SAP-C02 Design for New Solutions Practice Question
A company is building a serverless data processing pipeline. Data is uploaded to an S3 bucket, which triggers a Lambda function to transform the data and store the result in another S3 bucket. The Lambda function needs to access a VPC-hosted database for enrichment. What is the MOST secure way to allow the Lambda function to access the VPC resources?
⚠ Common exam trap
Watch out — candidates often think Lambda functions can be assigned public IPs or placed in public subnets like EC2 instances, but Lambda's VPC integration uses ENIs and requires private subnets, and the most secure way to access S3 from within a VPC is via a VPC endpoint, not a NAT Gateway.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure the Lambda function to access the VPC and use a VPC endpoint for S3.
It allows the Lambda function to be attached to a VPC, enabling it to access the VPC-hosted database securely over private IP addresses. Additionally, using a VPC endpoint for S3 ensures that data transfer between Lambda and the S3 buckets remains within the AWS network, avoiding public internet exposure and reducing data transfer costs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Assign a public IP to the Lambda function and route through an Internet Gateway.
Why it's wrong here
Public IP exposure is unnecessary and insecure.
- ✓
Configure the Lambda function to access the VPC and use a VPC endpoint for S3.
Why this is correct
VPC access enables private connectivity to VPC resources; VPC endpoint keeps S3 traffic private.
- ✗
Use Lambda@Edge to process data at the edge location.
Why it's wrong here
Lambda@Edge is for CloudFront events, not for VPC access.
- ✗
Place the Lambda function in a public subnet and use a NAT Gateway.
Why it's wrong here
Public subnet and NAT Gateway are less secure and add complexity.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,660 original SAP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.