CCSP Cloud Platform and Infrastructure Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Assign a public IP to the serverless function

  Why it's wrong here

  A public IP exposes the function to the internet and does not provide private connectivity to the database. It is tempting because public addressing enables outbound access generally, yet the requirement is private reachability, satisfied by placing the function in a VPC with private subnets.

• ✓

  Configure the serverless function with virtual private cloud integration

  Why this is correct

  VPC integration places the function's elastic network interfaces inside private subnets, so traffic to the database stays on the AWS private network and never routes through an internet gateway or NAT. This directly satisfies the requirement to avoid public internet traversal.

• ✗

  Enable public access on the database service

  Why it's wrong here

  Enabling public access exposes the database on its public endpoint, so function traffic still traverses the internet, violating the requirement. It is tempting when private connectivity is unavailable, since it is the quickest way to let a function reach the database, but the correct choice places the function in the database's VPC.

• ✗

  Use a network address translation gateway to route traffic

  Why it's wrong here

  A NAT gateway translates outbound addresses for resources in private subnets reaching the internet; it does not provide private connectivity to a database service. It is tempting because NAT gateways are commonly used to give private subnets outbound access, but the correct choice uses VPC endpoints or private networking.