SAA-C03 Q409 · Networking

Question

A company has applications that run on Amazon EC2 instances in a VPC. One of the applications needs to call the Amazon S3 API to store and read objects. According to the company's security regulations, no traffic from the applications is allowed to travel across the internet. Which solution will meet these requirements?

Accepted Answer

**Option A: Configure an S3 gateway endpoint** is correct because:

1. **Requirement**: EC2 instances must access S3 **without traffic traveling across the internet**.
2. **How a Gateway Endpoint solves this**: A VPC Gateway Endpoint creates a **private route** from your VPC directly to Amazon S3 through AWS's internal network. Traffic never leaves the AWS backbone network.
3. **Mechanism**: When you create an S3 gateway endpoint, AWS adds a route entry in your VPC route table(s) that directs S3-destined traffic (the S3 prefix list) to the endpoint. The EC2 instance's request to S3 is routed internally within AWS — no internet gateway, no NAT gateway, no public IP needed.
4. **Security**: This perfectly satisfies the security regulation because traffic stays entirely within AWS's private n

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

💰 Cost

🔒 Security

🎯 Exam Tips