ExamPark
Course menuDEA-C01

Exams / DEA-C01 / Network access to data sources / Question 1

DEA-C01 practice question: Network access to data sources

Data Security and Governance A free question from our original DEA-C01 practice exam. Try it, then open the answer to see why each option is right or wrong.

Last verified against current AWS documentation ·How we write our questions

A property-data vendor runs an AWS Lambda function in private subnets of a VPC. The function reads raw files from an Amazon S3 bucket and calls a partner's REST API. The partner allows requests only from a fixed list of IP addresses, which it will not change.

The security team does not want the function to have a public IP address, and it wants the S3 traffic to stay on the AWS network without incurring NAT data processing charges.

Which network design meets these requirements?

Choose one answer.

  1. A. Create an S3 gateway endpoint for the private subnets, and route partner traffic through a NAT gateway with a fixed Elastic IP.
  2. B. Move the function to a public subnet with an internet gateway, and rely on the function's changing public IP for the partner's allowlist.
  3. C. Create an S3 interface endpoint for the private subnets, and send the partner API traffic over an AWS Site-to-Site VPN to the partner's network.
  4. D. Assign an Elastic IP address to the Lambda function directly, so that the partner can allowlist that address.
Show the answer and explanation

Answer: A

  • A. Right: Correct. The S3 gateway endpoint keeps S3 traffic on the AWS network and avoids NAT data charges for S3. Partner traffic leaves through a NAT gateway with an Elastic IP, which gives the partner one fixed address to allowlist. Learn more: Gateway endpoints for Amazon S3 (opens in a new tab)
  • B. Wrong: A public subnet exposes the function, and the function's public IP can change between runs, so the partner's fixed allowlist would fail. The option breaks two requirements.
  • C. Wrong: A VPN to the partner is a bigger change than needed, and the partner has not agreed to it. The S3 interface endpoint also carries an hourly and per-GB charge that the gateway endpoint avoids.
  • D. Wrong: Lambda functions do not take Elastic IP addresses, and the function reaches the internet through a NAT gateway in the VPC. The option describes a configuration that Lambda does not support.

Explanation

A gateway endpoint keeps S3 traffic private without a NAT gateway, which avoids the NAT data processing charges for S3. A fixed partner allowlist needs a stable outbound address, which a NAT gateway with an Elastic IP provides for traffic leaving the VPC. A public subnet, an interface endpoint with a VPN, and direct Elastic IP assignment each fail one requirement.

A gateway VPC endpoint for S3 or DynamoDB beside a NAT gateway An application in a private subnet uses a route table. Traffic for the S3 or DynamoDB prefix list goes to a gateway endpoint, which is free and can carry an endpoint policy, and reaches the service over the AWS network. Any other internet traffic still goes through a NAT gateway. Private subnets Application private subnet Route table prefix list → endpoint Gateway endpoint free, endpoint policy NAT gateway other traffic only S3 or DynamoDB AWS network Internet
S3 traffic takes the gateway endpoint, and only the partner calls go through the NAT gateway with its fixed Elastic IP.

Study

Keep practicing

Answer questions with a score at the end, or practice just this topic with the explanation after each one. No sign-up needed.

Take the free DEA-C01 practice examPractice Network access to data sourcesAll Network access to data sources questions

Want more on Network access to data sources? The 5 full-length practice sets have 9 more Network access to data sources questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets