VPC endpoints let your VPC reach AWS services privately, and the exam tests the two types and which services use each.
The two types
Gateway endpoints work only for S3 and DynamoDB, are free, and are added as a route-table entry. Interface endpoints (powered by PrivateLink) work for most other services and place an elastic network interface with a private IP in your subnet (small hourly cost). S3/DynamoDB private access → gateway endpoint; almost anything else → interface endpoint.
Test yourself
You need private access from your VPC to Amazon S3 with no hourly cost and no traffic over the internet. Which endpoint type?
- Interface endpoint
- Gateway endpoint
- NAT gateway
- Internet gateway
👉 Click to reveal the answer & explanation
Correct answer: B. A Gateway endpoint provides free private access to S3 (and DynamoDB) via a route-table entry. An Interface endpoint (A) works for S3 too but incurs hourly cost; NAT (C) and Internet gateways (D) route over the internet.
Related topics
VPC endpoints · AWS PrivateLink · Amazon S3
Ready to pass the AWS Solutions Architect Associate (SAA-C03)?
Stop guessing whether you’re ready. Our full-length, exam-realistic practice exams put you through the exact question style you’ll face — with a detailed explanation behind every answer, so you learn why, not just what.
- ✓ 6 full-length practice exams
- ✓ A detailed explanation for every single question
- ✓ Realistic, scenario-based questions — not memory dumps
- ✓ Lifetime access, kept current for 2026
Get the SAA-C03 Practice Exams →or try 25 free questions first