Examkin

Question

Difficulty: MediumVPC Security for Developers

A company is building a financial transactions API where an AWS Lambda function, attached to private subnets in a custom VPC, must query a private Amazon Aurora MySQL database. The function also needs to retrieve database credentials from AWS Systems Manager Parameter Store and dispatch transaction receipts to an external payment gateway. Security policies mandate that database traffic and credentials retrieval must not traverse the public internet. Which combination of network configurations and security settings will allow the function to perform all required tasks?

  1. Associate the Lambda function with the private subnets. Create an interface VPC endpoint for Systems Manager in the private subnets. Deploy a NAT Gateway in a public subnet, and configure the private subnets' route table with a route for 0.0.0.0/00.0.0.0/0 pointing to the NAT Gateway.Answer
  2. B
    Associate the Lambda function with the private subnets. Rely on the default VPC subnet routing to reach the external payment gateway and Systems Manager without deploying a NAT Gateway or VPC endpoints.
  3. C
    Associate the Lambda function with the private subnets. Store the database credentials in Systems Manager Parameter Store and enable automatic credential rotation. Deploy a NAT Gateway in a public subnet, and configure the private subnets' route table with a route for 0.0.0.0/00.0.0.0/0 pointing to the NAT Gateway.
  4. D
    Associate the Lambda function with the private subnets. Configure the trust policy of the Lambda execution role to trust ssm.amazonaws.com so that the service can retrieve the credentials. Deploy a NAT Gateway in a public subnet, and configure the private subnets' route table with a route for 0.0.0.0/00.0.0.0/0 pointing to the NAT Gateway.

Answer

Associate the Lambda function with the private subnets. Create an interface VPC endpoint for Systems Manager in the private subnets. Deploy a NAT Gateway in a public subnet, and configure the private subnets' route table with a route for 0.0.0.0/00.0.0.0/0 pointing to the NAT Gateway.
The correct configuration establishes private connectivity to AWS Systems Manager Parameter Store using an Interface VPC Endpoint, avoiding the public internet. At the same time, it uses a NAT Gateway in a public subnet to allow the Lambda function to securely route outbound internet traffic to the external payment gateway.

Step-by-Step Solution

1
Determine the routing requirements for each destination endpoint.
Database traffic must remain local within the VPC; AWS Systems Manager Parameter Store must be accessed privately within the AWS network; the external payment gateway requires routing to the public internet.
Understanding where traffic needs to route is critical for designing the correct VPC components.
2
Configure the private endpoint for Systems Manager Parameter Store.
Provision an Interface VPC Endpoint (PrivateLink) for Systems Manager (ssm) inside the private subnets.
This routes Parameter Store requests entirely within the AWS network, fulfilling the security requirement that credentials retrieval does not traverse the public internet.
3
Configure outbound routing for external internet access.
Deploy a NAT Gateway in a public subnet (which has a route to the Internet Gateway) and add a route in the private subnets' route table pointing 0.0.0.0/00.0.0.0/0 to the NAT Gateway.
Because Lambda functions inside private subnets lack public IP addresses, they must use a NAT Gateway to send traffic to external endpoints like the payment gateway.

Key Concept

VPC endpoints allow private access to supported AWS services, whereas resources inside private subnets must use a NAT Gateway in a public subnet to communicate with external internet services.
Estimated Time:2m 0s
Rate this question

Topics

VPC Security for Developers

More questions from this topic