DVA-C02 Development with AWS Services Practice Question
A developer is building a serverless application using AWS Lambda. The Lambda function needs to access a VPC to connect to an RDS database. Which TWO resources must the developer configure to allow the Lambda function to access the VPC?
⚠ Common exam trap
Many exam-takers confuse the resources needed for VPC access (subnet IDs and security groups) with network infrastructure components (NAT gateway, internet gateway) or database-level permissions (IAM role), but the question specifically asks for the two resources that enable the Lambda function to connect to the VPC network layer, not the database service itself.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A security group that allows inbound/outbound traffic to the RDS database.
A security group acts as a virtual firewall for the Lambda function, controlling inbound and outbound traffic. To connect to an RDS database in a VPC, the Lambda function's security group must allow outbound traffic to the RDS database's security group on the database port (e.g., 3306 for MySQL), and the RDS security group must allow inbound traffic from the Lambda security group. This two-way rule ensures the Lambda function can establish a TCP connection to the database.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A NAT gateway in the VPC.
Why it's wrong here
A NAT gateway is primarily used to enable instances in a private subnet to initiate outbound connections to the internet or other AWS services outside the VPC, while preventing unsolicited inbound connections. For a Lambda function within a VPC to communicate with an RDS database *within the same VPC*, a NAT gateway is not required as this is internal VPC traffic, not outbound internet traffic. Therefore, it does not facilitate the direct connectivity between Lambda and RDS.
- ✓
A security group that allows inbound/outbound traffic to the RDS database.
Why this is correct
A security group acts as a virtual firewall for your RDS database instance, controlling both inbound and outbound traffic at the instance level. To allow a Lambda function to connect to RDS, the RDS security group must have an inbound rule permitting traffic on the database port (e.g., 3306 for MySQL) from the security group associated with the Lambda function's ENI. This ensures network-level access is granted for the serverless application.
- ✓
VPC subnet IDs for the Lambda function.
Why this is correct
To access resources within a Virtual Private Cloud (VPC), such as an RDS database, an AWS Lambda function must be configured to run within that VPC. This requires specifying the VPC's subnet IDs where the Lambda function's Elastic Network Interfaces (ENIs) will be created. These ENIs provide the necessary network connectivity for the Lambda function to communicate privately with other resources inside the VPC.
- ✗
An IAM role with permissions to access RDS.
Why it's wrong here
An IAM role provides authentication and authorization for the Lambda function to interact with AWS services, such as managing the RDS service or assuming roles for database authentication (e.g., IAM database authentication). However, an IAM role does not establish network connectivity between the Lambda function and the RDS database instance itself. Network access is governed by VPC configuration, including subnets and security groups, not IAM permissions.
- ✗
An internet gateway attached to the VPC.
Why it's wrong here
An internet gateway is a horizontally scaled, redundant, and highly available VPC component that allows communication between instances in your VPC and the internet. While essential for public subnets to access the internet, it is not required for a Lambda function to communicate with an RDS database *within the same private VPC*. This communication is entirely internal to the VPC and does not traverse the internet gateway.
Visual reference
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
This DVA-C02 question is part of Courseiva's 724-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.