SCS-C02 · Question #249
A company has created a set of AWS Lambda functions to automate incident response steps for incidents that occur on Amazon EC2 instances. The Lambda functions need to collect relevant artifacts, such
The correct answer is B. Deploy the Lambda functions to a private subnet in the VPC. Create an S3 gateway endpoint to. Option B is correct because deploying Lambda functions in a private subnet keeps them within the VPC (giving access to EC2 resources), and an S3 gateway endpoint routes all S3-bound traffic through the AWS private network - never touching the public internet - which directly sati
Question
A company has created a set of AWS Lambda functions to automate incident response steps for incidents that occur on Amazon EC2 instances. The Lambda functions need to collect relevant artifacts, such as instance ID and security group configuration. The Lambda functions must then write a summary to an Amazon S3 bucket. The company runs its workloads in a VPC that uses public subnets and private subnets. The public subnets use an internet gateway to access the internet. The private subnets use a NAT gateway to access the internet. All network traffic to Amazon S3 that is related to the incident response process must use the AWS network. This traffic must not travel across the internet. Which solution will meet these requirements?
Options
- ADeploy the Lambda functions to a private subnet in the VPC. Configure the Lambda functions to
- BDeploy the Lambda functions to a private subnet in the VPC. Create an S3 gateway endpoint to
- CDeploy the S3 bucket and the Lambda functions in the same private subnet. Configure the
- DDeploy an Amazon Simple Queue Service (Amazon SOS) queue and the Lambda functions in the
How the community answered
(53 responses)- A11% (6)
- B75% (40)
- C9% (5)
- D4% (2)
Explanation
Option B is correct because deploying Lambda functions in a private subnet keeps them within the VPC (giving access to EC2 resources), and an S3 gateway endpoint routes all S3-bound traffic through the AWS private network - never touching the public internet - which directly satisfies the core requirement.
Option A is wrong because placing Lambda in a private subnet alone is insufficient: without a gateway endpoint, S3 traffic would route through the NAT gateway and out over the internet, violating the "AWS network only" rule. Option C is wrong because S3 is a fully managed regional service - you cannot deploy an S3 bucket into a VPC subnet; it doesn't exist at that network layer. Option D introduces SQS unnecessarily and still doesn't address how S3 traffic avoids the internet.
Memory tip: S3 and DynamoDB use VPC Gateway Endpoints (free, no bandwidth cost) - whenever an exam question says "S3 traffic must stay on the AWS network," the answer always involves a gateway endpoint. Think: "Gateway = goes nowhere near the internet."
Topics
Community Discussion
No community discussion yet for this question.