SAP-C02 Question 241
Single answerA company has deployed an application in a private subnet within a VPC. The application needs to access an Amazon S3 bucket in the same AWS Region to store and retrieve data. The company wants to minimize latency, ensure traffic does not traverse the public internet, and avoid the need for a NAT Gateway. Which solution should you recommend?
- A
Enable VPC endpoints for Amazon S3 and update the route table for the private subnet to point to the endpoint.
- B
Deploy a NAT Gateway in the public subnet and route traffic from the private subnet to the NAT Gateway.
- C
Use S3 Transfer Acceleration to improve data transfer performance between the private subnet and the S3 bucket.
- D
Configure a VPN connection from the private subnet to Amazon S3.
Show answer and explanation
Correct answer: A
Explanation
The most suitable solution is to use a VPC endpoint for Amazon S3, which allows private communication between the application in the private subnet and S3 without traversing the public internet. This reduces latency, enhances security, and eliminates the need for a NAT Gateway, aligning with the company's requirements.
- A. Correct.
This is the correct option. Enabling a VPC endpoint for Amazon S3 allows the private subnet to communicate with S3 over AWS's private network, avoiding the public internet, reducing latency, and removing the need for a NAT Gateway.
- B. Incorrect.
This option works but does not meet the requirement of avoiding the public internet. A NAT Gateway routes traffic to the public internet and adds extra costs.
- C. Incorrect.
S3 Transfer Acceleration is designed to speed up transfers over long distances by leveraging edge locations, but it requires public internet access and is not suitable for this use case.
- D. Incorrect.
Amazon S3 does not support VPN connections directly. This option is invalid and not applicable.