DVA-C02 Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  A public NAT gateway only

  Why it's wrong here

  A public NAT gateway provides outbound internet access for resources located in private subnets. While this configuration would allow the Lambda function to reach the public endpoint of AWS Secrets Manager, it routes traffic over the public internet, even if within the AWS backbone. This approach is less secure and less private than dedicated private connectivity, and it incurs additional data transfer costs for traffic processed by the NAT Gateway.

• ✗

  An internet gateway attached to the Lambda subnet

  Why it's wrong here

  An Internet Gateway (IGW) enables direct internet access for resources within public subnets. Attaching an IGW to a Lambda subnet would effectively make that subnet public, exposing the Lambda function to the internet, which is generally not recommended for security best practices. Furthermore, accessing AWS Secrets Manager via its public endpoint, even from a public subnet, does not leverage the private connectivity options available within AWS.

• ✗

  A VPC peering connection to every AWS region

  Why it's wrong here

  VPC peering connections establish private network connectivity between two distinct VPCs, enabling resources in one VPC to communicate with resources in another as if they were on the same network. However, AWS Secrets Manager is a regional AWS service, not a resource residing within a customer's VPC. Therefore, peering with other VPCs, even across regions, would not provide the necessary private access to the Secrets Manager service endpoint itself.

• ✓

  An interface VPC endpoint for Secrets Manager with appropriate security groups

  Why this is correct

  An interface VPC endpoint for Secrets Manager, powered by AWS PrivateLink, establishes a private connection from your VPC to the Secrets Manager service. This allows the Lambda function to retrieve secrets without traffic leaving the Amazon network or traversing the public internet, significantly enhancing security and reducing latency. Configuring appropriate security groups on the endpoint ensures only authorized resources, like the Lambda function, can establish connections.