Exam AWS Certified Solutions Architect - Associate SAA-C02 topic 1 question 409 discussion

Exam question from Amazon's AWS Certified Solutions Architect - Associate SAA-C02

Question #: 409
Topic #: 1

[All AWS Certified Solutions Architect - Associate SAA-C02 Questions]

A company has several Amazon EC2 instances set up in a private subnet for security reasons. These instances host applications that read and write large amounts of data to and from Amazon S3 regularly. Currently, subnet routing directs all the traffic destined for the internet through a NAT gateway. The company wants to optimize the overall cost without impacting the ability of the application to communicate with Amazon S3 or the outside internet.
What should a solutions architect do to optimize costs?

A. Create an additional NAT gateway. Update the route table to route to the NAT gateway. Update the network ACL to allow S3 traffic.
B. Create an internet gateway. Update the route table to route traffic to the internet gateway. Update the network ACL to allow S3 traffic.
C. Create a VPC endpoint for Amazon S3. Attach an endpoint policy to the endpoint. Update the route table to direct traffic to the VPC endpoint.
D. Create an AWS Lambda function outside of the VPC to handle S3 requests. Attach an IAM policy to the EC2 instances, allowing them to invoke the Lambda function.

Show Suggested Answer

Suggested Answer: C 🗳️

by dmscountera at March 11, 2021, 7:21 p.m.

Disclaimers:

- ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
- Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Submit Cancel

dmscountera

Highly Voted 3 years, 8 months ago

C. Create a VPC endpoint for Amazon S3. Attach an endpoint policy to the endpoint. Update the route table to direct traffic to the VPC endpoint.

upvoted 35 times

...

moses101

Highly Voted 3 years, 8 months ago

agree with C!

upvoted 5 times

...

cloud_collector

Most Recent 2 years, 10 months ago

C should be right. Gateway endpoints provide reliable connectivity to Amazon S3 and DynamoDB without requiring an internet gateway or a NAT device for your VPC. Gateway endpoints do not enable AWS PrivateLink. There is no additional charge for using gateway endpoints. https://docs.aws.amazon.com/vpc/latest/privatelink/gateway-endpoints.html

upvoted 2 times

...

Megh96

3 years ago

Selected Answer: C

C is right

upvoted 2 times

...

jack4090

3 years, 6 months ago

C. VPC endpoint supports "S3, DynamoDB"

upvoted 4 times

...

tezawynn

3 years, 7 months ago

NAT Gateway is for VPC to VPC or to OnPremise. you dont use internet gateway. its not connecting to internet. You are connecting to a S3 resource. you need VPC endpoint for this. D is just plain stupid.

upvoted 3 times