Lambda Networking: VPC u0026 Subnet Access Essentials Quiz

Explore core concepts of Lambda networking with a focus on VPC connectivity, subnets, and integration patterns. This quiz helps you strengthen your understanding of how compute functions connect securely to private and public resources within virtual networks.

1. VPC Fundamentals

   Which best describes a Virtual Private Cloud (VPC) in cloud networking environments?

   1. A public network open to all internet users
   2. A dedicated physical server located on-premises
   3. A virtual machine with its own local storage
   4. A private, isolated network for resources within a cloud provider

   Explanation: A VPC is a private, isolated segment of the cloud where resources can be launched securely. It is not a physical server (distractor B), nor simply a virtual machine (C). Option D, a public network open to everyone, does not describe the controlled isolation provided by a VPC.

2. Lambda in a VPC

   When a Lambda function is configured to run inside a VPC, what is required for it to access private resources, such as a database in a private subnet?

   1. Disabling all network access controls
   2. Assigning the Lambda to the appropriate subnets and security group
   3. Giving the Lambda a public IP address
   4. Publishing the Lambda to a public repository

   Explanation: To access private resources, the Lambda must be launched within specific subnets and associated with the correct security group for permissions. Giving a public IP (B) or publishing it (D) does not grant access to private resources. Disabling network controls (C) is insecure and not required.

3. Subnet Types

   What is the main distinguishing factor between a public and a private subnet in cloud networking?

   1. Presence of a route to the internet via an internet gateway
   2. The number of resources deployed in the subnet
   3. Whether the subnet is used for compute or storage resources
   4. Amount of local storage available

   Explanation: Public subnets have a route to the internet gateway, making resources accessible from the internet. The other options—storage size (B), resource type (C), and resource quantity (D)—do not determine whether a subnet is public or private.

4. Internet Access for Lambdas

   If a Lambda function inside a private subnet needs to connect to the internet, what is commonly required?

   1. Deploying the Lambda outside the VPC
   2. Decreasing the subnet's CIDR block size
   3. Assigning a static MAC address to the Lambda
   4. A NAT device such as a NAT gateway or instance in a public subnet

   Explanation: A NAT device lets private subnet resources access the internet while staying inaccessible from the outside. Assigning a MAC address (B) or decreasing CIDR (D) doesn’t provide internet access. Deploying the Lambda outside the VPC (C) would remove VPC-level controls.

5. Default Lambda Network Setup

   What is the default network behavior for a Lambda function that is NOT connected to a VPC?

   1. It automatically launches a database
   2. It only has access to the resources in one specific subnet
   3. It can access the internet but not private VPC resources
   4. It cannot access the internet or private VPC resources

   Explanation: By default, Lambda can access the internet but cannot reach resources inside private VPCs. It is not limited to one subnet (C), cannot launch databases on its own (D), and does have internet access, unlike answer B.

6. Security Group Role

   In Lambda networking within a VPC, what is the primary role of a security group assigned to the function?

   1. Managing billing and usage reports
   2. Automatically scaling the Lambda code
   3. Controlling inbound and outbound network traffic
   4. Providing persistent storage for Lambda data

   Explanation: Security groups control allowed network traffic to and from the resources. They do not handle storage (B), scaling (C), or billing (D), which are managed by other components or services.

7. Multiple Subnet Assignment

   Why might you assign multiple subnets to a Lambda function running in a VPC?

   1. To ensure high availability across different Availability Zones
   2. To reduce billing costs
   3. To give Lambda access to more RAM
   4. To increase Lambda’s timeout duration

   Explanation: Assigning multiple subnets, often in different zones, raises reliability if an Availability Zone fails. Extra subnets do not impact RAM (B), Lambda timeouts (C), or directly affect costs (D).

8. Subnet Selection Impact

   What happens if you assign your Lambda function to only private subnets with no NAT configuration and it tries to call an external API?

   1. The Lambda function will fail to execute any code
   2. The Lambda cannot connect to the external API due to no internet access
   3. The Lambda will automatically receive public internet access
   4. The Lambda can still access the internet if it restarts

   Explanation: Without NAT or public access, private subnets prevent outgoing internet connections. Lambdas do not get public access automatically (B), do not fail all execution (C), and do not gain access by restarting (D).

9. Egress-Only Routing

   Which Lambda network configuration method allows only outgoing connections from a private subnet to the internet, blocking incoming connections?

   1. Assigning the Lambda to a public subnet
   2. Attaching an elastic IP directly to Lambda
   3. Removing all route table entries
   4. Using a NAT gateway

   Explanation: A NAT gateway enables resources in private subnets to access the internet outbound, while incoming traffic is blocked. Elastic IPs cannot be directly attached to Lambda (B). Assigning to a public subnet (C) exposes Lambda to the internet, and removing routes (D) cuts all connectivity.

10. Private Resource Connectivity

    A Lambda function needs to connect securely to a database inside a private subnet. Which configuration is necessary?

    1. Assign a public IP address to the Lambda
    2. Give both Lambda and the database the same function name
    3. Launch Lambda in the same VPC and assign proper security group and subnet
    4. Disable all security groups on the database

    Explanation: To connect, the Lambda must be in the same VPC with the right subnet and security group permissions. Assigning a public IP (B) or same function name (D) is not sufficient or relevant. Disabling security groups (C) is insecure and unnecessary.