Exams / SAA-C03 / Study guide / Network and data transfer costs

Network and data transfer costs: SAA-C03 study notes and practice questions

What to know about Network and data transfer costs for the SAA-C03 exam, from the Design Cost-Optimized Architectures domain (20% of the exam guide), then 1 free question to test it. Part of the SAA-C03 study guide.

Last verified October 2026 against current AWS documentation ·How we write our questions

What to know for the exam

Network cost questions describe a bill that’s higher than expected and ask which change reduces it without breaking anything. Learn where AWS charges for data movement.

Where charges apply

Traffic	Charge
Into AWS from the internet	Free
Out to the internet	Per GB (the first 100 GB each month are free across services)
Between Availability Zones in one Region	Per GB, in each direction
Within one Availability Zone, using private IPs	Free
Between Regions	Per GB
Through a NAT gateway	Per hour plus per GB processed, on top of any other transfer charges
From AWS origins to CloudFront	Free; you pay CloudFront’s (usually lower) rates to users
Through an interface endpoint	Per hour plus per GB
Through a gateway endpoint (S3, DynamoDB)	Free

Ways to cut it

Gateway endpoints for S3 and DynamoDB remove NAT gateway processing charges for that traffic. This is the most common answer.
Interface endpoints for other AWS services can be cheaper than NAT for heavy traffic, and keep it private.
CloudFront in front of S3 or a load balancer reduces data transfer out and origin load.
Keep chatty components in the same zone where availability allows, or use private IPs instead of public ones within a Region.
Direct Connect has lower per-GB data transfer out rates than the internet for large, steady volumes.
S3 Requester Pays makes the downloader pay for transfer when sharing large data sets.

Analyzing the bill

Cost Explorer filtered by usage type shows data transfer by kind.
VPC Flow Logs show which resources are talking to which.
Cost and Usage Reports (Data Exports) give line-item detail.

Common traps

Sending S3 traffic from private subnets through a NAT gateway. Add a gateway endpoint.
Assuming all traffic within a Region is free. Cross-zone traffic is charged.
Using a public IP between instances in the same Region. That can be charged like internet traffic; use private IPs.
Forgetting on-premises clients can’t use a gateway endpoint. They need an interface endpoint for S3 over Direct Connect or VPN.

Try the 1 practice question

Practice Network and data transfer costs Take the free practice exam

Question 1

Harder ·Link to this question

A company's analytics servers run in private subnets and download about 50 TB a month from Amazon S3 buckets in the same Region.

The traffic goes through a NAT gateway, and its data processing charges are now the largest item on the network bill.

Separately, an on-premises ingestion server must upload files to the same buckets over the company's existing AWS Site-to-Site VPN connection, without using the internet.

Which solution meets these requirements MOST cost-effectively?

Choose one answer.

A. Create an S3 gateway endpoint for the subnets, and an S3 interface endpoint with private DNS only for inbound endpoints for the VPN uploads.
B. Create an S3 interface endpoint with private DNS turned on for all clients, and send both the analytics downloads and the on-premises uploads through it.
C. Create an S3 gateway endpoint for the private subnets, and add routes so that the on-premises uploads reach S3 through it across the VPN.
D. Create an S3 gateway endpoint for the private subnets, and have the on-premises server upload through S3 Transfer Acceleration endpoints.

Show the answer and explanation

Answer: A

A. Right: Correct. Gateway endpoints have no additional charge, so the 50 TB a month stops paying NAT gateway processing fees. On-premises clients cannot use a gateway endpoint, so the interface endpoint serves the VPN traffic; with private DNS only for inbound endpoints, in-VPC traffic keeps using the free gateway endpoint. Learn more: AWS PrivateLink for Amazon S3 (opens in a new tab)
B. Wrong: This removes the NAT gateway and gives the on-premises server a private path. However, interface endpoints charge per hour in each Availability Zone and per GB processed, so all 50 TB a month would pay processing fees. The gateway endpoint carries in-VPC traffic at no extra charge. Learn more: AWS PrivateLink pricing (opens in a new tab)
C. Wrong: The gateway endpoint fixes the NAT gateway charges, but its connections cannot be extended out of the VPC. Resources on the other side of a VPN or Direct Connect connection cannot use a gateway endpoint, so the on-premises uploads have no private path. An interface endpoint is needed for them. Learn more: Gateway endpoints for Amazon S3 (opens in a new tab)
D. Wrong: The gateway endpoint fixes the NAT gateway charges. Transfer Acceleration, though, sends uploads over the internet to the nearest edge location, which breaks the requirement not to use the internet, and it adds its own charges. An interface endpoint reached over the VPN keeps uploads private. Learn more: Configuring fast, secure file transfers using Amazon S3 Transfer Acceleration (opens in a new tab)

Explanation

The two traffic flows need different endpoint types. In-VPC traffic to S3 in the same Region should use a gateway endpoint, which has no extra charge and bypasses the NAT gateway's per-GB fee. On-premises clients cannot use a gateway endpoint, so they need an interface endpoint; the private DNS only for inbound endpoints setting keeps VPC traffic on the cheaper gateway endpoint. On-premises clients can reach the interface endpoint with endpoint-specific DNS names or a Route 53 Resolver inbound endpoint.

Study

Want more on Network and data transfer costs? The 5 full-length practice sets have 10 more Network and data transfer costs questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets