ExamPark
Course menuSAP-C03

Exams / SAP-C03 / Data transfer and network costs (NAT, endpoints, Transit Gateway, AZ-aware design) / Question 1

SAP-C03 practice question: Data transfer and network costs (NAT, endpoints, Transit Gateway, AZ-aware design)

Cost-Optimized Architecture Design A free question from our original SAP-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.

Last verified against current AWS documentation ·How we write our questions

A logistics firm runs about 200 container tasks in private subnets across three Availability Zones. The tasks read and write large files in an Amazon S3 bucket in the same Region, and their monthly data processing charges on the NAT gateways are now the largest line in the network bill.

The security team requires that the tasks have no public IP addresses and keep no internet route for their S3 traffic. The change must not require any application code change.

Which change meets these requirements at the LOWEST cost?

Choose one answer.

  1. A. Move the tasks into public subnets and give each one a public IP address, so the S3 traffic goes directly to the internet gateway.
  2. B. Add a second NAT gateway in each Availability Zone and split the private subnets between them, so that the NAT data processing is spread across more gateways.
  3. C. Create an interface VPC endpoint for S3 in each Availability Zone, with private DNS turned on, so that the tasks reach S3 through those endpoints with no application code change.
  4. D. Add an S3 gateway VPC endpoint and associate it with the private subnets' route tables, so S3 traffic stays on the AWS network without passing through the NAT gateways.
Show the answer and explanation

Answer: D

  • A. Wrong: Public addresses break the security team's rule that the tasks have no public IP addresses. The S3 traffic would also still cross the internet path.
  • B. Wrong: NAT gateways charge for each gigabyte processed no matter how many gateways carry it, so adding gateways does not reduce the processing charge. The option adds hourly charges as well.
  • C. Wrong: Interface endpoints charge hourly in each Availability Zone and for data processed. The gateway endpoint for S3 gives the same private path at no hourly charge.
  • D. Right: Correct. A gateway endpoint for S3 has no hourly charge, and the route tables send the S3 traffic to it, so NAT data processing charges for that traffic go away. The tasks keep their private addresses and need no code change.

Explanation

An S3 gateway endpoint keeps the S3 traffic private and removes the NAT data processing charge at no hourly cost, and the tasks stay private. Public addresses break the security rule, and interface endpoints or extra NAT gateways cost more for the same traffic.

A gateway VPC endpoint for S3 or DynamoDB beside a NAT gateway An application in a private subnet uses a route table. Traffic for the S3 or DynamoDB prefix list goes to a gateway endpoint, which is free and can carry an endpoint policy, and reaches the service over the AWS network. Any other internet traffic still goes through a NAT gateway. Private subnets Application private subnet Route table prefix list → endpoint Gateway endpoint free, endpoint policy NAT gateway other traffic only S3 or DynamoDB AWS network Internet
The tasks keep the NAT gateways for other traffic, while S3 reads and writes take the free gateway endpoint.

Study

Keep practicing

Answer questions with a score at the end, or practice just this topic with the explanation after each one. No sign-up needed.

Take the free SAP-C03 practice examPractice Data transfer and network costs (NAT, endpoints, Transit Gateway, AZ-aware design)All Data transfer and network costs (NAT, endpoints, Transit Gateway, AZ-aware design) questions

Want more on Data transfer and network costs (NAT, endpoints, Transit Gateway, AZ-aware design)? The 5 full-length practice sets have 6 more Data transfer and network costs (NAT, endpoints, Transit Gateway, AZ-aware design) questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets