AWS Certified CloudOps Engineer Associate SOA-C03 Practice Question

An operations team runs an Auto Scaling group of Linux EC2 instances in two private subnets (one in each Availability Zone) of a VPC. The instances must occasionally download patches from public YUM repositories and read data from an S3 bucket. Each subnet currently uses its own NAT gateway, and the hourly NAT gateway charges are higher than all data-processing fees combined. The team must lower network costs while ensuring that outbound connectivity continues if either Availability Zone becomes unavailable. Which solution meets these requirements while following AWS best practices?

Create a gateway VPC endpoint for Amazon S3 and replace each NAT gateway with a small NAT instance in the corresponding Availability Zone. Disable source/destination checks on the instances and update the private route tables to use the new NAT instances.
Attach an egress-only internet gateway to the VPC and add a default route from each private subnet to the gateway.
Remove the NAT gateways and create an interface VPC endpoint for AWS Systems Manager; configure Patch Manager to download updates through the endpoint.
Replace both NAT gateways with a single NAT gateway in one Availability Zone and point the default route of both private subnets to that gateway.

Report Issue

Answer Description

A gateway VPC endpoint lets instances access Amazon S3 without traversing a NAT device, removing that portion of the traffic from any hourly or data-processing charge. Replacing each managed NAT gateway with a small NAT instance in the same Availability Zone eliminates the NAT gateway hourly fee yet preserves zonal redundancy: if one AZ fails, instances in the surviving AZ still have a local NAT instance for internet-bound traffic. NAT instances cost less per hour than NAT gateways and support the required outbound access when sized for the workload.

A single shared NAT gateway lowers hourly cost but introduces cross-AZ data charges and creates a single point of failure, violating the availability requirement. An egress-only internet gateway only supports IPv6 traffic, so IPv4 YUM repository access would fail. An interface endpoint for Systems Manager does not provide general internet access and cannot reach public YUM repositories, so patching would be interrupted.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.