Examkin

Question

Difficulty: MediumModernizing Workloads with Serverless Architectures (Lambda and API Gateway)

A gaming company is modernizing its multiplayer matchmaking lobby backend by migrating to a serverless architecture on AWS. The design features a public Amazon API Gateway HTTP API that routes incoming requests to an AWS Lambda function. The Lambda function must perform low-latency read and write operations against an Amazon ElastiCache for Redis cluster deployed in private subnets across 33 Availability Zones (AZsAZs). The Lambda function also requires outbound internet connectivity to communicate with external gaming partner APIs. Additionally, the Lambda function must retrieve and decrypt game configuration settings stored in a centralized security account, which are encrypted using an AWS KMS key. The architecture must protect other administrative Lambda functions in the same account from concurrency exhaustion during high-traffic peaks, avoid single points of network failure, and ensure that updates to the Lambda function can be rolled back automatically if error rates increase.

Which of the following configurations meets these requirements?

  1. Configure the Lambda function inside the VPC's private subnets across multiple Availability Zones, routing outbound internet traffic through redundant NAT Gateways (one per Availability Zone). Set reserved concurrency on the matchmaking Lambda function. Encrypt game configurations using a Customer Managed Key (CMK) in the central account and update its key policy to allow cross-account access. Deploy the Lambda function using AWS CodeDeploy with a canary deployment configuration and CloudWatch alarm-based rollbacks.Answer
  2. B
    Configure the Lambda function inside the VPC's private subnets across multiple Availability Zones, routing outbound internet traffic through redundant NAT Gateways (one per Availability Zone). Rely on the default regional unreserved concurrency pool to allow the function to scale dynamically to meet spikes. Encrypt game configurations using a Customer Managed Key (CMK) in the central account and update its key policy to allow cross-account access. Deploy the Lambda function using AWS CodeDeploy with a canary deployment configuration and CloudWatch alarm-based rollbacks.
  3. C
    Configure the Lambda function inside the VPC's private subnets across multiple Availability Zones, routing all outbound internet traffic through a single NAT Gateway deployed in one public subnet to reduce operating costs. Set reserved concurrency on the matchmaking Lambda function. Encrypt game configurations using a Customer Managed Key (CMK) in the central account and update its key policy to allow cross-account access. Deploy the Lambda function using AWS CodeDeploy with a canary deployment configuration and CloudWatch alarm-based rollbacks.
  4. D
    Configure the Lambda function inside the VPC's private subnets across multiple Availability Zones, routing outbound internet traffic through redundant NAT Gateways (one per Availability Zone). Set reserved concurrency on the matchmaking Lambda function. Encrypt game configurations using the AWS-managed KMS key for Systems Manager (aws/ssm) in the central account and modify its key policy to grant cross-account decryption access. Deploy the Lambda function using AWS CodeDeploy with a canary deployment configuration and CloudWatch alarm-based rollbacks.

Answer

Configure the Lambda function inside the VPC's private subnets across multiple Availability Zones with redundant NAT Gateways, set reserved concurrency, use a cross-account Customer Managed Key (CMK) for game configuration decryption, and deploy using AWS CodeDeploy canary configuration with CloudWatch alarm-based rollbacks.
The correct answer provides high availability by utilizing private subnets across multiple Availability Zones with redundant NAT Gateways, preventing single-AZ network failures. It protects regional account-level concurrency by explicitly defining reserved concurrency for the matchmaking function. It satisfies the cross-account encryption requirement by utilizing a Customer Managed Key (CMK) with a modified key policy. Finally, it ensures safe deployments with a reduced blast radius through CodeDeploy canary configurations and automated CloudWatch rollbacks.

Step-by-Step Solution

1
Evaluate the networking requirements for high availability and outbound internet access.
The Lambda function needs to be placed inside the private subnets of the VPC to communicate with the private ElastiCache cluster. For internet communication without a single point of failure, outbound traffic must route through redundant NAT Gateways (one per Availability Zone).
Ensuring a NAT Gateway is deployed per Availability Zone prevents a single AZ outage from interrupting outbound internet connectivity.
2
Analyze concurrency management to protect administrative functions.
Apply reserved concurrency to the matchmaking Lambda function to set a dedicated limit on its scaling.
Reserved concurrency acts as both a guarantee for the function and a ceiling that prevents it from consuming the entire regional account-level concurrency pool, which would throttle other functions.
3
Determine the correct KMS configuration for cross-account decryption.
Utilize a Customer Managed Key (CMK) in the central security account and configure the key policy to grant decrypt permissions to the matchmaking Lambda function's IAM role.
AWS-managed keys (e.g., aws/ssm) cannot have their key policies modified and therefore do not support cross-account access.
4
Select the proper deployment strategy to minimize blast radius and support automated rollbacks.
Use AWS CodeDeploy with a canary deployment configuration integrated with CloudWatch alarms.
A canary deployment routes a small percentage of traffic to the new version first and automatically rolls back if CloudWatch alarms (e.g., measuring latency or error rates) are triggered, minimizing blast radius.

Key Concept

Designing secure, highly available, and resilient serverless architectures using AWS Lambda, API Gateway, VPC networking, Reserved Concurrency, Customer Managed Keys, and CodeDeploy Canary deployments.
Rate this question

Topics

Modernizing Workloads with Serverless Architectures (Lambda and API Gateway)

More questions from this topic