Other things to study

Question 1

Gateway Endpoint

Answer 1

Target of traffic for controlled data flow.

Question 2

ENI

Answer 2

Elastic Network Interface (ENI): Virtual NIC

Question 3

Route Tables

Answer 3

Routes to determine network traffic from subnet or gateway.

Question 4

SCP

Service Control Policy

Answer 4

Part of AWS Organizations

Denies access to AWS services to member users. Non-members of your organization are not affected.

Is only restrictive. Grants no permissions.
By default, everything is enabled.

Effective permissions = SCP limitations + IAM access grants