Examkin

Question

Difficulty: HardModernizing Workloads with Serverless Architectures (Lambda and API Gateway)

A financial technology corporation is modernizing its legacy on-premises payment settlement API by migrating it to a serverless architecture on AWS. The solution must expose a private API to consumer applications deployed across multiple AWS accounts within the same AWS Organization. The architecture must satisfy the following requirements:
- All API communication must remain strictly within the AWS network.
- Cross-account consumers must authenticate using custom tokens verified by a central security account, which signs payloads using a custom AWS KMS key.
- The backend AWS Lambda functions must access a relational database securely.
- A sudden volume spike in a secondary, non-critical reporting API must not throttle or exhaust the execution capacity of the critical payment settlement API.
- The outbound traffic from the VPC-integrated Lambda functions to external verification endpoints must be highly resilient against Availability Zone failures.

Which of the following architectures meets these requirements while adhering to AWS best practices?

  1. A
    Create an Amazon API Gateway private REST API. Create an interface VPC endpoint (AWS PrivateLink) for API Gateway in each consumer VPC. Configure a custom Lambda authorizer that uses the default AWS-managed KMS key for API Gateway (aws/apigateway) to verify signed tokens from the central security account. Allocate reserved concurrency to the critical payment settlement Lambda functions. Deploy the VPC-integrated Lambda functions across multiple Availability Zones, routing outbound traffic through a dedicated NAT Gateway in each Availability Zone.
  2. B
    Create an Amazon API Gateway private REST API. Create an interface VPC endpoint (AWS PrivateLink) for API Gateway in each consumer VPC, using endpoint policies to restrict access. Configure a custom Lambda authorizer that uses a Customer Managed Key (CMK) in AWS KMS, with a key policy that grants cross-account decrypt permissions. Deploy the VPC-integrated Lambda functions across multiple Availability Zones, routing outbound traffic through a dedicated NAT Gateway in each Availability Zone. Run both the reporting and critical settlement Lambda functions using the default unreserved regional concurrency pool to maximize resource sharing.
  3. Create an Amazon API Gateway private REST API. Create an interface VPC endpoint (AWS PrivateLink) for API Gateway in each consumer VPC, using endpoint policies to restrict access. Configure a custom Lambda authorizer that uses a Customer Managed Key (CMK) in AWS KMS, with a key policy that grants cross-account decrypt permissions to verify the signed tokens. Allocate reserved concurrency to the critical payment settlement Lambda functions to protect their capacity. Deploy the VPC-integrated Lambda functions across multiple Availability Zones, routing outbound traffic through a dedicated NAT Gateway in each Availability Zone.Answer
  4. D
    Create an Amazon API Gateway private REST API. Create an interface VPC endpoint (AWS PrivateLink) for API Gateway in each consumer VPC, using endpoint policies to restrict access. Configure a custom Lambda authorizer that uses a Customer Managed Key (CMK) in AWS KMS, with a key policy that grants cross-account decrypt permissions. Allocate reserved concurrency to the critical payment settlement Lambda functions. Deploy the VPC-integrated Lambda functions across multiple Availability Zones, but route all outbound traffic through a single NAT Gateway located in a single public subnet to reduce NAT Gateway hourly charges.

Answer

The correct architecture uses a private REST API with interface VPC endpoints, a Customer Managed Key for cross-account authorization, dedicated NAT Gateways in each Availability Zone for resilient outbound routing, and reserved concurrency limits on the critical Lambda functions to protect execution capacity.
The correct architecture uses a private REST API with interface VPC endpoints to ensure traffic does not traverse the public internet. It leverages a Customer Managed Key (CMK) with an explicit key policy because AWS-managed keys cannot be modified to grant cross-account decryption rights. To guarantee that traffic spikes on the secondary reporting API do not impact the payment settlement system, it assigns a reserved concurrency limit to the settlement functions, securing their execution capacity. Finally, it routes outbound VPC traffic through dedicated NAT Gateways in each Availability Zone to eliminate single points of failure.

Step-by-Step Solution

1
Establish secure private connectivity between cross-account consumer applications and the backend API.
Private REST API in API Gateway accessed via interface VPC endpoints (PrivateLink) with endpoint policies restricting access.
Ensures all API traffic remains strictly within the AWS network, fulfilling the security requirement without traversing the public internet.
2
Set up the custom Lambda authorizer to decrypt and verify the cross-account tokens.
Lambda authorizer configured using a KMS Customer Managed Key with a key policy allowing cross-account decryption.
AWS-managed KMS keys cannot be shared across accounts because their key policies cannot be modified. A CMK is required for cross-account token decryption.
3
Configure compute resource limits to prevent service degradation during traffic spikes.
Allocate reserved concurrency to the critical payment settlement Lambda functions.
Guarantees a dedicated execution capacity for critical settlement functions, preventing throttling when the secondary reporting API spikes and consumes concurrency.
4
Design the VPC routing for the VPC-integrated Lambda functions to connect to external endpoints.
Route outbound traffic from Lambda functions through a dedicated NAT Gateway deployed in each Availability Zone.
Eliminates single points of failure, ensuring that outbound internet routing remains highly available even if an entire Availability Zone fails.

Key Concept

Modernizing applications using private API Gateway endpoints, custom Lambda authorizers with cross-account KMS CMKs, reserved concurrency for resource isolation, and redundant NAT Gateways.
Estimated Time:3m 0s
Rate this question

Topics

Modernizing Workloads with Serverless Architectures (Lambda and API Gateway)

More questions from this topic