloudFront). Simple setup--just create the endpoint and update route tables. Free to use (only a small hourly charge for the endpoint itself, no data transfer fees).Why Other Options Fail?B. Enable S3 Transfer Acceleration + Compression + Multipart Uploads Transfer Acceleration uses edge locations, but still requires internet access (NAT Gateway or public IP).Higher costs (additional fees for Transfer Acceleration).Does not eliminate the need for NAT Gateway in a private subnet.C. Use Amazon CloudFront DistributionCloudFront is a CDN, not a backup solution--it does not provide direct S3 access from private subnets. Still requires internet access (NAT Gateway or public IP) to upload to CloudFront.Higher costs (data transfer out from CloudFront edges).D. Use a Third-Party Tool to Mount S3 as a File ShareSome tools (e.g., s3fs, rclone) may work, but they still require internet access (NAT Gateway or public IP). Potential performance issues (not optimized for large backups). Not a native AWS solution--introduces operational complexity.How VPC Gateway Endpoint for S3 Works (Option A)Create an S3 Gateway Endpoint in the VPC.Attach it to the private subnet's route table, directing S3 traffic (pl-xxxxxx) through the endpoint. EC2 instances in the private subnet can now access S3 without going through the internet (NAT Gateway). No public IPs are used--communication stays within AWS's private network.Architecture DiagramInternetAWS Public NetworkVPC Private SubnetEC2 S3 Gateway Endpoint (Private Link)Instance(Backup traffic flows directly to S3 without NAT Gateway)Key TakeawaysVPC Gateway Endpoint for S3 is the most cost-effective and secure way to access S3 from private subnets.Avoid NAT Gateway for backups to reduce costs.Do not use CloudFront, Transfer Acceleration, or third-party tools for this use case.This solution ensures private, low-cost, and efficient backups to S3.