SAP-C02 Design for New Solutions Practice Question
A company is designing a new serverless application using AWS Lambda. The Lambda function needs to access an Amazon RDS database. The database is in a VPC without public internet access. What is the MOST secure way to allow the Lambda function to connect to the database?
⚠ Common exam trap
Many exam-takers confuse VPC endpoints (used for API calls to AWS services) with database connectivity, leading them to incorrectly select Option B, or they overcomplicate the solution with a load balancer (Option C) when a direct VPC attachment is the simplest and most secure approach.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure the Lambda function to access the VPC, and place it in the same subnets as the RDS instance.
Placing the Lambda function in the same VPC subnets as the RDS instance allows it to communicate directly over private IP addresses using the VPC's internal routing. This eliminates exposure to the public internet and leverages security groups to control traffic at the instance level. Lambda functions must be configured with VPC access to connect to resources inside a VPC, and placing them in the same subnets ensures minimal latency and maximum security.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Configure the Lambda function to access the VPC, and place it in the same subnets as the RDS instance.
Why this is correct
Lambda can connect to resources in a VPC via an Elastic Network Interface (ENI) in the same subnets.
- ✗
Create a VPC endpoint for Amazon RDS and use it from Lambda.
Why it's wrong here
VPC endpoints are for accessing AWS services like S3 or DynamoDB, not RDS instances.
- ✗
Use an AWS Network Load Balancer in front of the RDS instance and connect Lambda to the NLB.
Why it's wrong here
NLB is not designed for database access; it adds unnecessary complexity and latency.
- ✗
Create a public endpoint for the RDS instance and allow Lambda to connect over the internet.
Why it's wrong here
This exposes the database to the internet, which is insecure and against requirements.
Visual reference
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
This SAP-C02 question is part of Courseiva's 1,660-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.