AWS Certified Advanced Networking – Specialty ANS-C00 – Question390

A company uses multiple AWS accounts within AWS Organizations and has services deployed in a single AWS Region. The instances in a private subnet occasionally download patches from the internet through a NAT gateway. The company recently migrated from VPC peering to AWS Transit Gateway. The cumulative traffic through deployed NAT gateways is less than 1 Gbps. The NAT gateway hourly charge contributes to most of the NAT gateway costs across all inked accounts.
What should the company do to reduce NAT gateway hourly costs?

A.
Deploy and use NAT gateways in the same Availability Zone as the heavy-traffic resources.
B. Move to a centralized NAT gateway architecture with NAT gateways deployed in an egress VPC. Use VPC peering to send traffic through the centralized NAT gateways.
C. Use VPC endpoints to send traffic to AWS services in the same Region.
D. Move to a centralized NAT gateway architecture with NAT gateways deployed in an egress VPC. Use AWS Transit Gateway to send traffic through the centralized NAT gateways.

Correct Answer: C

Explanation:

Explanation:
This is located in a dedicated VPC with AWS service VPC endpoints and a Route 53 Resolver endpoint.
Each workload VPC in the same Region connects to this VPC over Transit Gateway. All instances send their HTTP traffic to the proxies. The proxies manage resolving domain names and forwarding the traffic to the correct Region. Here, each Route 53 Resolver supports inbound DNS requests from other VPCs.
Reference: https://aws.amazon.com/blogs/architecture/using-vpc-endpoints-in-multi-region-architectures-with-route-53-resolver/