Exams / DVA-C02 / Lambda and VPC access / Question 1
DVA-C02 practice question: Lambda and VPC access
Development with AWS Services A free question from our original DVA-C02 practice exam. Try it, then open the answer to see why each option is right or wrong.
A Lambda function was attached to a VPC so it can reach an Amazon RDS database in private subnets. Since then, its calls to a third-party HTTPS API on the internet time out. The VPC has public subnets with an internet gateway. What should the developer do so the function can reach both the database and the internet?
Choose one answer.
- AA. Attach the function to the public subnets so that its traffic uses the internet gateway.
- BB. Use private subnets with a default route to a NAT gateway in a public subnet.
- CC. Add an interface VPC endpoint for the third-party API's domain name to the VPC.
- DD. Allow all outbound traffic to 0.0.0.0/0 in the function's security group.
Show the answer and explanation
Answer: B
- A. Wrong: The Lambda documentation states that connecting a function to a public subnet does not give it internet access.
- B. Right: Correct. The private subnets' route table sends 0.0.0.0/0 to the NAT gateway, which reaches the internet through the internet gateway.
- C. Wrong: Interface endpoints reach AWS services and PrivateLink services, not an arbitrary internet API.
- D. Wrong: Security groups allow traffic but do not provide a route. With no route to the internet the calls still time out.
Explanation
A VPC-connected function can only use routes in its subnets. To reach the internet it must sit in private subnets whose default route points to a NAT gateway in a public subnet. Putting the function in a public subnet does not work, as AWS notes explicitly.
Study
Keep practising
Answer questions with a score at the end, or practise just this topic with the explanation after each one. No sign-up needed.