Selected Answer: B Option B: precise routing and bucket policies Precise routing ensures that: Traffic remains inside VPC / AWS backbone PrivateLink-based access is used (for S3, RDS, etc.) No unintended path to the Internet Directly relevant to RDS, S3 via endpoints, and PrivateLink. Bucket policies: Manage access to S3 objects. Common exam pattern: “Use VPC endpoint policy + S3 bucket policy to force S3 access over PrivateLink and block public access.” From an AWS exam perspective, this fits a very standard “secure multi-tier & S3” design.