ExamPark
Course menuSAA-C03

Exams / SAA-C03 / Security groups and network ACLs / Question 3

SAA-C03 practice question: Security groups and network ACLs (3 of 3)

Design Secure Architectures A free question from our original SAA-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.

A company runs AWS Lambda functions in private subnets of a VPC so that they can query an Amazon RDS database in the same subnets. The functions must now also read and write items in an Amazon DynamoDB table. The security team does not allow any route from these subnets to the internet, and the company wants the lowest ongoing cost. What should a solutions architect do?

Choose one answer.

  1. A. Add a NAT gateway in a new public subnet, and route the private subnets' traffic for DynamoDB through the NAT gateway.
  2. B. Create an interface VPC endpoint for DynamoDB in each Availability Zone used, with a security group that allows HTTPS from the functions.
  3. C. Create a gateway VPC endpoint for DynamoDB, and add it to the route tables of the private subnets that the functions use.
  4. D. Remove the VPC configuration from the functions so they reach DynamoDB directly, and connect to the database through an RDS Proxy.
Show the answer and explanation

Answer: C

Explanation

Gateway VPC endpoints for Amazon S3 and DynamoDB add a route table entry that sends traffic for the service over the AWS network, with no internet gateway, NAT gateway or extra charge. DynamoDB also supports interface endpoints, which are needed for on-premises or cross-Region access but cost more. Moving the functions out of the VPC would cut them off from the database.

Study

Keep practising

Answer questions with a score at the end, or practise just this topic with the explanation after each one. No sign-up needed.

Take the free SAA-C03 practice examPractise Security groups and network ACLsAll Security groups and network ACLs questions