Examkin

Question

Difficulty: MediumModernizing Workloads with Serverless Architectures (Lambda and API Gateway)

A real-estate Multiple Listing Service (MLS) provider is modernizing its legacy property listing management system by migrating to a serverless architecture on AWS. The application uses Amazon API Gateway and AWS Lambda, and must securely access an Amazon RDS PostgreSQL database located in a private subnet. The application experiences highly variable traffic with sudden, massive spikes during peak hours. The solution must ensure high availability, prevent database connection exhaustion, protect other critical functions in the AWS account from throttling, and support secure cross-account credentials access.

Which combination of actions should a solutions architect take to meet these requirements? (Select TWO.)

  1. Deploy Amazon RDS Proxy in the private subnets across multiple Availability Zones to manage the database connection pool, and configure the Lambda functions to connect to the RDS Proxy endpoint.Answer
  2. Configure reserved concurrency on the Lambda functions processing listing updates to protect the regional concurrency pool of the AWS account from exhaustion.Answer
  3. C
    Deploy a single NAT Gateway in a public subnet to handle all outbound database-bound traffic from the Lambda functions, reducing overall networking costs.
  4. D
    Encrypt database credentials in AWS Secrets Manager using the default AWS managed key (`aws/secretsmanager`) to facilitate simple authentication sharing with consumer applications in external AWS accounts.
  5. E
    Configure a rolling update deployment strategy in the AWS CloudFormation template to deploy Lambda updates, ensuring that traffic shifts immediately and rolls back if database connection limits are exceeded.
  6. F
    Configure provisioned concurrency on the Lambda functions without setting reserved concurrency, ensuring that the functions scale instantly to handle the bursty traffic without affecting database connections.

Answer

Deploy Amazon RDS Proxy in multiple Availability Zones and configure reserved concurrency on the Lambda functions.
To ensure database stability and high availability during traffic spikes, deploying Amazon RDS Proxy across multiple Availability Zones manages the connection pool effectively. To protect other critical functions in the AWS account from throttling, setting reserved concurrency on the listing update functions limits their resource consumption. Together, these two actions address database scaling limits and prevent account-wide resource starvation.

Step-by-Step Solution

1
Evaluate connection pool management and database protection.
Identify that Amazon RDS Proxy manages PostgreSQL connection pools to prevent exhaustion during rapid scaling of serverless functions.
Lambda functions scale rapidly in response to spikes, which can quickly exceed the database's max_connections limit.
2
Address high availability and redundancy requirements.
Ensure RDS Proxy is configured in multiple subnets/Availability Zones, and reject options proposing a single NAT Gateway.
A single NAT Gateway creates a single point of failure, violating the high availability requirement.
3
Evaluate account-wide concurrency limits.
Identify that configuring reserved concurrency prevents a single bursty function from consuming the entire account's regional concurrency pool.
Without reserved concurrency limits, traffic spikes could exhaust the concurrency pool and throttle other critical operations in the account.
4
Evaluate cross-account authentication security.
Determine that a customer managed KMS key is required for cross-account Secrets Manager access.
AWS managed KMS keys do not support policy modification and cannot be shared across accounts.

Key Concept

Modernizing legacy workloads using Lambda and API Gateway requires securing database connections, configuring concurrency limits to prevent account-wide starvation, and ensuring high availability across network and encryption configurations.
Rate this question

Topics

Modernizing Workloads with Serverless Architectures (Lambda and API Gateway)

More questions from this topic