Examkin

Question

Difficulty: HardModernizing Workloads with Serverless Architectures (Lambda and API Gateway)

A healthcare provider is modernizing a legacy patient portal on-premises application by migrating it to a serverless architecture on AWS. The application uses Amazon API Gateway integrated with an AWS Lambda function, which queries an Amazon Aurora PostgreSQL database. The application must connect to the database via Amazon RDS Proxy to prevent connection exhaustion. The database is encrypted at rest using an AWS KMS Customer Managed Key (CMK) to allow cross-account audit access. The Lambda function requires outbound internet access to fetch external insurance verification data, and must be protected from high-traffic spikes that could exhaust the regional Lambda concurrency limit. The architecture must remain highly available across multiple Availability Zones (AZs) without single points of failure. Which architectural configuration meets these requirements?

  1. Configure the Lambda function to run in private subnets across multiple Availability Zones (AZs). Route outbound internet traffic from these subnets through a NAT Gateway deployed in each AZ. Configure reserved concurrency on the Lambda function to protect the regional concurrency pool. Configure Amazon RDS Proxy to connect to the Aurora PostgreSQL database, and encrypt the database at rest using a Customer Managed Key (CMK).Answer
  2. B
    Configure the Lambda function to run in private subnets across multiple Availability Zones (AZs). Route outbound internet traffic from these subnets through a single NAT Gateway deployed in a single AZ to minimize costs. Configure reserved concurrency on the Lambda function. Configure Amazon RDS Proxy to connect to the Aurora PostgreSQL database, and encrypt the database at rest using a Customer Managed Key (CMK).
  3. C
    Configure the Lambda function to run in private subnets across multiple Availability Zones (AZs). Route outbound internet traffic from these subnets through a NAT Gateway deployed in each AZ. Do not configure reserved concurrency on the Lambda function, allowing it to scale dynamically using the default regional account concurrency pool. Configure Amazon RDS Proxy to connect to the Aurora PostgreSQL database, and encrypt the database at rest using a Customer Managed Key (CMK).
  4. D
    Configure the Lambda function to run in private subnets across multiple Availability Zones (AZs). Route outbound internet traffic from these subnets through a NAT Gateway deployed in each AZ. Configure reserved concurrency on the Lambda function. Configure Amazon RDS Proxy to connect to the Aurora PostgreSQL database, and encrypt the database at rest using the AWS-managed key (aws/rds).

Answer

Configure the Lambda function to run in private subnets across multiple Availability Zones (AZs). Route outbound internet traffic from these subnets through a NAT Gateway deployed in each AZ. Configure reserved concurrency on the Lambda function to protect the regional concurrency pool. Configure Amazon RDS Proxy to connect to the Aurora PostgreSQL database, and encrypt the database at rest using a Customer Managed Key (CMK).
The correct answer configures a NAT Gateway in each Availability Zone, ensuring that outbound internet access for the Lambda function remains highly available. It also configures reserved concurrency on the Lambda function, which prevents the function from scaling out of control and exhausting the regional concurrency limit. Finally, it uses a Customer Managed Key (CMK) for the database encryption, allowing the team to edit the key policy and grant cross-account audit permissions.

Step-by-Step Solution

1
Select the correct encryption key type for cross-account auditing.
AWS KMS Customer Managed Key (CMK) is chosen.
AWS-managed keys (e.g., aws/rds) have fixed key policies that cannot be modified to grant cross-account permissions. A Customer Managed Key (CMK) is required to configure custom policies for cross-account access.
2
Design the network routing for high availability without single points of failure.
Configure a NAT Gateway in each Availability Zone where private subnets are present.
Routing all outbound internet traffic from multiple private subnets through a single NAT Gateway in one AZ introduces a single point of failure (SPOF). If that AZ goes down, outbound connectivity for all subnets is lost.
3
Configure Lambda concurrency settings to protect account-wide resources.
Configure reserved concurrency on the Lambda function.
By default, Lambda functions share a regional pool of concurrency. Setting reserved concurrency guarantees that this function has a maximum limit, preventing it from consuming the entire regional limit and throttling other critical functions.

Key Concept

Securing and scaling serverless workloads with Lambda and API Gateway requires careful integration of network controls, concurrency limits, and encryption key management.
Estimated Time:2m 30s
Rate this question

Topics

Modernizing Workloads with Serverless Architectures (Lambda and API Gateway)

More questions from this topic