How to Invoke a Private API Gateway API via Direct Connect?

ANS-C01 By islever Editorial Last updated

Short answer

D Create an interface VPC endpoint for API Gateway with private DNS names enabled. Access the API by using the public DNS name of the endpoint.

Question

A company is developing an API-based application on AWS for its process workflow requirements. The API will be invoked by clients in the company’s on-premises data centers. The company has set up an AWS Direct Connect connection between on premises and AWS. A network engineer decides to implement the API as a private REST API in Amazon API Gateway. The network engineer wants to ensure that clients can reach the API endpoint through private communication. Which solution can the network engineer use to invoke the API without any additional infrastructure setup?
  1. Create an interface VPC endpoint for API Gateway with private DNS names enabled. Access the API by using the private DNS name of the endpoint.
  2. Create an interface VPC endpoint for API Gateway with private DNS names enabled. Access the API by using an Amazon Route 53 alias of the endpoint.
  3. Create an interface VPC endpoint for API Gateway. Associate the endpoint with the private REST API, Access the API by using an Amazon Route 53 alias of the endpoint.
  4. Create an interface VPC endpoint for API Gateway with private DNS names enabled. Access the API by using the public DNS name of the endpoint. Correct Answer

Key Takeaways

This question tests your understanding of how private API Gateway endpoints behave over Direct Connect: the private connection is established by the VPC endpoint, but the DNS resolution still uses the public DNS name of the API, so enabling private DNS alone is not sufficient for on-premises access.

For invoking a private REST API in Amazon API Gateway from on-premises over AWS Direct Connect, the correct approach is to create an interface VPC endpoint with private DNS names enabled and access the API using its public DNS name. Community consensus (67 votes) confirms option D, as it avoids additional infrastructure like Route 53 or inbound endpoints.

Common mistake: Choosing option A is the most common mistake because it assumes private DNS names must be used for private communication. However, in a Direct Connect scenario, AWS documentation explicitly states that you invoke the private API using public DNS names; private DNS names are not used across Direct Connect, and setting up Route 53 aliases (options B and C) would require additional infrastructure, which the question disallows.

Expert Analysis

Why the Answer Is Correct

Option D is correct because it aligns with AWS documentation on invoking a private API using AWS Direct Connect. When you create an interface VPC endpoint for API Gateway, you enable private DNS names so that the public DNS name of the API resolves to the private endpoint inside the VPC. Over Direct Connect, clients can then use that public DNS name to reach the private API without needing additional infrastructure like Route 53 alias records or inbound endpoints. This is exactly what the question asks: "without any additional infrastructure setup."

Why the Other Options Are Wrong

Options A and B are incorrect because they suggest using the private DNS name or a Route 53 alias, which require either the traffic to originate from within the VPC or a custom DNS configuration. For Direct Connect, the documented method is to use the public DNS name of the API endpoint, as noted in the AWS documentation cited by community comments. Option C is also incorrect because it omits enabling private DNS names, which is necessary for the public DNS name to resolve to the VPC endpoint, and it still uses a Route 53 alias, adding unnecessary setup.

Community Comment Notes

Several comments correctly point to the AWS documentation link: "Invoke a private API using AWS Direct Connect" (comments 3 and 5). One comment specifically highlights that "Only through inbound endpoints will we be able to use private DNS," which emphasizes why private DNS alone isn't the answer for on-premises access. Another comment (option A) misunderstands the requirement, suggesting private DNS names are needed, but the consensus and AWS docs favor option D. The key distinction is that the VPC endpoint provides the private connectivity, not the DNS name itself.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When answering questions about private APIs and Direct Connect, remember that the VPC endpoint supplies the private network path, while DNS resolution for on-premises clients still uses the API's public DNS name over that private connection. Look for wording that says "without additional infrastructure" — that rules out Route 53 aliases and any extra components.

Community Votes

D
75%
A
25%

75% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 7 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 7

  1. 304faa7 👍 5 Answered D
    D is the correct answer here as we don't want to setup additional infra(inbound endpoints) here as asked in the question. Only through inbound endpoints we will be able to use private DNS. Below is from AWS documentation : its a tricky question. Invoke a private API using AWS Direct Connect You can use AWS Direct Connect to establish a dedicated private connection from an on-premises network to Amazon VPC and access your private API endpoint over that connection by using public DNS names. You can also use private DNS names to access your private API from an on-premises network by setting up an Amazon Route 53 Resolver inbound endpoint and forwarding it all DNS queries of the private DNS from your remote network. For more information, see Forwarding inbound DNS queries to your VPCs in the Amazon Route 53 Developer Guide
  2. 304faa7 👍 3
    D is the correct answer here as we don't want to setup additional infra(inbound endpoints) here as asked in the question. Only through inbound endpoints we will be able to use private DNS. Below is from AWS documentation : its a tricky question. Invoke a private API using AWS Direct Connect You can use AWS Direct Connect to establish a dedicated private connection from an on-premises network to Amazon VPC and access your private API endpoint over that connection by using public DNS names. You can also use private DNS names to access your private API from an on-premises network by setting up an Amazon Route 53 Resolver inbound endpoint and forwarding it all DNS queries of the private DNS from your remote network. For more information, see Forwarding inbound DNS queries to your VPCs in the Amazon Route 53 Developer Guide.
  3. 304faa7 👍 2
    D is the correct answer ; https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-private-api-test-invoke-url.html#w78aac15c20c17c15c17
  4. chrootxxx 👍 1 Answered D
    https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-private-api-test-invoke-url.html Invoke a private API using AWS Direct Connect You can use AWS Direct Connect to establish a dedicated private connection from an on-premises network to Amazon VPC and access your private API endpoint over that connection by using public DNS names.
  5. dspd 👍 1 Answered C
    Answer C D - This option is incorrect because it suggests using the public DNS name of the endpoint, which contradicts the requirement for private communication. Additionally, like options A and B, it doesn't mention the necessary step of associating the endpoint with the private REST API.
Show 2 more comments
  1. ArunRav 👍 1 Answered A
    Using option A, engineer can invoke API end point connectivity using private communication and can avoid additional route 53 setup needed
  2. Nel07 👍 1 Answered A
    option A

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

How to make one AWS Direct Connect connection primary and the other failover-only?

S-grade

How to Copy On-Premises Application Logs to Amazon S3 Over AWS Direct Connect?

S-grade

Why Does VPC Traffic Mirroring Randomly Drop Traffic?

S-grade

What is the most secure way to expose cross-account microservices with API Gateway?

S-grade

Practice All ANS-C01 Questions

Access 137 questions with complete answers and detailed explanations.

View Full ANS-C01 Practice Test →

← Back to ANS-C01 Study Guide