CCSP Cloud Platform and Infrastructure Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Store database credentials in the function code

  Why it's wrong here

  Hardcoding credentials in function code exposes secrets in source control and logs, and grants no network path to a private RDS instance. It is tempting as a quick way to supply authentication, but credential storage belongs in AWS Secrets Manager or Parameter Store, not the deployment package.

• ✗

  Use a NAT Gateway to allow inbound traffic

  Why it's wrong here

  A NAT Gateway translates outbound traffic from private subnets to the internet; it does not accept inbound connections, so it cannot reach RDS. It is correct when private instances need outbound internet access, such as patching, not for enabling a Lambda function to connect inward to a database.

• ✓

  Place the Lambda function inside the VPC using VPC configuration

  Why this is correct

  Placing the Lambda function inside the VPC via VPC configuration gives it an elastic network interface in a private subnet, allowing it to reach the RDS instance over private IP addresses. No public IP or internet gateway is required for the database connection.

• ✗

  Attach an Internet Gateway to the VPC

  Why it's wrong here

  An Internet Gateway provides bidirectional public connectivity for subnets, contradicting the requirement to avoid public IP addresses and exposing RDS. It is the right component when resources must be publicly reachable, whereas private RDS access from Lambda requires VPC configuration and security group rules instead.