NAT gateway vs VPC endpoints: SAA-C03 cost scenarios

Where private-subnet egress quietly runs up a bill, and the endpoint that makes it disappear — gateway free, interface metered, NAT charged twice. Seven cost scenarios, SAA-C03, 2026 edition.

Try 7 free NAT-vs-endpoint cost scenarios in the exam's own style — every answer explained, no sign-up.

Straight to the 7 free questions ↓

Private-subnet egress is the cost line that hides in plain sight. A fleet reaches Amazon S3, everything works, and only the bill reveals that every gigabyte took a metered path it never needed. The SAA-C03 tests whether you know where that charge comes from and which endpoint makes it vanish — without reciting a single price.

Why the NAT gateway is the wrong meter for S3

A NAT gateway bills two ways: an hourly charge for running it, and a per-gigabyte data-processing charge on everything that flows through. That model is fine for its real job — giving private instances outbound internet access for patches or third-party APIs. It is wasteful for AWS-service traffic like S3 or DynamoDB, because that traffic can stay on AWS’s own network entirely, yet through NAT it is metered by the gigabyte and pushed out over the public internet on the way.

The free path: gateway endpoints

A gateway VPC endpoint adds a route-table target for S3 or DynamoDB — and only those two services. It carries no hourly charge and no per-gigabyte charge: it is free. Move bulk S3 or DynamoDB traffic onto it and the NAT data-processing charge for that traffic simply disappears. The diagram contrasts the two routes out of one private subnet: the charged NAT path and the free gateway-endpoint path to the same bucket.

The metered path: interface endpoints (PrivateLink)

Most AWS services — SQS, Secrets Manager, Systems Manager, KMS, and the rest — have no gateway endpoint. Their private path is an interface endpoint, an AWS PrivateLink elastic network interface placed in your subnets. It bills per hour for each Availability Zone it lives in, plus per gigabyte. That is cheaper and more private than routing the same calls through NAT, but it is not free — assuming it is is the exam’s favourite cost trap. Interface endpoints also reach private SaaS offered over PrivateLink, which a gateway endpoint cannot do.

The decision, as the exam frames it

Traffic to S3 or DynamoDB? Use the gateway endpoint — free, so it wins on cost outright.
Traffic to another AWS service or a PrivateLink SaaS? Use an interface endpoint — metered, but cheaper and private versus NAT.
Genuinely internet-bound (OS patches, arbitrary public APIs)? That is the NAT gateway’s real job — keep it for exactly that, and nothing more.

The recurring distractor routes AWS-service traffic through NAT “because it already works” or “because it is already there.” Sunk infrastructure is not a reason to keep paying per gigabyte: the requirement word is most cost-effective, and a free gateway endpoint beats a charged path every time it is available. A second trap forces an interface endpoint on S3, adding a per-gigabyte charge the free gateway endpoint avoids — the gateway-versus-interface distinction the exam keeps probing.

Cost first, privacy for free

Note the side benefit that never costs extra: a gateway endpoint keeps S3 traffic on the AWS private network, off the public internet. That is a real security gain, but it is a bonus riding on a cost decision — it does not encrypt objects, change durability, or alter request pricing. Keep the claim honest and the answer stays right.

How to use the seven scenarios below

Answer each before opening the explanation, and when you miss, name where the charge was arising — “NAT per gigabyte”, “interface per-AZ hour”, “free gateway endpoint left unused”. Every explanation states that cost source and dismantles the distractors, most of which are real controls billed on the wrong path. For the domain overview, see Design Cost-Optimized Architectures.

A private subnet with two routes to Amazon S3. The expensive route sends S3-bound traffic through a NAT gateway in a public subnet, which bills both an hourly charge and a per-gigabyte data-processing charge, then out over the public internet. The free route sends the same traffic through a gateway VPC endpoint for S3, which adds no hourly and no per-gigabyte charge and keeps traffic on the AWS private network. A note shows that other AWS services such as SQS or Secrets Manager, and private SaaS over PrivateLink, use interface endpoints, which bill per hour per Availability Zone plus per gigabyte.

7 free SAA-C03 practice questions

Answers and explanations — no email wall

SAA-C03 Question 1 of 7

A solutions architect is asked why a NAT gateway is an expensive path for a private-subnet fleet that pulls large volumes from Amazon S3. Which pair of charges makes the NAT gateway costly for this traffic?

Answer: A — An hourly charge for the gateway plus a per-gigabyte data-processing charge on everything it handles.

A NAT gateway bills two ways: an hourly charge for each gateway it runs, and a per-gigabyte data-processing charge on every gigabyte that passes through it — so high-volume S3 traffic is metered by the gigabyte on a path it never needed to take. Why not the others: there is no one-time provisioning fee and the cost is not limited to the Elastic IP; data processing is charged, not free; and the bill is emphatically not flat — volume is exactly what drives it. The per-gigabyte processing charge is why routing bulk S3 traffic through NAT is the wrong cost decision.

SAA-C03 Question 2 of 7

A batch job in a private subnet writes tens of terabytes to Amazon DynamoDB each month, currently routed through a NAT gateway. The requirement is the most cost-effective path for this AWS-service traffic. What should the architect recommend?

Answer: A — Create a gateway VPC endpoint for DynamoDB and route DynamoDB traffic to it — it adds no hourly and no per-gigabyte charge.

DynamoDB is one of the two services with a gateway VPC endpoint, and a gateway endpoint carries no hourly charge and no per-gigabyte charge — the terabytes stop being metered the moment they leave the NAT path. Why not the others: DynamoDB has no interface endpoint to choose, and an interface endpoint would add per-gigabyte cost anyway rather than remove it; a second NAT gateway multiplies the charge instead of avoiding it; and public IPs re-expose the instances while still routing over a charged path. Bulk S3 or DynamoDB traffic belongs on the free gateway endpoint.

SAA-C03 Question 3 of 7

An application in a private subnet calls Amazon SQS and AWS Secrets Manager privately and does high message volume. The team wants to keep this off the NAT gateway but needs to budget for the alternative. How does an interface endpoint (AWS PrivateLink) bill?

Answer: A — Per hour for each Availability Zone the endpoint is provisioned in, plus a per-gigabyte data-processing charge.

An interface endpoint is a PrivateLink elastic network interface: it bills per hour for each Availability Zone it is provisioned in, plus a per-gigabyte data-processing charge on traffic through it. Why not the others: not all endpoints are free — only the gateway endpoints for S3 and DynamoDB are, and assuming an interface endpoint is free is the trap this tests; the hourly charge scales with the number of Availability Zones, so it is not a single flat rate; and there is an hourly component, not a request-only charge. Interface endpoints are metered — cheaper and more private than NAT for these services, but not free.

SAA-C03 Question 4 of 7

A workload in private subnets needs private access to Amazon S3 (very high volume) and to AWS Systems Manager (low volume). The team wants the lowest cost for each. Which endpoint choice is correct?

Answer: A — A gateway endpoint for S3, and an interface endpoint for Systems Manager.

Gateway endpoints exist only for S3 and DynamoDB, and they are free — so S3's very high volume rides the gateway endpoint at no per-gigabyte cost. Systems Manager has no gateway endpoint, so its private path is an interface endpoint, whose metered cost is trivial at low volume. Why not the others: forcing an interface endpoint on S3 would add a per-gigabyte charge the free gateway endpoint avoids; there is no gateway endpoint for Systems Manager to create; and putting both on a NAT gateway pays the per-gigabyte processing charge on the heavy S3 flow needlessly. Match the service to the endpoint type it actually supports, then let 'free' win where it is offered.

SAA-C03 Question 5 of 7

A team already runs a NAT gateway for occasional OS patching and proposes leaving all Amazon S3 traffic on it 'because the NAT gateway is already there.' The S3 traffic is large and steady. From a cost standpoint, what should the architect advise?

Answer: A — Add a gateway VPC endpoint for S3 so the large S3 flow bypasses the NAT gateway's per-gigabyte processing charge; keep NAT only for the internet-bound patch traffic.

The NAT gateway existing does not make its per-gigabyte processing charge free — every gigabyte of S3 still meters. A gateway endpoint for S3 is free and removes that charge, while the NAT gateway stays for the genuinely internet-bound patch traffic it is needed for. Why not the others: the endpoint does not duplicate the NAT path, it replaces a charged path with a free one for S3; a gateway endpoint cannot carry the OS-patch traffic to the public internet, so the NAT gateway cannot be removed outright; and there is no self-service 'volume discount' toggle — the architectural fix is the endpoint. Sunk infrastructure is not a reason to keep paying per gigabyte.

SAA-C03 Question 6 of 7

An architect recommends a gateway VPC endpoint for S3 primarily to cut the NAT data-processing bill. A reviewer asks what else changes. Which additional benefit is correct?

Answer: A — S3 traffic stays on the AWS private network and never traverses the public internet — a security and privacy gain that comes at no extra cost.

A gateway endpoint routes S3 traffic over AWS's private network instead of out through NAT and across the public internet — so the cost win comes bundled with a privacy win, and the endpoint itself is free. Why not the others: the endpoint governs the network path, not object encryption at rest, which is an S3 setting; it does not change S3's durability, which is a property of the storage service; and it does not alter S3 request pricing — it removes the NAT data-processing charge, not the API charge. Cheaper and more private is the honest summary; the other options claim capabilities the endpoint does not have.

SAA-C03 Question 7 of 7

Instances in a private subnet must reach a third-party SaaS analytics service privately, without egress over the public internet, at predictable cost. The vendor exposes the service through AWS PrivateLink. What should the architect use?

Answer: A — An interface VPC endpoint to the provider's PrivateLink service.

PrivateLink to a third-party service is consumed through an interface endpoint — an elastic network interface in your subnets that reaches the provider privately, billed per hour per Availability Zone plus per gigabyte. Why not the others: gateway endpoints exist only for S3 and DynamoDB and cannot point at a SaaS provider; a NAT gateway would send the traffic over the public internet, defeating the 'private' requirement and still charging per gigabyte; and an S3 gateway endpoint is bound to S3 and cannot carry unrelated SaaS traffic. Private access to another party's service means an interface endpoint over PrivateLink.

That is exactly how every question in the course works — answer, explanation, why-not. The real set continues in the practice player: 10 free questions, no sign-up.

Continue with the 10 free questions →

Those 7 questions were the start.

The exam does not test whether you recognise a term — it tests whether you can rule out three plausible answers under time pressure. That is what the explanations above are for, and there are 780 more questions built exactly like them.

Collecting questions yourself

Scattered across forums, of unknown age
Answer keys without reasoning
No idea which domain you are weak in

Practising with a system

780 questions in 12 full tests, SAA-C03 (2026)
Every option explained — including the wrong ones
Readiness per exam domain, and drills for your weakest

Start free — 10 questions

Straight into the player. No account, no email.

Frequently asked questions

Gateway endpoint or interface endpoint — how do I choose?

Service and cost decide it. Gateway endpoints exist only for Amazon S3 and DynamoDB and are free, so they are the default for those two. Every other AWS service, and private SaaS over PrivateLink, uses an interface endpoint, which bills per hour per Availability Zone plus per gigabyte. Prefer the free gateway endpoint wherever the service offers one; use an interface endpoint when it does not.

Is a gateway VPC endpoint really free?

Yes. A gateway endpoint for S3 or DynamoDB adds no hourly charge and no per-gigabyte data-processing charge — that is precisely why moving bulk S3 or DynamoDB traffic off a NAT gateway and onto a gateway endpoint removes the NAT per-gigabyte bill. Interface endpoints, by contrast, are metered.

Are these real exam questions?

No. They are original scenarios written for this page in the exam's style and difficulty. Reproducing real exam items violates the AWS certification agreement and can cost a candidate their certification — ours come with the reasoning attached instead.

Updated for SAA-C03 (July 2026). The sample questions above are our own work in the style of the exam — not real exam items. The exam itself is set and marked by the certification body.