DVA-C02 Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Place the Lambda function inside a VPC.

  Why this is correct

  By default, Lambda functions run in an AWS-owned VPC and cannot connect to resources in your private subnets. Attaching the function to the same VPC provisions elastic network interfaces in your subnets, giving it private IP connectivity to the RDS instance. This is the foundational step required before any TCP connection to RDS can be established.

• ✓

  Store the database credentials in AWS Secrets Manager and retrieve them in the Lambda code.

  Why this is correct

  Hardcoding database passwords in Lambda environment variables or code creates a security risk and makes rotation difficult. Secrets Manager lets the function call GetSecretValue at runtime to retrieve the current credentials, with IAM permissions controlling which functions may access the secret. This addresses authentication, not networking, so it complements the VPC setup but does not replace it.

• ✗

  Attach an IAM role to the Lambda function that grants rds:* permissions.

  Why it's wrong here

  An IAM role defines permissions for AWS API actions, not for database logins. rds:* would let the Lambda call RDS management endpoints like CreateDBInstance or DescribeDBInstances, but RDS still expects a database user name and password in the connection string. Even when using IAM database authentication, the correct permission is rds-db:connect for a specific database resource, not the blanket rds:* policy, so this option cannot authenticate the function.

• ✗

  Configure the RDS instance to require client certificates.

  Why it's wrong here

  Client certificate verification is a mutual TLS feature that proves the identity of the connecting application, but Lambda functions do not natively present a client certificate for RDS connections. Standard drivers for MySQL, Postgres, or SQL Server do not automatically use the certificate associated with an IAM role or execution environment. Even if enabled, this does not resolve network access or provide the database password, so it is irrelevant to the core requirement and would likely break the connection.

• ✓

  Configure the security group of the RDS instance to allow inbound traffic from the Lambda function's security group.

  Why this is correct

  After the Lambda is placed in the VPC, its associated security group becomes the source for outbound connections, so the RDS instance's security group must permit inbound traffic on the database port from that security group. This stateful rule limits the database to only accept traffic from the Lambda's network interface, providing a precise control plane. It is necessary to actually open the path, but it only works if the Lambda has already been attached to the VPC.