Your VPC consumes a third-party SaaS API. Security requires traffic never traverse the public internet — no NAT, no peering, no public IPs. What connects privately?
A.VPC peering to the vendor
Peering needs CIDR alignment and gives bidirectional access.
B.AWS PrivateLink — an interface endpoint to the provider's endpoint service
Correct. Consumer endpoint → provider service, all private.
C.A public hosted zone with private records
DNS tricks don't move traffic off the internet path.
D.Transit Gateway to the vendor's VPC
TGW requires trusting the vendor's network topology.
Why this answer
PrivateLink exposes a provider's service inside your VPC via an interface endpoint — unidirectional, private, no overlapping-CIDR issues (unlike peering). It's how AWS services and SaaS vendors offer private connectivity.
Correct answer: B · Last reviewed 2026-11-04
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Network Security practice session.
Practice Network Security