Q61 — AWS SAA-C03 Ch.17

Question 61 of 89 | ← Chapter 17

Q1361. A company is building a data processing application that uses AWS Lambda functions. The application's Lambda functions need to communicate with an Amazon RDS DB instance that is deployed within a VPC in the same AWS account.Which solution meets solution meets these requirements in the MOST secure way?

• A. Configure the DB instance to allow public access. Update the DB instance security group to allow access from the Lambda public address space for the AWS Region.
• B. Deploy the Lambda functions inside the VPC. Attach a network ACL to the Lambda subnet. Provide outbound rule access to the VPC CIDR range only. Update the DB instance security group to allow traffic from 0.0.0.0/0.
• C. Deploy the Lambda functions inside the VPC. Attach a security group to the Lambda functions. Provide outbound rule access to the VPC CIDR range only. Update the DB instance security group to allow traffic from the Lambda security group. ✓
• D. Peer the Lambda default VPC with the VPC that hosts the DB instance to allow direct network access without the need for security groups.

Correct Answer: C. Deploy the Lambda functions inside the VPC. Attach a security group to the Lambda functions. Provide outbound rule access to the VPC CIDR range only. Update the DB instance security group to allow traffic from the Lambda security group.

Explanation

The correct answer is C. Deploy the Lambda functions inside the VPC. Attach a security group to the Lambda functions. Provide outbound rule access to the VPC CIDR range only. Update the DB instance security group to allow traffic from the Lambda security group.Explanation:The company needs a secure way for AWS Lambda functions to communicate with an Amazon RDS DB instance inside a VPC. The solution must:Restrict access to the RDS instance (no public exposure).Use least privilege (only allow necessary traffic).Leverage VPC security mechanisms (security groups, subnets).Why Option C is the Best Choice:Lambda inside the VPCEnables private network access to RDS (no need for public internet).Avoids exposing the DB instance to the internet.Security group for LambdaControls outbound traffic (only to the VPC CIDR range where RDS resides).Follows the principle of least privilege (no open access).Security group for RDSRestricts inbound traffic to only the Lambda security group (no 0.0.0.0/0). Ensures only authorized Lambda functions can access the DB.Why Other Options Are Incorrect:A. Allow public access to RDS + Lambda public IPsHighly insecure Exposes the DB instance to the internet (risk of breaches). Lambda functions should not use public IPs when accessing VPC resources. B. Lambda in VPC + network ACL (NACL) + RDS open to 0.0.0.0/0 NACLs are stateless and less granular Security groups are better for fine-grained control. RDS open to 0.0.0.0/0 is a security risk Allows any IP to connect.D. Peer Lambda default VPC with RDS VPCLambda does not have a "default VPC" Lambda functions are stateless and typically run outside a VPC unless explicitly configured.VPC peering is unnecessary Lambda can directly access RDS if deployed in the same VPC.Comparison Table:OptionSecurity (RDS Exposure)Access Control (Least Privilege)Best For C(Private access)(Security groups + CIDR restrictions)Secure Lambda-RDS communication A (Public access) (Open to Lambda public IPs)Never recommended B(Private access) (NACLs + RDS open to world)Overly permissive D (Misconfigured VPC peering) (No proper security controls)Not applicable Conclusion:Option C is the most secure and compliant solution because:Lambda runs inside the VPC No public internet exposure.Security groups enforce least privilege Only authorized traffic is allowed.No unnecessary peering or NACLs Simpler and more secure.Avoid Options A, B, and D (they introduce security risks or misconfigurations).Final Answer: C