A SaaS company is launching a new product based in a cloud environment. The new product will be provided as an API and should not be exposed to the internet. Which of the following should the…

Question

Options

• AA transit gateway that connects the API to the customer's VPC
• BFirewall rules allowing access to the API endpoint from the customer's VPC
• CA VPC peering connection from the API VPC to the customer's VPC
• DA private service endpoint exposing the API endpoint to the customer's VPC

• A
  17% (6)
• B
  3% (1)
• C
  8% (3)
• D
  72% (26)

Explanation

A private service endpoint (also called a PrivateLink in AWS or Private Service Connect in GCP) allows a service provider to expose an API endpoint directly into a customer's VPC using private IP addressing, with no traffic traversing the public internet. This is purpose-built for the exact requirement described. A transit gateway (A) connects multiple VPCs or on-premises networks but is a broader routing construct, not specific to privately exposing a single service. Firewall rules (B) restrict traffic but do not inherently remove internet exposure - the endpoint would still be publicly reachable unless the architecture is redesigned. VPC peering (C) connects two VPCs entirely, giving broader network access rather than scoping exposure to a single service endpoint.

No community discussion yet for this question.