ExamPark
Course menuDVA-C03

Exams / DVA-C03 / Lambda and VPC access / Question 1

DVA-C03 practice question: Lambda and VPC access

Development with AWS Services A free question from our original DVA-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.

Last verified against current AWS documentation ·How we write our questions

A Lambda function is attached to private subnets so that it can query an Amazon RDS database, which must stay private.

The function must also call a payment provider's HTTPS API. The provider accepts requests only from one fixed public IP address that the company has registered with it. Calls to the provider currently time out.

The company will not open the database to the internet.

Which change meets these requirements?

Choose one answer.

  1. A. Move the function into the VPC's public subnets, so that its traffic leaves through the internet gateway.
  2. B. Add a route from the private subnets to the internet gateway, and allow outbound traffic in the security group.
  3. C. Create a NAT gateway in a public subnet with an Elastic IP, and route the private subnets' traffic to it.
  4. D. Create an interface VPC endpoint for the payment provider's domain name in the private subnets, and turn on private DNS.
Show the answer and explanation

Answer: C

  • A. Wrong: Connecting a function to a public subnet does not give it internet access or a public IP address. The calls would still time out. Learn more: Giving Lambda functions access to resources in a VPC (opens in a new tab)
  • B. Wrong: The function has no public IP address, so the internet gateway cannot carry its traffic. The provider would still never see the fixed address it expects.
  • C. Right: Correct. Outbound traffic from the private subnets leaves through the NAT gateway, which uses its Elastic IP address. The provider sees that fixed address, and the database stays private. Learn more: NAT gateways (opens in a new tab)
  • D. Wrong: Interface endpoints reach AWS services and PrivateLink services. They cannot reach an arbitrary third-party API, and they do not give the function a fixed outbound address.

Explanation

A function in private subnets reaches the internet only through a route to a NAT gateway in a public subnet. The NAT gateway's Elastic IP address is the fixed address the provider sees, and the database stays private. Public subnets and internet gateway routes do not give the function a public address.

A Lambda function in private subnets reaching the internet through a NAT gateway Inside the VPC, a Lambda function in a private subnet queries a private RDS database. Its internet traffic goes to a NAT gateway with an Elastic IP in a public subnet, then through the internet gateway to an external API, which sees the Elastic IP. External API VPC Internet gateway NAT gateway Elastic IP, fixed Lambda function private subnet RDS database private subnet
The provider sees the NAT gateway's Elastic IP, and the database never gets a route to the internet.

Study

Keep practicing

Answer questions with a score at the end, or practice just this topic with the explanation after each one. No sign-up needed.

Take the free DVA-C03 practice examPractice Lambda and VPC accessAll Lambda and VPC access questions

Want more on Lambda and VPC access? The 5 full-length practice sets have 5 more Lambda and VPC access questions, 390 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets