SAA-C03 practice question 2 of 35

A company has a VPC with multiple private subnets that host multiple applications. The applications must not be accessible to the internet. However…

Choose your answer, then check it against the explanation and the full breakdown below.

Domain Design Secure Architectures

A company has a VPC with multiple private subnets that host multiple applications. The applications must not be accessible to the internet. However, the applications need to access multiple AWS services. The applications must not use public IP addresses to access the AWS services. Which solution will meet these requirements MOST cost-effectively?

Answer options

Correct Answer:

Explanation

The most cost-effective and secure solution is to use VPC endpoints. Interface VPC endpoints, powered by AWS PrivateLink, enable private connections between a VPC and supported AWS services without requiring an internet gateway, NAT gateway, or public IP addresses. Traffic between the VPC and the AWS service does not leave the Amazon network. This directly fulfills the requirements of keeping applications inaccessible from the internet while allowing them to privately and securely access other AWS services. While there are costs associated with interface endpoints (hourly and data processing), this is the only option that meets all technical requirements.

Why Incorrect

B. A NAT gateway enables instances in a private subnet to connect to the internet. Traffic to AWS services would traverse the public internet, which violates the requirement to not use public IP addresses.

C. An internet gateway is attached to a VPC to enable communication with the internet. Using one would expose the subnets to the internet, violating a core security requirement of the scenario.

D. AWS Direct Connect establishes a dedicated private connection from an on-premises network to AWS. It is not used for communication from a VPC to AWS services within the same region.

References

1. AWS Documentation - VPC Endpoints: "An interface endpoint is an elastic network interface with a private IP address that serves as an entry point for traffic destined to a supported AWS service... AWS PrivateLink provides private connectivity between VPCs

AWS services

and your on-premises networks

without exposing your traffic to the public internet." (AWS Documentation

VPC User Guide

Section: "VPC endpoints"

Subsection: "Interface endpoints").

2. AWS Documentation - NAT Gateways: "You can use a network address translation (NAT) gateway to enable instances in a private subnet to connect to the internet or other AWS services

but prevent the internet from initiating a connection with those instances." (AWS Documentation

VPC User Guide

Section: "NAT gateways"). This confirms that NAT gateways route traffic over the internet.

3. AWS Whitepaper - AWS Security Best Practices: "To further improve your security posture

you can use AWS PrivateLink to privately access AWS services from your Amazon VPC in a scalable manner... This connection does not traverse the internet." (AWS Whitepaper: AWS Security Best Practices

August 2020

Page 27).

4. AWS Documentation - AWS Direct Connect: "AWS Direct Connect is a cloud service solution that makes it easy to establish a dedicated network connection from your premises to AWS." (AWS Documentation

AWS Direct Connect User Guide

Section: "What is AWS Direct Connect?"). This clarifies its primary use case is for hybrid connectivity

not intra-AWS communication from a VPC.

Question 2 of 35

Question breakdown

Tests: Private connectivity from VPC to AWS services
Difficulty: Easy

Key idea: VPC endpoints let resources in private subnets reach AWS services over private IPs without an internet gateway or NAT.

How to reach the answer

Clue: 'must not use public IP addresses to access the AWS services' rules out any internet-bound path.
NAT gateways and internet gateways both send traffic to public service endpoints.
Direct Connect links on-premises networks to AWS and does not address VPC-to-service access.
Interface endpoints (PrivateLink) give private ENIs for each service, satisfying all constraints.

Each option

ACorrect. Interface endpoints provide private IP access to AWS services without exposing the subnets to the internet.
BIncorrect. NAT gateways sit in public subnets and route traffic to services' public endpoints, and one per private subnet adds needless cost.
CIncorrect. Internet gateways attach to the VPC, not subnets, and routing through one makes the subnets public.
DIncorrect. Direct Connect connects on-premises networks to AWS, not subnets to each other or to AWS services.

Common trap: Thinking a NAT gateway keeps traffic private because instances stay unreachable inbound; outbound traffic still uses public IPs.

In practice: Locked-down workloads commonly use interface endpoints for services like SSM, Secrets Manager, and ECR, plus free gateway endpoints for S3 and DynamoDB where available.

Remember: Need AWS service access with no public IPs or internet path: use VPC endpoints.

Official documentation: Access an AWS service using an interface VPC endpoint

Drafted with AI assistance and checked against the answer key.

Keep practicing

Take the free SAA-C03 practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test