DVA-C02 Development with AWS Services Practice Question
A developer is building a serverless application using AWS Lambda that needs to connect to an Amazon RDS MySQL database. The function will be deployed in a VPC. Which resource should the developer use to ensure secure and efficient database connections?
⚠ Common exam trap
It's easy for candidates to confuse VPC Endpoints or PrivateLink with database connectivity, not realizing that RDS Proxy is the only service designed specifically to solve connection management and security for Lambda functions accessing RDS in a VPC.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
RDS Proxy
RDS Proxy is the correct choice because it manages a pool of database connections, allowing Lambda functions to reuse them efficiently and avoid exhausting MySQL connection limits under high concurrency. It also enforces IAM authentication and securely stores credentials in AWS Secrets Manager, eliminating the need to hardcode database passwords in the function code.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
NAT Gateway
Why it's wrong here
A NAT Gateway enables instances in a private subnet to initiate outbound connections to the internet or other AWS services outside the VPC. It translates private IP addresses to public ones, but it does not facilitate direct connections from a Lambda function within a VPC to an RDS database instance residing within the same or a peered VPC. Its purpose is external network access, not internal VPC resource connectivity to a database.
- ✓
RDS Proxy
Why this is correct
RDS Proxy is specifically designed to manage and pool database connections for applications like AWS Lambda, which often create many short-lived connections. It sits between your Lambda function and the RDS database, maintaining a pool of established connections to the database. This significantly reduces the overhead of establishing new connections, improves scalability, and enhances security by integrating with AWS Secrets Manager for credential management and IAM for authentication.
- ✗
VPC Endpoint
Why it's wrong here
A VPC Endpoint allows private connectivity from your VPC to supported AWS services (like S3, DynamoDB, or SQS) or VPC endpoint services powered by AWS PrivateLink, without traversing the public internet. However, RDS database instances are already deployed directly within your VPC and are accessible via their private IP addresses. Therefore, a VPC Endpoint is not applicable or necessary for connecting a Lambda function to an RDS database within the same VPC.
- ✗
AWS PrivateLink
Why it's wrong here
AWS PrivateLink enables private connectivity between VPCs and services hosted by AWS or by other AWS customers (SaaS providers). While RDS Proxy internally leverages PrivateLink for certain cross-VPC or cross-account functionalities, PrivateLink itself is not a direct service or resource that you configure to connect a Lambda function to an RDS database. It's a foundational networking technology for exposing services, not the direct solution for managing database connections for a serverless application.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
This DVA-C02 question is part of Courseiva's 724-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.