SAA-C03 Q651 · Networking

Question

A company uses AWS Lambda functions in a private subnet in a VPC to run application logic. The Lambda functions must not have access to the public internet. Additionally, all data communication must remain within the private network. As part of a new requirement, the application logic needs access to an Amazon DynamoDB table. What is the MOST secure way to meet this new requirement?

Accepted Answer

**Answer B: Create a gateway VPC endpoint for DynamoDB** satisfies every requirement:

1. **No public internet access**: Lambda functions are in a private subnet with no NAT Gateway or Internet Gateway route. A Gateway VPC endpoint adds a route in the private subnet's route table that directs DynamoDB traffic through the AWS private network — no internet required.

2. **Data stays within the private network**: Gateway VPC endpoints route traffic through AWS's internal network backbone. Traffic never traverses the public internet, keeping all communication private.

3. **Access to DynamoDB**: DynamoDB is a fully managed regional service with public endpoints by default. Without a VPC endpoint, Lambda in a private subnet simply cannot reach DynamoDB at all (no route to the internet). The gat

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

💰 Cost

🔒 Security

🎯 Exam Tips