ExamPark
Course menuSAP-C03

Exams / SAP-C03 / Study guide / Data transfer and network costs (NAT, endpoints, Transit Gateway, AZ-aware design)

Data transfer and network costs (NAT, endpoints, Transit Gateway, AZ-aware design): SAP-C03 study notes and practice questions

What to know about Data transfer and network costs (NAT, endpoints, Transit Gateway, AZ-aware design) for the SAP-C03 exam, from the Cost-Optimized Architecture Design domain (15% of the exam guide), then 1 free question to test it. Part of the SAP-C03 study guide.

Last verified against current AWS documentation ·How we write our questions

What to know for the exam

SAP-C03 shows a bill where networking has grown faster than compute and asks which design change cuts it. You need to know which paths are charged and which are free.

What gets billed

  • Inbound data from the internet is free; outbound to the internet is charged per GB.
  • Cross-AZ traffic inside a Region is charged per GB in each direction. Traffic within one AZ over private IPs is free.
  • Inter-Region traffic is charged per GB by the sending Region, and costs more than cross-AZ traffic.
  • NAT gateways charge per hour and per GB processed, on top of any transfer charge.
  • Gateway VPC endpoints for S3 and DynamoDB have no charge and keep that traffic off the NAT gateway.
  • Interface endpoints (PrivateLink) charge per endpoint per AZ per hour plus per GB processed.
  • Transit Gateway charges per attachment per hour and per GB processed for traffic sent through it.
  • VPC peering has no hourly or processing charge; you pay only normal cross-AZ or inter-Region transfer.
  • Direct Connect data transfer out costs less per GB than internet egress, but port hours apply.

Design patterns that save money

  • Add S3 and DynamoDB gateway endpoints to every VPC that reaches those services from private subnets.
  • Put one NAT gateway per AZ and route each subnet to the NAT gateway in its own AZ, which is both resilient and avoids cross-AZ charges.
  • Centralizing interface endpoints in a shared services VPC behind Transit Gateway cuts endpoint hours when there are many VPCs, but adds Transit Gateway processing per GB; compare both for high-volume traffic.
  • Use VPC peering for a few high-throughput VPC pairs (such as an analytics VPC pulling large datasets) and Transit Gateway for broad any-to-any connectivity.
  • AZ-aware design: keep chatty tiers in the same AZ where availability allows, use load balancer settings that limit cross-zone traffic where it fits, and use topology-aware routing in EKS so pods prefer endpoints in their own AZ.
  • Read from replicas in the same AZ or Region as the reader instead of crossing Regions.
  • Compress, filter and aggregate before sending data across Regions.
  • Data Transfer Terminal lets you bring storage devices to an AWS location and upload large datasets over a fast local connection, instead of buying extra bandwidth or waiting weeks for a network transfer.

Finding the cost

VPC Flow Logs with Athena, Cost Explorer grouped by usage type (look for DataTransfer-Regional-Bytes and NatGateway-Bytes), and the CUR show which flows dominate. See cost monitoring.

How to choose

Scenario wording Pick
“Large NAT gateway bill, instances read from S3” S3 gateway endpoint
“Private access to an SaaS or another account’s service” PrivateLink interface endpoint
“Two VPCs exchange hundreds of TB a month” VPC peering instead of Transit Gateway
“Hundreds of VPCs need transitive routing” Transit Gateway, accept the per-GB processing
“Cross-AZ charges between app and cache” AZ-aware routing, same-AZ placement where safe
“Private subnets in three AZs share one NAT gateway” One NAT gateway per AZ

Common traps

  • Interface endpoints for S3 from inside the VPC when a free gateway endpoint does the job (interface endpoints for S3 are for on-premises or cross-Region access).
  • Assuming Transit Gateway is free to send data through.
  • Sending all traffic through a central inspection VPC when only some flows need inspection.
  • Single NAT gateway in one AZ: cross-AZ charges plus a single point of failure.
  • Replicating every dataset to every Region “just in case”.

Try the 1 practice question

Practice Data transfer and network costs (NAT, endpoints, Transit Gateway, AZ-aware design)Take the free practice exam

Question 1

Medium ·Link to this question (question 1)

A logistics firm runs about 200 container tasks in private subnets across three Availability Zones. The tasks read and write large files in an Amazon S3 bucket in the same Region, and their monthly data processing charges on the NAT gateways are now the largest line in the network bill.

The security team requires that the tasks have no public IP addresses and keep no internet route for their S3 traffic. The change must not require any application code change.

Which change meets these requirements at the LOWEST cost?

Choose one answer.

  1. A. Move the tasks into public subnets and give each one a public IP address, so the S3 traffic goes directly to the internet gateway.
  2. B. Add a second NAT gateway in each Availability Zone and split the private subnets between them, so that the NAT data processing is spread across more gateways.
  3. C. Create an interface VPC endpoint for S3 in each Availability Zone, with private DNS turned on, so that the tasks reach S3 through those endpoints with no application code change.
  4. D. Add an S3 gateway VPC endpoint and associate it with the private subnets' route tables, so S3 traffic stays on the AWS network without passing through the NAT gateways.
Show the answer and explanation

Answer: D

  • A. Wrong: Public addresses break the security team's rule that the tasks have no public IP addresses. The S3 traffic would also still cross the internet path.
  • B. Wrong: NAT gateways charge for each gigabyte processed no matter how many gateways carry it, so adding gateways does not reduce the processing charge. The option adds hourly charges as well.
  • C. Wrong: Interface endpoints charge hourly in each Availability Zone and for data processed. The gateway endpoint for S3 gives the same private path at no hourly charge.
  • D. Right: Correct. A gateway endpoint for S3 has no hourly charge, and the route tables send the S3 traffic to it, so NAT data processing charges for that traffic go away. The tasks keep their private addresses and need no code change.

Explanation

An S3 gateway endpoint keeps the S3 traffic private and removes the NAT data processing charge at no hourly cost, and the tasks stay private. Public addresses break the security rule, and interface endpoints or extra NAT gateways cost more for the same traffic.

A gateway VPC endpoint for S3 or DynamoDB beside a NAT gateway An application in a private subnet uses a route table. Traffic for the S3 or DynamoDB prefix list goes to a gateway endpoint, which is free and can carry an endpoint policy, and reaches the service over the AWS network. Any other internet traffic still goes through a NAT gateway. Private subnets Application private subnet Route table prefix list → endpoint Gateway endpoint free, endpoint policy NAT gateway other traffic only S3 or DynamoDB AWS network Internet
The tasks keep the NAT gateways for other traffic, while S3 reads and writes take the free gateway endpoint.

Study

Want more on Data transfer and network costs (NAT, endpoints, Transit Gateway, AZ-aware design)? The 5 full-length practice sets have 6 more Data transfer and network costs (NAT, endpoints, Transit Gateway, AZ-aware design) questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets

Study Data transfer and network costs (NAT, endpoints, Transit Gateway, AZ-aware design)

More Cost-Optimized Architecture Design topics