Exams / SOA-C03 / Study guide / Network cost optimization

Network cost optimization: SOA-C03 study notes and practice questions

What to know about Network cost optimization for the SOA-C03 exam, from the Networking and Content Delivery domain (18% of the exam guide), then 1 free question to test it. Part of the SOA-C03 study guide.

Last verified October 2026 against current AWS documentation ·How we write our questions

What to know for the exam

Network cost questions describe a growing bill and ask for a change that cuts it without breaking anything.

Where charges come from

Item	Charge
NAT gateway	Per hour and per GB processed
Data transfer between AZs	Per GB in each direction
Data transfer between Regions	Per GB
Internet egress	Per GB (first 100 GB a month free)
Public IPv4 addresses	Per hour for every public IPv4 address, in use or not
Interface endpoints	Per hour per AZ plus per GB
Transit Gateway	Per attachment hour plus per GB processed
Gateway endpoints	Free

Common savings

Gateway endpoints for S3 and DynamoDB remove NAT processing charges for that traffic.
Interface endpoints for heavily used AWS services can cost less than NAT processing.
CloudFront for content served to the internet; transfer from AWS origins to CloudFront is free.
Keep chatty traffic in one AZ where availability allows; NAT gateway per AZ also avoids cross-AZ hops.
Release unused Elastic IPs and remove unneeded public IPs; consider IPv6.
VPC peering has no hourly charge, unlike Transit Gateway, for a few VPCs.

Finding the cause

Cost Explorer grouped by usage type (look for NatGateway-Bytes, DataTransfer-Regional-Bytes).
VPC Flow Logs show which sources and destinations send the traffic.
Public IP Insights in IPAM lists public IPv4 addresses.
CloudWatch NAT gateway metrics (BytesOutToDestination).

Common traps

Assuming traffic within a Region is free. Cross-AZ transfer is charged.
Interface endpoint for S3 from inside the VPC when a free gateway endpoint works.
Forgetting on-premises access to S3 needs an interface endpoint, not a gateway endpoint.

Try the 1 practice question

Practice Network cost optimization Take the free practice exam

Question 1

Medium ·Link to this question

A regional bank's statement-generation instances run in private subnets and write about 40 TB a month to Amazon S3 buckets in the same Region through a NAT gateway.

The monthly bill shows high NAT gateway data processing charges.

Security policy requires that this traffic stay off the public internet.

What should a CloudOps engineer do to reduce the cost while meeting the policy?

Choose one answer.

A. Replace the NAT gateway with a NAT instance on a large EC2 instance type to avoid per-gigabyte processing charges.
B. Turn on S3 Transfer Acceleration so that the uploads use the AWS edge network instead of the NAT gateway.
C. Create an S3 gateway VPC endpoint and add it to the route tables of the private subnets.
D. Move the NAT gateway to the same Availability Zone as most of the instances to remove the processing charges.

Show the answer and explanation

Answer: C

A. Wrong: A NAT instance avoids the processing charge, but the bank would run, patch and scale it, and it becomes a single point of failure. A gateway endpoint removes the charge with no instances. Learn more: NAT gateways (opens in a new tab)
B. Wrong: Transfer Acceleration speeds up long-distance transfers through edge locations and adds its own charges. The instances would still reach it through the NAT gateway. Learn more: Configuring fast, secure file transfers using Amazon S3 Transfer Acceleration (opens in a new tab)
C. Right: Correct. A gateway endpoint routes S3 traffic privately within the AWS network, and it has no hourly or data processing charge. The NAT gateway no longer handles the S3 traffic. Learn more: Gateway endpoints for Amazon S3 (opens in a new tab)
D. Wrong: Keeping traffic in one Availability Zone avoids cross-AZ data transfer charges. The NAT gateway still charges for every gigabyte it processes, so the main cost stays. Learn more: Amazon VPC pricing (opens in a new tab)

Explanation

NAT gateways charge for each gigabyte they process, which grows quickly for bulk S3 traffic. A gateway VPC endpoint for S3 is free and keeps traffic on the AWS network, so moving S3 traffic onto it removes most of the charge. Interface endpoints for S3 also exist but have hourly and per-gigabyte charges.

S3 traffic follows the endpoint route instead of the NAT gateway, so the per-gigabyte NAT charge goes away.

Study

Want more on Network cost optimization? The 5 full-length practice sets have 6 more Network cost optimization questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets

Study Network cost optimization

NAT gateways