ExamworthyExamworthy
Open the appStart free

SAA-C03 - Design Cost-Optimized Architectures - Section 4.6

Reduce data transfer cost using VPC endpoints, Amazon CloudFront and Region and Availability Zone aware design.

Identify the main sources of AWS data transfer cost - cross-AZ traffic, NAT gateway processing, and internet egress - and apply patterns that reduce them. Use VPC endpoints (Gateway endpoints for S3 and DynamoDB are free) instead of NAT egress for AWS service calls, cache egress with Amazon CloudFront, and keep traffic within one Availability Zone where the saving justifies the lower resilience.

Data transfer costVPC endpointsAmazon CloudFrontNAT gateway cost

Practice question for this objective

Free sampleDesign Cost-Optimized Architectureshard

An analytics fleet runs on Amazon EC2 instances in private subnets in one Region. Throughout the day the instances move several terabytes of objects to and from an Amazon S3 bucket and also read and write heavily to an Amazon DynamoDB table, both in the same Region. All of this traffic currently leaves the private subnets through a NAT gateway, and the monthly bill is dominated by NAT gateway data processing charges for the S3 and DynamoDB traffic. The team must eliminate the per-gigabyte NAT charge for both the S3 and the DynamoDB traffic while keeping the instances private, and it does not want to add any new per-hour charge. Which two changes meet these requirements? Select TWO.

  • ACreate a gateway VPC endpoint for Amazon S3 and add its prefix list to the route tables of the private subnets so S3 traffic stays on the AWS network. Correct
  • BAttach an internet gateway and give the instances public IP addresses so the S3 and DynamoDB traffic reaches the public endpoints directly instead of crossing the NAT gateway.
  • CCreate a gateway VPC endpoint for Amazon DynamoDB and add its prefix list to the route tables of the private subnets so DynamoDB traffic stays on the AWS network. Correct
  • DCreate an interface VPC endpoint powered by AWS PrivateLink for Amazon S3 in each Availability Zone so the S3 traffic resolves to private endpoint network interfaces.
  • EReplace the single NAT gateway with one NAT gateway per Availability Zone so the data processing load is spread across more gateways and the charge falls.
Use the free gateway VPC endpoints for Amazon S3 and DynamoDB to remove NAT gateway data processing charges for same-Region traffic while instances stay private. Gateway VPC endpoints exist only for Amazon S3 and DynamoDB and route same-Region traffic through a route-table prefix list at no hourly or data processing charge, so the chargeable NAT gateway path is bypassed for both services. Interface endpoints add PrivateLink fees, more NAT gateways still bill per gigabyte, and public IPs violate the private requirement.

Why A is correct: A gateway VPC endpoint routes same-Region S3 traffic off the NAT path at no hourly or per-gigabyte charge, removing the NAT data processing fee for S3.

Why B is wrong: Public IPs would bypass the NAT gateway, but exposing the instances to the internet breaks the requirement to keep them private, so this is wrong.

Why C is correct: DynamoDB is one of only two services with a gateway endpoint, which carries no hourly or per-gigabyte fee and takes the DynamoDB traffic off the chargeable NAT path.

Why D is wrong: An interface endpoint for S3 works but adds a per-hour and per-gigabyte PrivateLink charge, breaking the no-new-per-hour-cost requirement when a free gateway endpoint exists.

Why E is wrong: Adding NAT gateways spreads load but the per-gigabyte data processing rate is charged on every gateway, so total cost does not fall and may rise.

See more SAA-C03 practice questions, answers explained.

More in this domain

Back to all Design Cost-Optimized Architectures objectives, or the SAA-C03 cert hub.

Examworthy is not affiliated with or endorsed by Amazon Web Services. Original, blueprint-aligned practice material only.