nerdexam
Amazon

SAP-C02 · Question #665

A company is running a serverless application that consists of several AWS Lambda functions and Amazon DynamoDB tables. The company has created new functionality that requires the Lambda functions…

The correct answer is B. Create three private subnets in the Neptune VPC, and route internet traffic through a NAT E. Create three private subnets in the Neptune VPC. Host the Lambda functions in the three new. AWS Lambda functions need to access a Neptune DB cluster located in a VPC and also interact with public DynamoDB tables.

Submitted by kim_seoul· Mar 6, 2026Continuous Improvement for Existing Solutions

Question

A company is running a serverless application that consists of several AWS Lambda functions and Amazon DynamoDB tables. The company has created new functionality that requires the Lambda functions to access an Amazon Neptune DB cluster. The Neptune DB cluster is located in three subnets in a VPC. Which of the possible solutions will allow the Lambda functions to access the Neptune DB cluster and DynamoDB tables? (Choose two.)

Options

  • ACreate three public subnets in the Neptune VPC, and route traffic through an internet gateway.
  • BCreate three private subnets in the Neptune VPC, and route internet traffic through a NAT
  • CHost the Lambda functions outside the VPUpdate the Neptune security group to allow access
  • DHost the Lambda functions outside the VPC. Create a VPC endpoint for the Neptune database,
  • ECreate three private subnets in the Neptune VPC. Host the Lambda functions in the three new

How the community answered

(22 responses)
  • A
    5% (1)
  • B
    68% (15)
  • C
    18% (4)
  • D
    9% (2)

Why each option

AWS Lambda functions need to access a Neptune DB cluster located in a VPC and also interact with public DynamoDB tables.

ACreate three public subnets in the Neptune VPC, and route traffic through an internet gateway.

Creating public subnets exposes resources to the internet (if public IPs are assigned), which is generally not recommended for Lambda functions that primarily need to access private VPC resources and DynamoDB, and is less secure than private subnets with a NAT Gateway.

BCreate three private subnets in the Neptune VPC, and route internet traffic through a NATCorrect

Creating private subnets in the Neptune VPC with a NAT gateway allows Lambda functions (when placed in these subnets) to access public AWS services like DynamoDB securely. The NAT gateway provides outbound internet access while keeping the Lambda functions within the VPC for Neptune access.

CHost the Lambda functions outside the VPUpdate the Neptune security group to allow access
DHost the Lambda functions outside the VPC. Create a VPC endpoint for the Neptune database,
ECreate three private subnets in the Neptune VPC. Host the Lambda functions in the three newCorrect

Creating three private subnets in the Neptune VPC and hosting the Lambda functions within these new subnets enables direct private communication between Lambda and the Neptune DB cluster. This also allows the Lambda functions, via a NAT Gateway in those private subnets, to reach the public DynamoDB service.

Concept tested: Lambda VPC access and NAT Gateway for public services

Source: https://docs.aws.amazon.com/lambda/latest/dg/configuration-vpc.html

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full SAP-C02 Practice