SAA-C03 practice question: Security groups and network ACLs (3 of 3)
Design Secure Architectures A free question from our original SAA-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.
A company runs AWS Lambda functions in private subnets of a VPC so that they can query an Amazon RDS database in the same subnets.
The functions must now also read and write items in an Amazon DynamoDB table. The security team does not allow any route from these subnets to the internet, and the company wants the lowest ongoing cost.
What should a solutions architect do?
Choose one answer.
AA. Add a NAT gateway in a new public subnet, and route the private subnets' traffic for DynamoDB through the NAT gateway.
BB. Create an interface VPC endpoint for DynamoDB in each Availability Zone used, with a security group that allows HTTPS from the functions.
CC. Create a gateway VPC endpoint for DynamoDB, and add it to the route tables of the private subnets that the functions use.
DD. Remove the VPC configuration from the functions so they reach DynamoDB directly, and connect to the database through an RDS Proxy.
Show the answer and explanation
Answer: C
A. Wrong: A NAT gateway gives the subnets a route to the internet, which the security team does not allow. It also has hourly and per-GB processing charges. A gateway endpoint reaches DynamoDB with no internet route and no charge. Learn more: NAT gateways (opens in a new tab)
B. Wrong: DynamoDB supports interface endpoints, and this keeps traffic private. However, interface endpoints are charged per hour in each Availability Zone and per GB processed. The gateway endpoint does the same job here at no extra charge. Learn more: AWS PrivateLink FAQs (opens in a new tab)
C. Right: Correct. A gateway endpoint adds a route to DynamoDB in the chosen route tables, so traffic stays on the AWS network without an internet or NAT gateway. There is no additional charge for gateway endpoints. Learn more: Gateway endpoints for Amazon DynamoDB (opens in a new tab)
Gateway VPC endpoints for Amazon S3 and DynamoDB add a route table entry that sends traffic for the service over the AWS network, with no internet gateway, NAT gateway or extra charge. DynamoDB also supports interface endpoints, which are needed for on-premises or cross-Region access but cost more. Moving the functions out of the VPC would cut them off from the database.
A gateway endpoint for DynamoDB adds a route, so the functions reach the table with no NAT gateway and no extra charge.
Want more on Security groups and network ACLs? The 5 full-length practice sets have 10 more Security groups and network ACLs questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →