AWS Certified Sysops Administrator Associate · Free Practice Question Medium
Question 53
An organization has files stored across 100 Amazon S3 buckets in the same AWS Region. The company requires a cost-free solution to connect securely from its Amazon EC2 instances to the S3 buckets over a private network.
Which solution should be implemented to fulfill these requirements?
-
A
Create an interface VPC endpoint for all the S3 buckets and add it to the VPC route table.
-
B
Create a gateway VPC endpoint for all the S3 buckets and add it to the VPC route table.
-
C
Create an interface VPC endpoint for each S3 bucket and connect them to every subnet within the VPC.
-
D
Create a gateway VPC endpoint for each S3 bucket and associate them with each subnet in the VPC.
Reveal correct answer
Correct answer: B
Explanation
A Gateway VPC Endpoint is the correct solution for connecting securely over a private network connection from Amazon EC2 instances to Amazon S3 buckets. With this setup, you don't need a separate endpoint for each bucket, and since it uses prefix lists under the hood, traffic is routed based on the prefix list associated with S3 in your route table. It also incurs no additional costs.
CORRECT: "Create a gateway VPC endpoint for all the S3 buckets and add it to the VPC route table" is the correct answer (as explained above.)
INCORRECT: "Create a gateway VPC endpoint for each S3 bucket and associate them with each subnet in the VPC" is incorrect.
You don't need to create a gateway VPC endpoint for each S3 bucket. One is sufficient for all the buckets.
INCORRECT: "Create an interface VPC endpoint for each S3 bucket and connect them to every subnet within the VPC" is incorrect.
Interface VPC endpoints (powered by AWS PrivateLink) are not free and are charged per hour and per data processed. Moreover, S3 does not require an Interface VPC endpoint; a Gateway VPC endpoint is the appropriate choice.
INCORRECT: "Create an interface VPC endpoint for all the S3 buckets and add it to the VPC route table" is incorrect.
As per the previous explanation, a gateway VPC endpoint is the better choice.
References:
https://docs.aws.amazon.com/vpc/latest/privatelink/concepts.html
Save time with our AWS cheat sheets:
Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
