How to Invoke a Private API Gateway API via Direct Connect?

A company is developing an API-based application on AWS for its process workflow requirements. The API will be invoked by clients in the company’s on-premises data centers. The company has set up an AWS Direct Connect connection between on premises and AWS. A network engineer decides to implement the API as a private REST API in Amazon API Gateway. The network engineer wants to ensure that clients can reach the API endpoint through private communication. Which solution can the network engineer use to invoke the API without any additional infrastructure setup?

  1. Create an interface VPC endpoint for API Gateway with private DNS names enabled. Access the API by using the private DNS name of the endpoint.
  2. Create an interface VPC endpoint for API Gateway with private DNS names enabled. Access the API by using an Amazon Route 53 alias of the endpoint.
  3. Create an interface VPC endpoint for API Gateway. Associate the endpoint with the private REST API, Access the API by using an Amazon Route 53 alias of the endpoint.
  4. Create an interface VPC endpoint for API Gateway with private DNS names enabled. Access the API by using the public DNS name of the endpoint. Source Reference Answer

Community Votes

D
75%
A
25%

75% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

This question tests your understanding of how private API Gateway endpoints behave over Direct Connect: the private connection is established by the VPC endpoint, but the DNS resolution still uses the public DNS name of the API, so enabling private DNS alone is not sufficient for on-premises access.

For invoking a private REST API in Amazon API Gateway from on-premises over AWS Direct Connect, the correct approach is to create an interface VPC endpoint with private DNS names enabled and access the API using its public DNS name. Community consensus (67 votes) confirms option D, as it avoids additional infrastructure like Route 53 or inbound endpoints.

Choosing option A is the most common mistake because it assumes private DNS names must be used for private communication. However, in a Direct Connect scenario, AWS documentation explicitly states that you invoke the private API using public DNS names; private DNS names are not used across Direct Connect, and setting up Route 53 aliases (options B and C) would require additional infrastructure, which the question disallows.

Community Discussion (7 comments)

304faa7 👍 5 Selected: D
D is the correct answer here as we don't want to setup additional infra(inbound endpoints) here as asked in the question. Only through inbound endpoints we will be able to use private DNS. Below is from AWS documentation : its a tricky question. Invoke a private API using AWS Direct Connect You can use AWS Direct Connect to establish a dedicated private connection from an on-premises network to Amazon VPC and access your private API endpoint over that connection by using public DNS names. You can also use private DNS names to access your private API from an on-premises network by setting up an Amazon Route 53 Resolver inbound endpoint and forwarding it all DNS queries of the private DNS from your remote network. For more information, see Forwarding inbound DNS queries to your VPCs in the Amazon Route 53 Developer Guide
dspd 👍 1 Selected: C
Answer C D - This option is incorrect because it suggests using the public DNS name of the endpoint, which contradicts the requirement for private communication. Additionally, like options A and B, it doesn't mention the necessary step of associating the endpoint with the private REST API.
chrootxxx 👍 1 Selected: D
https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-private-api-test-invoke-url.html Invoke a private API using AWS Direct Connect You can use AWS Direct Connect to establish a dedicated private connection from an on-premises network to Amazon VPC and access your private API endpoint over that connection by using public DNS names.
304faa7 👍 3
D is the correct answer here as we don't want to setup additional infra(inbound endpoints) here as asked in the question. Only through inbound endpoints we will be able to use private DNS. Below is from AWS documentation : its a tricky question. Invoke a private API using AWS Direct Connect You can use AWS Direct Connect to establish a dedicated private connection from an on-premises network to Amazon VPC and access your private API endpoint over that connection by using public DNS names. You can also use private DNS names to access your private API from an on-premises network by setting up an Amazon Route 53 Resolver inbound endpoint and forwarding it all DNS queries of the private DNS from your remote network. For more information, see Forwarding inbound DNS queries to your VPCs in the Amazon Route 53 Developer Guide.
Nel07 👍 1 Selected: A
option A
ArunRav 👍 1 Selected: A
Using option A, engineer can invoke API end point connectivity using private communication and can avoid additional route 53 setup needed
304faa7 👍 2
D is the correct answer ; https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-private-api-test-invoke-url.html#w78aac15c20c17c15c17

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Expert Analysis

Why the Answer Is Correct

Option D is correct because it aligns with AWS documentation on invoking a private API using AWS Direct Connect. When you create an interface VPC endpoint for API Gateway, you enable private DNS names so that the public DNS name of the API resolves to the private endpoint inside the VPC. Over Direct Connect, clients can then use that public DNS name to reach the private API without needing additional infrastructure like Route 53 alias records or inbound endpoints. This is exactly what the question asks: "without any additional infrastructure setup."

Why the Other Options Are Wrong

Options A and B are incorrect because they suggest using the private DNS name or a Route 53 alias, which require either the traffic to originate from within the VPC or a custom DNS configuration. For Direct Connect, the documented method is to use the public DNS name of the API endpoint, as noted in the AWS documentation cited by community comments. Option C is also incorrect because it omits enabling private DNS names, which is necessary for the public DNS name to resolve to the VPC endpoint, and it still uses a Route 53 alias, adding unnecessary setup.

Community Comment Notes

Several comments correctly point to the AWS documentation link: "Invoke a private API using AWS Direct Connect" (comments 3 and 5). One comment specifically highlights that "Only through inbound endpoints will we be able to use private DNS," which emphasizes why private DNS alone isn't the answer for on-premises access. Another comment (option A) misunderstands the requirement, suggesting private DNS names are needed, but the consensus and AWS docs favor option D. The key distinction is that the VPC endpoint provides the private connectivity, not the DNS name itself.

Official Reference

Exam Strategy

When answering questions about private APIs and Direct Connect, remember that the VPC endpoint supplies the private network path, while DNS resolution for on-premises clients still uses the API's public DNS name over that private connection. Look for wording that says "without additional infrastructure" — that rules out Route 53 aliases and any extra components.

Related Analysis

A company ran out of IP address space in one of the Availabi

S-Grade

A network engineer is working on a large migration effort fr

S-Grade

A company has a highly available application that is hosted

A-Grade

Practice All ANS-C01 Questions

Access 137 questions with complete answers and detailed explanations.

View Full ANS-C01 Practice Test →

← Back to ANS-C01 Study Guide