Exams / SAA-C03 / Network and data transfer costs / Question 1
SAA-C03 practice question: Network and data transfer costs
Design Cost-Optimized Architectures A free question from our original SAA-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.
A company's analytics servers run in private subnets and download about 50 TB a month from Amazon S3 buckets in the same Region. The traffic goes through a NAT gateway, and its data processing charges are now the largest item on the network bill. Separately, an on-premises ingestion server must upload files to the same buckets over the company's existing AWS Site-to-Site VPN connection, without using the internet. Which solution meets these requirements MOST cost-effectively?
Choose one answer.
- AA. Create an S3 gateway endpoint for the subnets, and an S3 interface endpoint with private DNS only for inbound endpoints for the VPN uploads.
- BB. Create an S3 interface endpoint with private DNS turned on for all clients, and send both the analytics downloads and the on-premises uploads through it.
- CC. Create an S3 gateway endpoint for the private subnets, and add routes so that the on-premises uploads reach S3 through it across the VPN.
- DD. Create an S3 gateway endpoint for the private subnets, and have the on-premises server upload through S3 Transfer Acceleration endpoints.
Show the answer and explanation
Answer: A
- A. Right: Correct. Gateway endpoints have no additional charge, so the 50 TB a month stops paying NAT gateway processing fees. On-premises clients cannot use a gateway endpoint, so the interface endpoint serves the VPN traffic; with private DNS only for inbound endpoints, in-VPC traffic keeps using the free gateway endpoint. Learn more: AWS PrivateLink for Amazon S3 (opens in a new tab)
- B. Wrong: This removes the NAT gateway and gives the on-premises server a private path. However, interface endpoints charge per hour in each Availability Zone and per GB processed, so all 50 TB a month would pay processing fees. The gateway endpoint carries in-VPC traffic at no extra charge. Learn more: AWS PrivateLink pricing (opens in a new tab)
- C. Wrong: The gateway endpoint fixes the NAT gateway charges, but its connections cannot be extended out of the VPC. Resources on the other side of a VPN or Direct Connect connection cannot use a gateway endpoint, so the on-premises uploads have no private path. An interface endpoint is needed for them. Learn more: Gateway endpoints for Amazon S3 (opens in a new tab)
- D. Wrong: The gateway endpoint fixes the NAT gateway charges. Transfer Acceleration, though, sends uploads over the internet to the nearest edge location, which breaks the requirement not to use the internet, and it adds its own charges. An interface endpoint reached over the VPN keeps uploads private. Learn more: Configuring fast, secure file transfers using Amazon S3 Transfer Acceleration (opens in a new tab)
Explanation
The two traffic flows need different endpoint types. In-VPC traffic to S3 in the same Region should use a gateway endpoint, which has no extra charge and bypasses the NAT gateway's per-GB fee. On-premises clients cannot use a gateway endpoint, so they need an interface endpoint; the private DNS only for inbound endpoints setting keeps VPC traffic on the cheaper gateway endpoint. On-premises clients can reach the interface endpoint with endpoint-specific DNS names or a Route 53 Resolver inbound endpoint.
Study
Keep practising
Answer questions with a score at the end, or practise just this topic with the explanation after each one. No sign-up needed.