nerdexam
Amazon

SAA-C03 · Question #193

A solutions architect is designing the network architecture for an application that runs on Amazon EC2 instances in an Auto Scaling group. The application needs to access data that is in Amazon S3 buc

The correct answer is B. Deploy the EC2 instances in a public subnet. Create a gateway endpoint for Amazon S3. D. Deploy the EC2 instances in a private subnet. Configure a default route to a NAT gateway in a. Option B: A gateway endpoint for S3 allows traffic to S3 without using public IPs and integrates with route tables. Option D: Deploying EC2 instances in a private subnet with a NAT gateway enables outbound internet connectivity for other requirements without public IPs. Option A:

Submitted by minji_kr· Mar 4, 2026Design Secure Architectures

Question

A solutions architect is designing the network architecture for an application that runs on Amazon EC2 instances in an Auto Scaling group. The application needs to access data that is in Amazon S3 buckets. Traffic to the S3 buckets must not use public IP addresses. The solutions architect will deploy the application in a VPC that has public and private subnets. Which solutions will meet these requirements? (Select TWO.)

Options

  • ADeploy the EC2 instances in a private subnet. Configure a default route to an egress-only internet
  • BDeploy the EC2 instances in a public subnet. Create a gateway endpoint for Amazon S3.
  • CDeploy the EC2 instances in a public subnet. Create an interface endpoint for Amazon S3.
  • DDeploy the EC2 instances in a private subnet. Configure a default route to a NAT gateway in a
  • EDeploy the EC2 instances in a private subnet. Configure a default route to a customer gateway.

How the community answered

(49 responses)
  • A
    24% (12)
  • B
    59% (29)
  • C
    4% (2)
  • E
    12% (6)

Explanation

Option B: A gateway endpoint for S3 allows traffic to S3 without using public IPs and integrates with route tables. Option D: Deploying EC2 instances in a private subnet with a NAT gateway enables outbound internet connectivity for other requirements without public IPs. Option A: Egress-only internet gateways are for IPv6 traffic and do not work for IPv4 in this Option C: Interface endpoints are not required for S3 as gateway endpoints are more suitable and Option E: A customer gateway is for hybrid connectivity (e.g., on-premises), not suitable for this

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full SAA-C03 Practice