Examkin

VPC Security for Developers

40 questions

All types40Multiple choice21Multiple select19
Question 21Question →

A team is deploying a serverless data ingestion application. An AWS Lambda function needs to read and write data to an Amazon ElastiCache for Redis cluster located in the private subnets of a VPC. The Lambda function also must perform outbound HTTPS requests to an external validation API on the public internet. Which TWO network and security configurations must the developer implement to establish this connectivity? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure the Lambda function to run in the private subnets of the VPC, and configure a route to a NAT Gateway in a public subnet to route outbound traffic from the private subnets to the internet.; Configure the security group of the ElastiCache cluster to allow inbound TCP traffic on port 6379 from the security group assigned to the Lambda function.

Answer

To establish the required connectivity, the developer must place the Lambda function in the VPC's private subnets and use a NAT Gateway in a public subnet for public internet access, while also adjusting the ElastiCache security group to allow inbound traffic on port 6379 from the Lambda function's security group.
Configuring the Lambda function inside private subnets with a NAT Gateway in a public subnet allows the function to access both private resources (ElastiCache) and the public internet (external API). Modifying the ElastiCache security group to accept inbound traffic from the Lambda security group is required to allow connection requests.

Step-by-Step Solution

1
Place the Lambda function inside the private subnets of the VPC to grant it network path access to the ElastiCache cluster.
The Lambda function is associated with ENIs in the private subnets, enabling it to reach local VPC resources.
VPC-enabled Lambda functions require association with subnets inside the VPC to interact with private endpoints like ElastiCache.
2
Set up a NAT Gateway in a public subnet of the VPC and update the private subnets' route table to forward 0.0.0.0/0 traffic to the NAT Gateway.
The Lambda function in the private subnets can now establish outbound HTTPS connections to the external validation API.
Lambda functions in private subnets cannot access the public internet directly through an Internet Gateway and must use a NAT Gateway.
3
Modify the ElastiCache security group to allow inbound Redis traffic (TCP 6379) from the security group assigned to the Lambda function.
Network communication on port 6379 is allowed through the stateful firewall rules of both security groups.
Security groups act as firewalls at the instance/resource level, and inbound access must be explicitly allowed for connection requests to succeed.

Key Concept

VPC Security for Lambda and ElastiCache connectivity, including security group rules and private-to-public routing.
Estimated Time:2m 0s
Question 22Question →

A developer is configuring an AWS Lambda function to run inside a custom VPC. The function needs to retrieve database configuration parameters stored in AWS Systems Manager Parameter Store. The corporate security policy requires that no traffic to Systems Manager may traverse the public internet. During testing, the Lambda function times out whenever it attempts to call the GetParameter API. How should the developer resolve this issue while complying with the security policy?

Show answer & explanation

Answer: Create an interface VPC endpoint for Systems Manager in the VPC, and configure the security group of the VPC endpoint to allow inbound HTTPS traffic from the Lambda function's security group.

Answer

Create an interface VPC endpoint for Systems Manager in the VPC, and configure the security group of the VPC endpoint to allow inbound HTTPS traffic from the Lambda function's security group.
The correct answer correctly identifies that an interface VPC endpoint (AWS PrivateLink) allows resources inside private subnets to securely connect to Systems Manager over private IP addresses. It also correctly states that the security group of the VPC endpoint must permit inbound HTTPS traffic from the Lambda function's security group.

Step-by-Step Solution

1
Identify the root cause of the timeout.
The Lambda function inside the VPC has no path to the public Systems Manager endpoint.
By default, resources in private subnets cannot reach the public internet or public AWS services without a NAT Gateway or VPC Endpoint.
2
Apply the corporate security constraint.
Discard solutions involving NAT Gateways or Internet Gateways.
The security policy forbids traffic from traversing the public internet.
3
Select the correct private connectivity mechanism.
Determine that Systems Manager supports Interface VPC Endpoints (AWS PrivateLink).
Interface VPC Endpoints assign private IPs within the VPC to route traffic securely to the service.
4
Configure security groups for the endpoint.
Allow inbound port 443 traffic from the Lambda function's security group to the endpoint's security group.
Security groups control the traffic flow between the Lambda function's ENI and the VPC endpoint's ENI.

Key Concept

VPC Security and PrivateLink Interface Endpoints for Lambda
Question 23Question →

An AWS Lambda function is configured to run inside a private subnet of a custom VPC. The function retrieves transaction data from an internal Amazon RDS database and must then send a confirmation request to an external, public HTTP API. The database connection is successful, but the external API call times out. Which network configuration change will resolve the timeout issue?

Show answer & explanation

Answer: Place a NAT Gateway in a public subnet, and configure the private subnet's route table to route outbound internet traffic (0.0.0.0/00.0.0.0/0) to the NAT Gateway.

Answer

Place a NAT Gateway in a public subnet, and configure the private subnet's route table to route outbound internet traffic to the NAT Gateway.
For resources inside a private subnet to establish outbound connections to the internet, they must route traffic through a NAT Gateway. The NAT Gateway must be located in a public subnet and have a route from the private subnet's route table pointing 0.0.0.0/00.0.0.0/0 to it.

Step-by-Step Solution

1
Analyze the network route requirements.
The Lambda function needs to communicate internally with the Amazon RDS database and externally with a public API endpoint.
Establishing both private and public paths helps determine the required VPC components.
2
Select the correct translation gateway for private subnets.
A NAT Gateway must be provisioned in a public subnet of the VPC.
A NAT Gateway maps private IP addresses to a public IP to enable outbound communication with internet resources.
3
Configure the route table.
A route is added to the private subnet's route table directing destination traffic 0.0.0.0/00.0.0.0/0 to the NAT Gateway.
This instructs the VPC router to forward all outbound internet traffic from the private subnet through the NAT Gateway, resolving the connection timeout.

Key Concept

VPC Routing for Lambda Functions needing Public and Private Access
Estimated Time:55s
Question 24Question →

A developer is configuring an AWS Lambda function that runs inside a private subnet of a VPC. The Lambda function needs to securely download external libraries from a public repository on the internet and retrieve configuration parameters from AWS Systems Manager Parameter Store. Which of the following VPC configurations are required to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure a route in the private subnet's route table that directs outbound traffic (0.0.0.0/0) to a NAT Gateway located in a public subnet.; Create an Interface VPC Endpoint (AWS PrivateLink) for Systems Manager (ssm) and associate it with the private subnets.

Answer

Configure a route in the private subnet's route table that directs outbound traffic (0.0.0.0/0) to a NAT Gateway located in a public subnet, and create an Interface VPC Endpoint (AWS PrivateLink) for Systems Manager (ssm) associated with the private subnets.
The correct configurations involve routing private subnet outbound internet traffic to a NAT Gateway in a public subnet, and establishing an Interface VPC Endpoint for Systems Manager. This allows the Lambda function to securely communicate with both the public internet and AWS Systems Manager privately.

Step-by-Step Solution

1
Analyze internet access requirements for Lambda in a private subnet.
To access the public internet (external registry), a Lambda function in a private subnet requires a route targeting a NAT Gateway located in a public subnet.
Resources in private subnets cannot associate with public IP addresses directly, so egress to the internet must be handled by a Network Translation (NAT) device.
2
Analyze private access to AWS Systems Manager.
Create an Interface VPC Endpoint (PrivateLink) for 'ssm' and map it to the private subnets.
This establishes a secure, private connection to Systems Manager within the VPC without routing traffic through the public internet.

Key Concept

VPC Egress and VPC Endpoints for Lambda
Question 25Question →

A company is deploying an application on Amazon EC2 instances located in a private subnet of a custom VPC. The application must securely retrieve database credentials from AWS Secrets Manager and also connect to a public API endpoint of an external partner over the internet.

Which of the following network configurations must the developer implement to meet these requirements while minimizing data transfer over the public internet? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create an interface VPC endpoint (AWS PrivateLink) for AWS Secrets Manager in the private subnet.; Deploy a NAT gateway in a public subnet and add a route in the private subnet's route table that points 0.0.0.0/0 to the NAT gateway.

Answer

The correct configurations are to create an interface VPC endpoint (AWS PrivateLink) for AWS Secrets Manager in the private subnet, and deploy a NAT gateway in a public subnet with a route in the private subnet's route table pointing outbound internet-bound traffic (0.0.0.0/0) to the NAT gateway.
To satisfy both requirements under the constraint of minimizing public internet usage, the developer must: 1. Deploy an Interface VPC Endpoint (PrivateLink) for Secrets Manager so that credential requests remain entirely within the AWS network. 2. Use a NAT Gateway in a public subnet coupled with a route in the private route table to enable outbound internet access to the external payment API.

Step-by-Step Solution

1
Determine the required connectivity for AWS Secrets Manager.
Since the goal is to retrieve credentials securely while minimizing internet traffic, the application should connect to Secrets Manager privately. Secrets Manager supports Interface VPC Endpoints (AWS PrivateLink) for private network connectivity.
Using an interface endpoint prevents database credential retrieval traffic from traversing the public internet.
2
Determine the required connectivity for the external API.
The external API is a public internet endpoint. Instances in private subnets cannot access the public internet directly. A NAT gateway must be deployed in a public subnet, and a route to it (for 0.0.0.0/0) must be added to the private subnet's route table.
A NAT gateway allows private subnet resources to initiate outbound requests to public endpoints.

Key Concept

Configuring private subnets to securely access AWS services via VPC endpoints and external services via NAT Gateways.
Question 26Question →

A developer is deploying a backend microservice on an AWS Lambda function that is configured to run inside the private subnets of a custom VPC. The function must retrieve database credentials from AWS Secrets Manager and query an Amazon DynamoDB table. Due to strict compliance guidelines, the VPC has no Internet Gateway or NAT Gateway attached, and all traffic must remain within the AWS network.

Which two configuration steps should the developer perform to establish private connectivity to these services while maintaining the principle of least privilege? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create a Gateway VPC Endpoint for Amazon DynamoDB and associate it with the route tables of the private subnets.; Create an Interface VPC Endpoint for AWS Secrets Manager in the private subnets, and configure its security group to allow inbound HTTPS traffic from the security group associated with the Lambda function.

Answer

Create a Gateway VPC Endpoint for Amazon DynamoDB and associate it with the route tables of the private subnets, and create an Interface VPC Endpoint for AWS Secrets Manager in the private subnets with its security group configured to allow inbound HTTPS traffic from the security group associated with the Lambda function.
To connect to AWS services privately from a VPC without internet access, developers must use VPC endpoints. Amazon DynamoDB supports Gateway VPC Endpoints, which route traffic directly to the service using route table entries associated with the private subnets. AWS Secrets Manager requires an Interface VPC Endpoint, which deploys Elastic Network Interfaces (ENIs) into the subnets. To secure access to the Secrets Manager Interface Endpoint under the principle of least privilege, its security group must allow inbound HTTPS (port 443) traffic from the security group of the Lambda function.

Step-by-Step Solution

1
Determine the correct VPC endpoint type for Amazon DynamoDB.
Identify that DynamoDB supports Gateway VPC Endpoints.
Gateway endpoints provide private routing to DynamoDB via subnet route tables without incurring hourly charges or requiring security group modifications.
2
Determine the correct VPC endpoint type for AWS Secrets Manager.
Identify that Secrets Manager requires an Interface VPC Endpoint (AWS PrivateLink).
Secrets Manager does not support Gateway endpoints; it requires an Interface endpoint, which places an Elastic Network Interface (ENI) with a private IP in the subnets.
3
Configure the security group for the Secrets Manager Interface VPC Endpoint.
Allow inbound HTTPS (TCP port 443) traffic originating from the specific security group assigned to the Lambda function.
This implements the principle of least privilege, ensuring only the authorized Lambda function can reach the Secrets Manager interface.

Key Concept

VPC Endpoint Routing and Security Group Configuration for Private AWS Service Access
Estimated Time:2m 0s
Question 27Question →

A developer has configured an AWS Lambda function to run inside private subnets of a VPC. The function needs to connect to an external, third-party payment gateway API on the public internet, but the connection attempts are failing due to timeouts. Which configuration change should the developer implement to allow the Lambda function to connect to the external API?

Show answer & explanation

Answer: Deploy a NAT Gateway in a public subnet, and add a route in the private subnet's route table directing outbound 0.0.0.0/00.0.0.0/0 traffic to the NAT Gateway.

Answer

Deploy a NAT Gateway in a public subnet, and add a route in the private subnet's route table directing outbound traffic to the NAT Gateway.
The correct answer provides a valid network path for the Lambda function. Since the Lambda function is placed in a private subnet, it has no public IP address and cannot directly route traffic to an Internet Gateway. Deploying a NAT Gateway in a public subnet and routing the private subnet's outbound traffic to the NAT Gateway allows the Lambda function to reach public endpoints securely.

Step-by-Step Solution

1
Analyze the network requirements of the Lambda function.
The Lambda function is inside private subnets of a VPC and needs to access an endpoint on the public internet.
Since the Lambda is within a VPC private subnet, it lacks a path to the public internet by default.
2
Select the correct AWS VPC component to enable outbound-only internet connectivity.
A NAT Gateway must be deployed in a public subnet of the VPC.
A NAT Gateway translates private IP addresses to a public IP to facilitate outbound communication with the internet.
3
Update the routing configuration of the private subnet.
Add a route for 0.0.0.0/00.0.0.0/0 pointing to the NAT Gateway.
This ensures all internet-bound traffic from the Lambda function is correctly forwarded to the NAT Gateway.

Key Concept

Outbound internet connectivity for VPC-enabled Lambda functions requires a NAT Gateway and appropriate route table entries.
Estimated Time:1m 0s
Question 28Question →

A developer is building a serverless integration service. An AWS Lambda function is configured to run inside a custom VPC to process sensitive data. The function must poll messages from an Amazon SQS queue, store the processed data in an Amazon Aurora PostgreSQL database located in a private database subnet, and send a confirmation payload to an external HTTP webhook API on the public internet.

Which two configurations are required to ensure the Lambda function has the necessary network paths and security settings?

Select all that apply

Show answer & explanation

Answer: Configure the Lambda function to run in the private subnets of the VPC, and configure a route in the subnet route tables directing 0.0.0.0/00.0.0.0/0 to a NAT Gateway located in a public subnet.; Configure the Security Group of the Aurora PostgreSQL database to allow inbound traffic on port 54325432 from the Security Group associated with the Lambda function.

Answer

Configure the Lambda function to run in private subnets with a route to a NAT Gateway, and configure the database's Security Group to allow inbound traffic from the Lambda function's Security Group.
To allow the Lambda function to connect to the private database, the database security group must authorize inbound traffic on port 54325432 from the Lambda function's security group. To allow the function to reach the external HTTP webhook on the public internet, the Lambda function must run in private subnets with a route directing outbound traffic to a NAT Gateway in a public subnet.

Step-by-Step Solution

1
Analyze database connectivity requirements
The Lambda function needs to connect to Aurora PostgreSQL on port 54325432. The database's security group must authorize inbound traffic on port 54325432 originating from the security group assigned to the Lambda function.
Security groups act as firewalls at the instance/resource level and must be configured for stateful communication.
2
Analyze internet connectivity requirements
The Lambda function needs to call an external webhook. A VPC-enabled Lambda function must be placed in private subnets with a route directing 0.0.0.0/00.0.0.0/0 to a NAT Gateway.
VPC-enabled Lambda functions do not receive public IP addresses and cannot connect directly to the internet from a public subnet.
3
Evaluate SQS connectivity requirements
SQS traffic can flow either via the NAT Gateway or through an Interface VPC Endpoint. SQS does not support Gateway VPC Endpoints.
Only Amazon S3 and DynamoDB support Gateway VPC Endpoints; all other supported services use Interface VPC Endpoints.

Key Concept

VPC networking configurations for AWS Lambda, including NAT Gateway routing, security groups, and VPC endpoint types.
Question 29Question →

An organization requires a new microservice backend to run on AWS Lambda within a custom VPC. The function must query an Amazon Aurora MySQL database residing in a private subnet. The function also needs to retrieve database credentials from AWS Secrets Manager without any traffic transiting the public internet.

Which configuration should a developer implement to meet these requirements securely?

Show answer & explanation

Answer: Associate the Lambda function with the private subnets. Provision an interface VPC endpoint for Secrets Manager in the VPC, and configure the security groups to allow inbound HTTPS traffic from the Lambda function's security group to the endpoint.

Answer

Associate the Lambda function with the private subnets. Provision an interface VPC endpoint for Secrets Manager in the VPC, and configure the security groups to allow inbound HTTPS traffic from the Lambda function's security group to the endpoint.
The correct solution involves associating the Lambda function with the private subnets where the database resides and provisioning an interface VPC endpoint for Secrets Manager. The security groups are then configured to allow inbound HTTPS traffic from the Lambda function to the endpoint. This satisfies all requirements: Lambda can query the Aurora database, and the credentials from Secrets Manager are retrieved securely over private IP addresses within the AWS network without transiting the public internet.

Step-by-Step Solution

1
Associate the Lambda function with the private subnets of the VPC.
The Lambda function receives elastic network interfaces (ENIs) inside the private subnets, enabling network connectivity to the Aurora database.
By default, Lambda functions run in a secure service VPC and cannot access resources in a customer's private subnets unless VPC association is configured.
2
Provision an interface VPC endpoint (AWS PrivateLink) for AWS Secrets Manager in the VPC.
Private IP addresses are allocated in the private subnets for the endpoint, resolving hostnames privately within the VPC.
An interface VPC endpoint is required to access AWS Secrets Manager without routing requests through a NAT Gateway or transiting the public internet.
3
Configure the security groups of the interface VPC endpoint to allow inbound HTTPS (port 443) traffic from the Lambda function's security group.
The firewall rules are updated to permit secure HTTPS connections from the Lambda function to the Secrets Manager endpoint.
Interface VPC endpoints use security groups to restrict network access, and they must explicitly permit incoming traffic from the clients.

Key Concept

VPC endpoints enable private connection between a VPC and supported AWS services without requiring internet gateways, NAT devices, or VPN connections. Security groups must be configured to allow communication between resources and interface endpoints.
Question 30Question →

A developer is configuring an AWS Lambda function to run inside a private subnet of a custom VPC. The function must retrieve configuration parameters from Systems Manager Parameter Store and send trace data to AWS X-Ray. Due to strict compliance guidelines, the VPC does not have a NAT Gateway or an Internet Gateway. Which two configurations must the developer implement to enable this connectivity? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create an interface VPC endpoint for Systems Manager (com.amazonaws.region.ssm) and associate it with the private subnets.; Create an interface VPC endpoint for AWS X-Ray (com.amazonaws.region.xray) and associate it with the private subnets.

Answer

Create interface VPC endpoints for Systems Manager (com.amazonaws.region.ssm) and AWS X-Ray (com.amazonaws.region.xray) and associate them with the private subnets.
Because the Lambda function is deployed inside a private subnet without internet egress (no NAT Gateway or Internet Gateway), it cannot resolve and reach the public API endpoints of Systems Manager and AWS X-Ray. Implementing interface VPC endpoints (AWS PrivateLink) creates private elastic network interfaces (ENIs) with private IP addresses directly inside the private subnet. This routes traffic privately to the specified AWS services without exposing data to the public internet.

Step-by-Step Solution

1
Identify the destination services needed by the Lambda function.
The function must reach AWS Systems Manager (SSM) Parameter Store and AWS X-Ray.
This establishes the specific AWS service endpoints that require network pathways.
2
Select the correct connectivity mechanism for a VPC without internet egress (no NAT Gateway or Internet Gateway).
Determine that interface VPC endpoints (AWS PrivateLink) are required for SSM and X-Ray since gateway endpoints are not supported for these services.
AWS PrivateLink provisions private ENIs inside the subnets to route traffic locally and securely over the AWS network.
3
Configure the interface endpoints for com.amazonaws.region.ssm and com.amazonaws.region.xray.
The Lambda function inside the private subnet can now resolve these service endpoints to private IP addresses and successfully connect.
This establishes the necessary network endpoints for secure internal service resolution.

Key Concept

AWS PrivateLink and Interface VPC Endpoints for private AWS service communication
Question 31Question →

A developer is implementing a database maintenance task using an AWS Lambda function. The function is configured to run within a private subnet of a custom VPC in order to access an Amazon RDS DB instance. The database credentials must be retrieved securely from AWS Secrets Manager. During testing, the Lambda function successfully queries the database but fails when trying to retrieve credentials from the Secrets Manager endpoint. Which action should the developer take to resolve this connection failure?

Show answer & explanation

Answer: Create an interface VPC endpoint for Secrets Manager, and configure the Lambda function's security group to allow outbound HTTPS traffic to the endpoint's security group.

Answer

Create an interface VPC endpoint for Secrets Manager, and configure the Lambda function's security group to allow outbound HTTPS traffic to the endpoint's security group.
Creating an interface VPC endpoint for Secrets Manager allows resources in private subnets to securely connect to the service via PrivateLink, avoiding the public internet. The security group of the Lambda function must allow outbound HTTPS traffic to the endpoint's IP addresses to establish this connection.

Step-by-Step Solution

1
Analyze the network path requirements.
The Lambda function is running in a private VPC subnet and needs to access AWS Secrets Manager, which is a public service.
Since the VPC lacks a NAT Gateway or internet path, the function cannot reach public endpoints.
2
Select the correct VPC security integration pattern.
Create an interface VPC endpoint (powered by AWS PrivateLink) for Secrets Manager inside the VPC.
This provides a private network path from the VPC subnets to the AWS service using private IP addresses.
3
Configure the security groups.
Allow outbound traffic from the Lambda function's security group to the VPC endpoint on HTTPS port 443.
Security groups are stateful and must allow outbound connections to initiate the handshake.

Key Concept

VPC Endpoint integration for accessing public AWS services privately from within private subnets.
Question 32Question →

A developer is deploying an application on Amazon ECS (Fargate) tasks within a private subnet of a VPC. The application must retrieve database credentials from AWS Secrets Manager and publish events to an Amazon SNS topic. The company's security policy mandates that all traffic to AWS services must remain within the AWS network and must not traverse the public internet.

Which combination of configurations will meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create Interface VPC Endpoints (AWS PrivateLink) for Secrets Manager and SNS in the private subnets, and ensure private DNS hostnames are enabled for the VPC.; Configure the security groups associated with the VPC endpoints to allow inbound traffic on port 443 from the security group of the ECS tasks.

Answer

The correct configurations are to create Interface VPC Endpoints for Secrets Manager and SNS with private DNS hostnames enabled, and to configure the security groups on the VPC endpoints to allow inbound traffic on port 443 from the ECS tasks' security group.
To connect ECS tasks in a private subnet securely to AWS services (Secrets Manager and SNS) without traversing the public internet, the developer must use Interface VPC Endpoints (AWS PrivateLink). Private DNS hostnames must be enabled so that standard SDK calls to these services resolve to the private endpoint interfaces. Additionally, because Interface VPC Endpoints use ENIs with security groups, the endpoint security groups must be configured to allow inbound traffic on port 443 (HTTPS) from the ECS tasks' security group.

Step-by-Step Solution

1
Determine the type of VPC endpoint required for Secrets Manager and SNS.
Both AWS Secrets Manager and Amazon SNS require Interface VPC Endpoints (AWS PrivateLink), as Gateway VPC Endpoints are only available for Amazon S3 and Amazon DynamoDB.
This establishes the basic network architecture needed to access these services without using a public internet path.
2
Configure private resolution for the service endpoints within the VPC.
Enable private DNS hostnames for the created Interface VPC Endpoints in the VPC settings.
This ensures that DNS queries for the service endpoints (e.g., secretsmanager.us-east-1.amazonaws.com) resolve to the private IP addresses of the endpoint ENIs rather than their public IPs, preventing application code modifications.
3
Configure network security rules (security groups) to permit communication.
Allow inbound traffic on port 443 in the VPC endpoint security groups originating from the ECS tasks' security group, and ensure the ECS tasks' security group allows outbound traffic to the endpoints on port 443.
Interface VPC Endpoints are stateful and use security groups to filter incoming traffic. Since they expose resources over HTTPS, traffic must be allowed on port 443.

Key Concept

Establishing secure, private connections from resources in a private VPC subnet to AWS services using AWS PrivateLink (Interface VPC Endpoints) and proper security group configurations.
Estimated Time:1m 30s
Question 33Question →

A developer is deploying a backend application on Amazon ECS (Fargate) within a custom VPC. The application tasks are placed in private subnets and must connect to an Amazon ElastiCache for Redis cluster located in dedicated isolated subnets within the same VPC. Additionally, the application must fetch runtime API keys from AWS Secrets Manager and send transaction data to a third-party payment processing API on the public internet. Which combination of configurations will securely enable these connections while adhering to the principle of least privilege? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure the ECS tasks' security group to allow outbound TCP traffic on port 6379 to the ElastiCache security group, and configure the ElastiCache security group to allow inbound TCP traffic on port 6379 from the ECS tasks' security group.; Deploy a NAT Gateway in a public subnet, add a route pointing 0.0.0.0/0 to the NAT Gateway in the private subnets' route table, and create an Interface VPC Endpoint for AWS Secrets Manager in the private subnets.

Answer

The correct configurations are to configure the ECS tasks' security group to allow outbound TCP traffic on port 6379 to the ElastiCache security group and configure the ElastiCache security group to allow inbound TCP traffic on port 6379 from the ECS tasks' security group, and deploy a NAT Gateway in a public subnet, add a route pointing 0.0.0.0/0 to the NAT Gateway in the private subnets' route table, and create an Interface VPC Endpoint for AWS Secrets Manager in the private subnets.
The correct configurations involve using stateful security group rules to authorize outbound traffic from the ECS tasks' security group to the ElastiCache security group on port 6379, while allowing inbound traffic on the ElastiCache security group from the ECS tasks. To access the public internet, a NAT Gateway must be deployed in a public subnet with a corresponding route in the private subnets' route table. To securely access AWS Secrets Manager without using the public internet, an Interface VPC Endpoint should be created inside the private subnets.

Step-by-Step Solution

1
Configure internal database connectivity using security groups.
ECS tasks are permitted to initiate TCP connections to the ElastiCache cluster on port 6379, and the ElastiCache cluster permits inbound connections only from the ECS tasks' security group. Because security groups are stateful, return traffic is automatically handled without extra inbound rules.
Ensures secure, restricted database access within the VPC without exposing databases to broader subnet traffic.
2
Configure public internet routing for the external API.
A NAT Gateway is deployed in a public subnet, and the private subnet routing table is updated with a route pointing 0.0.0.0/0 to the NAT Gateway. This allows tasks in the private subnet to securely initiate outbound HTTPS connections to the payment gateway.
Private subnets do not have direct internet access; routing traffic through a NAT Gateway in a public subnet is required.
3
Establish secure private access to AWS Secrets Manager.
An Interface VPC Endpoint (AWS PrivateLink) is provisioned inside the private subnets for Secrets Manager. The application resolves the Secrets Manager DNS to private IP addresses.
Allows the application to fetch sensitive secrets without sending API requests over the public internet, reducing exposure.

Key Concept

VPC security controls require coordinating stateful security groups for internal resources, stateless routing via NAT Gateways for internet access, and VPC Endpoints for private AWS service communication.
Estimated Time:2m 0s
Question 34Question →

An application developer is implementing a Lambda function that validates user sessions. The function must query a Redis cluster running in the private subnets of a custom VPC. At the same time, the function needs to send validation logs to an external analytics provider's HTTPS endpoint on the public internet. How should the developer configure the VPC network paths to allow the Lambda function to access both the private Redis cluster and the public HTTPS endpoint?

Show answer & explanation

Answer: Place the Lambda function in the private subnets of the VPC. Create a NAT Gateway in a public subnet, and add a route in the private subnet route table that directs 0.0.0.0/00.0.0.0/0 traffic to the NAT Gateway. Ensure the Redis security group allows inbound traffic from the Lambda function's security group.

Answer

Place the Lambda function in the private subnets of the VPC. Create a NAT Gateway in a public subnet, and add a route in the private subnet route table that directs 0.0.0.0/00.0.0.0/0 traffic to the NAT Gateway. Ensure the Redis security group allows inbound traffic from the Lambda function's security group.
The correct answer provides the standard, secure pattern for accessing both private VPC resources and the public internet from an AWS Lambda function. By associating the Lambda function with the private subnets, it can reach the Redis cluster. By routing outbound internet traffic (0.0.0.0/00.0.0.0/0) from the private subnets through a NAT Gateway in a public subnet, the function can safely establish HTTPS connections to the public analytics API.

Step-by-Step Solution

1
Determine private connectivity requirements
To access the Redis cluster inside the private subnets, the Lambda function must be configured with VPC integration and attached to the same VPC and private subnets.
VPC integration allows the Lambda function to access resources in private subnets via Elastic Network Interfaces (ENIs) deployed in those subnets.
2
Determine public connectivity requirements
A NAT Gateway must be provisioned in a public subnet, and the route table for the private subnets must direct all internet-bound traffic (0.0.0.0/00.0.0.0/0) to this NAT Gateway.
Lambda functions with VPC integration lose access to the public internet by default because ENIs in private subnets do not have public IP addresses.
3
Configure security group rules
Allow inbound traffic on the Redis port from the Lambda function's security group.
VPC security groups act as stateful firewalls and must explicitly permit the inbound traffic to the Redis cluster.

Key Concept

A Lambda function configured to access resources within a private VPC subnet requires a NAT Gateway or VPC Endpoint to communicate with any endpoints on the public internet.
Question 35Question →

A developer is implementing an AWS Lambda function that performs data enrichment. The function must query an Amazon Aurora MySQL database cluster running in a private VPC subnet. In addition, the function must invoke an external public API to retrieve conversion rates and securely access database credentials. The Lambda function is configured to run within the same private VPC subnet. Which configuration will allow the Lambda function to meet these requirements?

Show answer & explanation

Answer: Deploy the Lambda function in the private subnet. Create a NAT Gateway in a public subnet, and add a route in the private subnet's route table pointing 0.0.0.0/0 to the NAT Gateway. Store the database credentials in AWS Secrets Manager, and grant the Lambda execution role permissions to retrieve the secret.

Answer

Deploy the Lambda function in the private subnet, configure a NAT Gateway in a public subnet for external internet traffic, and secure credentials using AWS Secrets Manager with IAM execution role permissions.
The correct configuration deploys the Lambda function in the private subnet to connect locally to the private Aurora database. To access the external API, a NAT Gateway is deployed in a public subnet, and the private subnet's route table is updated to route internet-bound traffic (0.0.0.0/0) through it. Secrets Manager securely stores the database credentials, which the Lambda execution role can retrieve using standard identity-based permissions.

Step-by-Step Solution

1
Determine network access requirements for the Lambda function to reach the Aurora database and the external API.
The Lambda function must be placed in a VPC private subnet to access the private Aurora database. To reach the external API (public internet), it requires a NAT Gateway situated in a public subnet.
Lambda functions associated with a VPC private subnet do not have direct internet access unless outbound traffic is routed through a NAT Gateway or NAT instance.
2
Establish secure storage and access for database credentials.
Store the sensitive credentials in AWS Secrets Manager, and grant the Lambda execution role the necessary IAM permissions (secretsmanager:GetSecretValue) to retrieve them.
Storing credentials in Secrets Manager ensures encryption at rest and transit, supports rotation, and complies with security best practices.
3
Configure routing and security groups.
Add a route to the private subnet's route table directing 0.0.0.0/0 traffic to the NAT Gateway. Ensure the security groups allow outbound traffic from the Lambda function to the database and the NAT Gateway.
Proper route tables and security group rules are required to establish network paths to both local VPC resources and external services.

Key Concept

Configuring VPC routing and external API access for Lambda functions deployed inside private subnets, while securing credentials using AWS Secrets Manager.
Question 36Question →

An asynchronous processing system utilizes an AWS Lambda function to retrieve messages from an Amazon SQS queue and perform updates on an Amazon Aurora PostgreSQL database. The database is hosted in private subnets within a custom VPC. To connect to the database, the Lambda function is associated with the same private subnets. However, the Lambda function fails to retrieve any messages from the queue and times out during execution. How should the network and endpoint configuration be adjusted to allow the function to securely poll the SQS queue?

Show answer & explanation

Answer: Establish an Interface VPC endpoint for Amazon SQS within the private subnets, enabling private DNS hostnames for the VPC endpoint to route requests internally.

Answer

Establish an Interface VPC endpoint for Amazon SQS within the private subnets, enabling private DNS hostnames for the VPC endpoint to route requests internally.
Establishing an Interface VPC endpoint for Amazon SQS inside the private VPC subnets allows the Lambda function to securely and privately access SQS over the AWS internal network. Activating private DNS hostnames ensures that the standard SQS DNS hostname automatically resolves to the private IP addresses of the endpoint network interfaces.

Step-by-Step Solution

1
Analyze the network configuration of the Lambda function.
The Lambda function is placed in a private VPC subnet to access the private Aurora database.
By placing Lambda in a VPC subnet, it loses its default internet connectivity and can only access resources inside the VPC or via VPC gateways/endpoints.
2
Identify the destination endpoint requirements.
The Lambda function needs to communicate with Amazon SQS, which is a public AWS service.
Since the function is in a private subnet with no path to the public internet, it cannot resolve or reach the public SQS endpoint directly.
3
Determine the secure, private solution for AWS service integration.
Create an Interface VPC endpoint (powered by AWS PrivateLink) for SQS in the VPC and enable Private DNS.
This places elastic network interfaces (ENIs) inside the private subnets, allowing the Lambda function to route SQS API calls entirely within the AWS network.

Key Concept

VPC Endpoint Connectivity for Serverless Resources
Estimated Time:1m 30s
Question 37Question →

A developer is configuring an AWS Lambda function to run inside private subnets of a custom VPC. The Lambda function needs to read data from an Amazon Aurora PostgreSQL database located in another private subnet of the same VPC. Additionally, the Lambda function must retrieve database credentials from AWS Secrets Manager. To meet security requirements, all traffic must remain within the AWS network. Which two configurations must the developer implement to allow the Lambda function to connect to both the database and AWS Secrets Manager? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure the security groups to allow outbound traffic from the Lambda function to the database, and inbound traffic to the database from the Lambda function.; Create an Interface VPC Endpoint for AWS Secrets Manager in the private subnets, and configure the Lambda function's security group to allow outbound traffic to the endpoint.

Answer

Configure the security groups to allow outbound traffic from the Lambda function to the database (and inbound traffic to the database from the Lambda function) and create an Interface VPC Endpoint for AWS Secrets Manager in the private subnets, configuring the Lambda function's security group to allow outbound traffic to the endpoint.
To secure communications between resources, security groups must explicitly allow traffic between the Lambda function and the database. Additionally, because the Lambda function resides in a private VPC subnet and must reach AWS Secrets Manager without using the public internet, an Interface VPC Endpoint must be provisioned. This places an Elastic Network Interface in the private subnet to facilitate private communication with Secrets Manager.

Step-by-Step Solution

1
Configure the security groups for the local database connection.
The Lambda function is allowed to initiate outbound connections to the database, and the database accepts inbound connections from the Lambda function on the PostgreSQL port.
Security groups act as stateful firewalls at the resource interface level to allow communication within the VPC.
2
Determine the endpoint type required to access AWS Secrets Manager privately.
Identify that an Interface VPC Endpoint (AWS PrivateLink) is needed for AWS Secrets Manager, as Gateway Endpoints are not supported for this service.
Interface VPC Endpoints allow resources inside private subnets to communicate securely with AWS services without leaving the Amazon network.
3
Establish the Interface VPC Endpoint and configure its security group.
The endpoint is created in the private subnets, and its security group is updated to allow inbound HTTPS traffic from the Lambda function's security group.
Interface endpoints use Elastic Network Interfaces (ENIs) which require security group configurations to permit incoming traffic from client resources.

Key Concept

AWS VPC private connectivity using Security Groups and Interface VPC Endpoints.
Question 38Question →

A developer is configuring an AWS Lambda function that must run inside a private subnet of a custom VPC. The Lambda function needs to retrieve database credentials from AWS Secrets Manager without the traffic traversing the public internet, and it must also call a public API endpoint on the internet to validate transactions. Which of the following network configuration steps are required to allow the Lambda function to perform these tasks? (Select TWO)

Select all that apply

Show answer & explanation

Answer: Deploy a NAT Gateway in a public subnet, and configure the route table of the private subnet to route outbound traffic (0.0.0.0/0) through the NAT Gateway.; Create an Interface VPC Endpoint (AWS PrivateLink) for AWS Secrets Manager in the VPC, and associate it with the private subnet.

Answer

To securely achieve both goals, a NAT Gateway must be deployed in a public subnet to handle internet-bound validation calls, and an Interface VPC Endpoint must be created for AWS Secrets Manager to keep the secrets retrieval traffic private.
To satisfy both requirements, the developer must configure outbound internet access and private AWS service connectivity. A NAT Gateway deployed in a public subnet allows the Lambda function in the private subnet to make outbound calls to the public API. Simultaneously, an Interface VPC Endpoint (AWS PrivateLink) is required for AWS Secrets Manager to ensure that API requests for secrets retrieval do not traverse the public internet.

Step-by-Step Solution

1
Enable internet egress for private subnet resources.
Create a NAT Gateway in a public subnet of the VPC, and add a route in the private subnet's route table directing all outbound internet traffic (0.0.0.0/0) to the NAT Gateway.
This allows the Lambda function inside the private subnet to connect to the public transaction validation API on the internet.
2
Enable private access to AWS Secrets Manager.
Create an Interface VPC Endpoint (AWS PrivateLink) specifically for AWS Secrets Manager, and map it to the private subnet with Private DNS enabled.
This routes the AWS Secrets Manager API calls through a private IP address within the VPC, ensuring that credentials traffic does not traverse the public internet.

Key Concept

Configuring public internet egress and private AWS service access for AWS Lambda functions running inside a private subnet of a custom VPC.
Estimated Time:2m 0s
Question 39Question →

A developer is deploying an AWS Lambda function that processes transaction requests. The function is configured to run within the private subnets of a custom VPC. The Lambda function must connect to a private Amazon RDS PostgreSQL database cluster in the same VPC, call a public API endpoint of an external payment provider, and retrieve parameters from AWS Systems Manager Parameter Store. Which two network and security configurations should the developer implement to enable this connectivity? (Select two.)

Select all that apply

Show answer & explanation

Answer: Configure the RDS database security group to allow inbound TCP traffic on port 54325432 from the security group associated with the Lambda function.; Configure a route in the private subnet route table pointing 0.0.0.0/00.0.0.0/0 to a NAT Gateway deployed in a public subnet.

Answer

To enable connectivity, the developer must allow inbound TCP traffic on port 54325432 from the Lambda function's security group in the RDS database's security group, and configure a route in the private subnet route table directing outbound internet traffic (0.0.0.0/00.0.0.0/0) to a NAT Gateway deployed in a public subnet.
To connect the Lambda function to the RDS database, the database security group must explicitly allow inbound traffic from the security group associated with the Lambda function. Additionally, since the Lambda function runs in a private VPC subnet, it cannot access external endpoints directly. Configuring a route pointing to a NAT Gateway in a public subnet allows the Lambda function to route traffic to the external payment API and Systems Manager Parameter Store.

Step-by-Step Solution

1
Configure the security group of the destination database to permit inbound traffic from the source.
The RDS database cluster security group is updated with a rule allowing inbound TCP traffic on port 54325432 from the Lambda function's security group.
Since both resources reside within the same VPC, communication is routed locally but must be explicitly permitted by the database's security group.
2
Configure outbound routing for external internet endpoints and public AWS services.
A route is added to the private subnet route table directing 0.0.0.0/00.0.0.0/0 traffic to a NAT Gateway deployed in a public subnet.
Lambda functions inside private VPC subnets do not have public IP addresses and cannot connect directly to an Internet Gateway. A NAT Gateway translates their addresses and forwards traffic to the public internet, enabling access to the payment provider API and Systems Manager Parameter Store.

Key Concept

VPC security group rules and routing configurations for Lambda functions in private subnets.
Question 40Question →

A company is building a financial transactions API where an AWS Lambda function, attached to private subnets in a custom VPC, must query a private Amazon Aurora MySQL database. The function also needs to retrieve database credentials from AWS Systems Manager Parameter Store and dispatch transaction receipts to an external payment gateway. Security policies mandate that database traffic and credentials retrieval must not traverse the public internet. Which combination of network configurations and security settings will allow the function to perform all required tasks?

Show answer & explanation

Answer: Associate the Lambda function with the private subnets. Create an interface VPC endpoint for Systems Manager in the private subnets. Deploy a NAT Gateway in a public subnet, and configure the private subnets' route table with a route for 0.0.0.0/00.0.0.0/0 pointing to the NAT Gateway.

Answer

Associate the Lambda function with the private subnets. Create an interface VPC endpoint for Systems Manager in the private subnets. Deploy a NAT Gateway in a public subnet, and configure the private subnets' route table with a route for 0.0.0.0/00.0.0.0/0 pointing to the NAT Gateway.
The correct configuration establishes private connectivity to AWS Systems Manager Parameter Store using an Interface VPC Endpoint, avoiding the public internet. At the same time, it uses a NAT Gateway in a public subnet to allow the Lambda function to securely route outbound internet traffic to the external payment gateway.

Step-by-Step Solution

1
Determine the routing requirements for each destination endpoint.
Database traffic must remain local within the VPC; AWS Systems Manager Parameter Store must be accessed privately within the AWS network; the external payment gateway requires routing to the public internet.
Understanding where traffic needs to route is critical for designing the correct VPC components.
2
Configure the private endpoint for Systems Manager Parameter Store.
Provision an Interface VPC Endpoint (PrivateLink) for Systems Manager (ssm) inside the private subnets.
This routes Parameter Store requests entirely within the AWS network, fulfilling the security requirement that credentials retrieval does not traverse the public internet.
3
Configure outbound routing for external internet access.
Deploy a NAT Gateway in a public subnet (which has a route to the Internet Gateway) and add a route in the private subnets' route table pointing 0.0.0.0/00.0.0.0/0 to the NAT Gateway.
Because Lambda functions inside private subnets lack public IP addresses, they must use a NAT Gateway to send traffic to external endpoints like the payment gateway.

Key Concept

VPC endpoints allow private access to supported AWS services, whereas resources inside private subnets must use a NAT Gateway in a public subnet to communicate with external internet services.
Estimated Time:2m 0s
PreviousPage 2 / 2