Why Can’t I Deploy a PrivateLink Endpoint in a New Availability Zone?

ANS-C01 By islever Editorial Last updated Aug 21, 2026

Short answer

C The SaaS provider does not offer the solution in the new Availability Zone and has not configured cross-zone load balancing for the NLB.

Question

A company securely connects resources that are in its VPC to a software as a service (SaaS) solution from a SaaS provider. The SaaS solution is hosted in the AWS Cloud and is powered by AWS PrivateLink. The company uses a PrivateLink endpoint to access the SaaS solution behind the SaaS provider's Network Load Balancer (NLB). The company recently added a new Availability Zone and new subnets to its VPC. A network engineer is unable to deploy a new interface VPC endpoint for the SaaS solution in the new Availability Zone. What is the cause of this problem?

The CIDR block of the new subnets conflicts with the SaaS provider's CIDR block.
The enableDnsHostnames attribute and enableDnsSupport attribute were not configured on the new subnets in the new Availability Zone.
The SaaS provider does not offer the solution in the new Availability Zone and has not configured cross-zone load balancing for the NLB. Correct Answer
The new subnets are missing a route to the VPC internet gateway.

Key Takeaways

Tests understanding of PrivateLink AZ dependency constraints, with the common trap being misdiagnosis via VPC routing or DNS attributes instead of service-side AZ limitations.

AWS PrivateLink requires endpoint services to be explicitly provisioned in each target Availability Zone. Community consensus confirms that missing AZ availability or disabled cross-zone load balancing directly blocks interface endpoint deployment.

Common mistake: Option B is frequently selected because candidates confuse DNS resolution prerequisites with endpoint creation requirements, but missing DNS flags only break name resolution, not AZ-specific provisioning.

Expert Analysis

Why the Answer Is Correct

Interface VPC endpoints require dedicated ENIs deployed within specific Availability Zones. For deployment to succeed, the underlying PrivateLink service must be actively offered in that exact AZ. If the SaaS provider has not enabled their endpoint service in the new AZ and cross-zone load balancing remains disabled on the NLB, AWS rejects the request. This architectural rule guarantees strict traffic isolation unless explicitly overridden.

Why the Other Options Are Wrong

Option A is invalid because PrivateLink utilizes private IPs and completely ignores CIDR overlap checks between consumer and provider networks. Option B incorrectly targets DNS attributes; while enableDnsHostnames and enableDnsSupport are mandatory for resolving private endpoints, their absence never halts endpoint instantiation. Option D references an Internet Gateway, which is entirely irrelevant since PrivateLink traffic never leaves the AWS backbone network.

Community Comment Notes

Examinees universally validate option C based on real exam experience. Comment [1] accurately explains that endpoint creation strictly hinges on service availability within the target AZ. Comment [2] points to the official AWS whitepaper detailing how cross-zone load balancing resolves multi-AZ PrivateLink deployments. Multiple users emphasize that distractors like CIDR conflicts and IGW routes successfully filter out candidates who misunderstand PrivateLink's isolated architecture.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When troubleshooting VPC endpoint failures, always verify the service provider's AZ coverage before auditing your own VPC settings. Remember that PrivateLink operates independently of public routing and demands strict AZ alignment unless cross-zone load balancing is explicitly enabled on the backend infrastructure.

Community Votes

100%

100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

Akshay0403 👍 2 Answered C

AWS PrivateLink endpoints require the service to be available in the Availability Zone where the endpoint is being created. If the SaaS provider does not offer the service in the new Availability Zone and cross-zone load balancing is not configured for the NLB, the endpoint cannot be deployed in that Availability Zone. This is a likely cause of the problem because the endpoint creation depends on the service being present and accessible in the desired Availability Zone.
rdiaz 👍 2 Answered C

https://docs.aws.amazon.com/whitepapers/latest/aws-privatelink/creating-highly-available-endpoint-services.html
woorkim 👍 1

C is right! A: CIDR block conflicts are not relevant here, as PrivateLink operates at the network interface level and is independent of the CIDR block configuration of the VPC. B: The enableDnsHostnames and enableDnsSupport attributes are required for DNS resolution of private endpoints, but their absence would not block the creation of an endpoint in a specific Availability Zone. D: The new subnets do not need a route to an internet gateway to use AWS PrivateLink, as it operates within the AWS network and does not rely on public internet routing.
cas_tori 👍 1 Answered C

this is C

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Practice All ANS-C01 Questions

Access 137 questions with complete answers and detailed explanations.

View Full ANS-C01 Practice Test →

← Back to ANS-C01 Study Guide