Examkin

Question

Difficulty: EasyVPC Security for Developers

A serverless invoice processing application uses a Lambda function to query a relational database residing in a private subnet of a custom VPC. The function also needs to call a third-party billing service endpoint on the public internet.

Which of the following configurations are required to establish this network connectivity while maintaining secure access? (Select TWO.)

  1. Associate the Lambda function with the private subnets of the VPC, and route outbound internet traffic through a NAT Gateway located in a public subnet.Answer
  2. Configure a security group for the Lambda function that permits outbound traffic to the database port and to the internet on HTTPS port 443.Answer
  3. C
    Place the Lambda function in a public subnet of the VPC and enable the default auto-assign public IP setting on the function configuration to reach the billing endpoint directly.
  4. D
    Modify the Lambda function's execution role trust policy to allow inbound database connections from the security group of the database.
  5. E
    Store the database credentials in Systems Manager Parameter Store and enable the native database credential rotation feature.

Answer

To establish network connectivity for the Lambda function, associate it with the private subnets of the VPC and route outbound internet traffic through a NAT Gateway in a public subnet. Additionally, configure the function's security group to allow outbound traffic to the database port and to the internet on HTTPS port 443.
The correct configurations are to associate the Lambda function with the private subnets of the VPC, routing outbound internet traffic through a NAT Gateway in a public subnet, and configure a security group for the Lambda function that permits outbound traffic to both the database port and HTTPS port 443. This setup ensures that the Lambda function can resolve and reach local resources like the database, while securely routing outbound internet traffic to the external endpoint via the NAT Gateway.

Step-by-Step Solution

1
Determine subnet placement for the Lambda function.
The Lambda function is associated with private subnets of the custom VPC to allow secure communication with the database.
Private resources should not be exposed to the public internet, and Lambda needs VPC network interfaces (ENIs) in the same subnets to reach the database.
2
Enable internet connectivity for the private subnets.
Configure a NAT Gateway in a public subnet, and add a route in the private subnets' route table pointing 0.0.0.0/0 traffic to the NAT Gateway.
Lambda functions in private subnets cannot reach the public internet directly; they require a NAT Gateway to translate private IPs to a public IP for internet access.
3
Configure the Lambda function's Security Group rules.
Add outbound rules allowing traffic to the database's Security Group on its port, and outbound HTTPS traffic to the internet.
Security groups are stateful and must explicitly allow the outbound traffic initiated by the Lambda function.

Key Concept

VPC Security for Lambda and Resource Access
Estimated Time:1m 30s
Rate this question

Topics

VPC Security for Developers

More questions from this topic