SAA-C03 - Design Cost-Optimized Architectures (20% of the exam) - Section 4.6

Reduce data transfer cost using VPC endpoints, Amazon CloudFront and Region and Availability Zone aware design.

Identify the main sources of AWS data transfer cost - cross-AZ traffic, NAT gateway processing, and internet egress - and apply patterns that reduce them. Use VPC endpoints (Gateway endpoints for S3 and DynamoDB are free) instead of NAT egress for AWS service calls, cache egress with Amazon CloudFront, and keep traffic within one Availability Zone where the saving justifies the lower resilience.

Data transfer costVPC endpointsAmazon CloudFrontNAT gateway cost

Practice question for this objective

Free sampleDesign Cost-Optimized Architectureshard

An analytics fleet runs on Amazon EC2 instances in private subnets in one Region. Throughout the day the instances move several terabytes of objects to and from an Amazon S3 bucket and also read and write heavily to an Amazon DynamoDB table, both in the same Region. All of this traffic currently leaves the private subnets through a NAT gateway, and the monthly bill is dominated by NAT gateway data processing charges for the S3 and DynamoDB traffic. The team must eliminate the per-gigabyte NAT charge for both the S3 and the DynamoDB traffic while keeping the instances private, and it does not want to add any new per-hour charge. Which two changes meet these requirements? Select TWO.

ACreate a gateway VPC endpoint for Amazon S3 and add its prefix list to the route tables of the private subnets so S3 traffic stays on the AWS network. Correct
BAttach an internet gateway and give the instances public IP addresses so the S3 and DynamoDB traffic reaches the public endpoints directly instead of crossing the NAT gateway.
CCreate a gateway VPC endpoint for Amazon DynamoDB and add its prefix list to the route tables of the private subnets so DynamoDB traffic stays on the AWS network. Correct
DCreate an interface VPC endpoint powered by AWS PrivateLink for Amazon S3 in each Availability Zone so the S3 traffic resolves to private endpoint network interfaces.
EReplace the single NAT gateway with one NAT gateway per Availability Zone so the data processing load is spread across more gateways and the charge falls.

Use the free gateway VPC endpoints for Amazon S3 and DynamoDB to remove NAT gateway data processing charges for same-Region traffic while instances stay private. Gateway VPC endpoints exist only for Amazon S3 and DynamoDB and route same-Region traffic through a route-table prefix list at no hourly or data processing charge, so the chargeable NAT gateway path is bypassed for both services. Interface endpoints add PrivateLink fees, more NAT gateways still bill per gigabyte, and public IPs violate the private requirement.

Why A is correct: A gateway VPC endpoint routes same-Region S3 traffic off the NAT path at no hourly or per-gigabyte charge, removing the NAT data processing fee for S3.

Why B is wrong: Public IPs would bypass the NAT gateway, but exposing the instances to the internet breaks the requirement to keep them private, so this is wrong.

Why C is correct: DynamoDB is one of only two services with a gateway endpoint, which carries no hourly or per-gigabyte fee and takes the DynamoDB traffic off the chargeable NAT path.

Why D is wrong: An interface endpoint for S3 works but adds a per-hour and per-gigabyte PrivateLink charge, breaking the no-new-per-hour-cost requirement when a free gateway endpoint exists.

Why E is wrong: Adding NAT gateways spreads load but the per-gigabyte data processing rate is charged on every gateway, so total cost does not fall and may rise.

See more SAA-C03 practice questions, answers explained.

Exam traps in Design Cost-Optimized Architectures

Answers that look right on this material and are not. Each one is a distractor from a different question in the SAA-C03 bank for this domain.

Keep the single NAT gateway but enlarge it and route all three private subnets to it, since a larger NAT gateway eliminates the inter-Availability-Zone charge for the traffic crossing into its zone.
Why it is wrong: NAT gateway size does not change data transfer billing; cross-zone traffic to a single NAT gateway is still charged per gigabyte and a single-zone NAT remains a failure point, so this fixes neither cost nor resilience.
Move the cache tier into a single Availability Zone and point all web tier nodes at it so the chatty traffic no longer crosses any Availability Zone boundary at all.
Why it is wrong: Collapsing the cache into one Availability Zone removes cross-zone charges but destroys the multi-Availability Zone resilience the requirement says must be preserved, so it is not acceptable.
Create an interface VPC endpoint for DynamoDB in each subnet and route the instances to it, accepting the hourly endpoint and data processing charges in exchange for private connectivity.
Why it is wrong: DynamoDB is reached through a gateway endpoint, which has no hourly or data processing fee; an interface endpoint would add charges this requirement explicitly tries to avoid and is not the standard pattern for DynamoDB.

Examworthy is not affiliated with or endorsed by Amazon Web Services. Original, blueprint-aligned practice material only.