AWS Certified Developer Associate · Free Practice Question Medium
Question 6
An AWS Lambda function must be connected to an Amazon VPC private subnet that does not have Internet access. The function also connects to an Amazon DynamoDB table. What MUST a Developer do to enable access to the DynamoDB table?
-
A
Attach an ENI to the DynamoDB table
-
B
Attach an Internet Gateway
-
C
Create a route table
-
D
Configure a VPC endpoint
Reveal correct answer
Correct answer: D
Explanation
To connect to AWS services from a private subnet with no internet access, use VPC endpoints. A VPC endpoint for DynamoDB enables resources in a VPC to use their private IP addresses to access DynamoDB with no exposure to the public internet.
When you create a VPC endpoint for DynamoDB, any requests to a DynamoDB endpoint within the Region (for example, dynamodb.us-west-2.amazonaws.com) are routed to a private DynamoDB endpoint within the Amazon network.
CORRECT: "Configure a VPC endpoint" is the correct answer.
INCORRECT: "Attach an Internet Gateway" is incorrect as you do not attach these to a private subnet.
INCORRECT: "Create a route table" is incorrect as a route table will exist for all subnets and it does not help to route out from a private subnet via the Internet unless an entry for a NAT Gateway or Instance is added.
INCORRECT: "Attach an ENI to the DynamoDB table" is incorrect as you do not attach Elastic Network Interfaces to DynamoDB tables.
References:
https://docs.aws.amazon.com/lambda/latest/dg/troubleshooting-networking.html
https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/vpc-endpoints-dynamodb.html
Save time with our AWS cheat sheets:
Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
