SCS-C02 Question #120: Real Exam Question with Answer & Explanation

Question

A company is running an Amazon RDS for MySQL DB instance in a VPC. The VPC must not send or receive network traffic through the internet. A security engineer wants to use AWS Secrets Manager to rotate the DB instance credentials automatically. Because of a security policy, the security engineer cannot use the standard AWS Lambda function that Secrets Manager provides to rotate the credentials. The security engineer deploys a custom Lambda function in the VPC. The custom Lambda function will be responsible for rotating the secret in Secrets Manager. The security engineer edits the DB instance's security group to allow connections from this function. When the function is invoked, the function cannot communicate with Secrets Manager to rotate the secret properly. What should the security engineer do so that the function can rotate the secret?

Options

• AAdd an egress-only internet gateway to the VPC. Allow only the Lambda function's subnet to
• BAdd a NAT gateway to the VPC. Configure only the Lambda function's subnet with a default route
• CConfigure a VPC peering connection to the default VPC for Secrets Manager. Configure the
• DConfigure a Secrets Manager interface VPC endpoint. Include the Lambda function's private

Explanation

Option D is correct because Secrets Manager is a regional AWS service that normally communicates over the public internet, so a Lambda function inside a VPC with no internet access cannot reach it by default. A Secrets Manager interface VPC endpoint (powered by AWS PrivateLink) creates a private network path from inside the VPC directly to Secrets Manager without any traffic crossing the internet, satisfying both the rotation requirement and the security policy.

Why the distractors fail:

• A (egress-only internet gateway) only handles IPv6 outbound traffic and still routes through the public internet - violating the no-internet policy.
• B (NAT gateway) lets private subnets reach the internet outbound, which directly violates the stated security requirement.
• C is architecturally invalid - Secrets Manager is an AWS-managed regional service, not a customer-owned VPC, so VPC peering cannot be established with it.

Memory tip: The pattern for this family of questions is: "VPC with no internet + needs an AWS service = VPC Endpoint." Interface endpoints (PrivateLink) cover most services like Secrets Manager, SSM, and KMS; Gateway endpoints cover only S3 and DynamoDB. When you see "isolated VPC" + "AWS managed service," reach for an interface VPC endpoint first.

No community discussion yet for this question.