VPC endpoints for private access in DynamoDB - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

What is the primary benefit of using a VPC endpoint for DynamoDB?

You want to access your DynamoDB tables securely without using the public internet. What is the main advantage of using a VPC endpoint for this?

A It increases the read and write capacity of DynamoDB tables.

B It allows private, secure access to DynamoDB without exposing traffic to the public internet.

C It automatically encrypts all data stored in DynamoDB tables.

D It enables cross-region replication of DynamoDB tables.

💡 Hint

Think about how network traffic flows when using a VPC endpoint.

A VPC endpoint lets your resources connect to DynamoDB privately within the AWS network, avoiding exposure to the public internet.

❓ query_result

intermediate

Identify the correct VPC endpoint policy effect

Given this VPC endpoint policy snippet, what effect does it have on DynamoDB access? { "Statement": [{ "Effect": "Deny", "Action": "dynamodb:DeleteItem", "Resource": "*" }]} What happens when a user tries to delete an item through this endpoint?

A The delete operation is blocked when using this VPC endpoint.

B The delete operation is allowed without restrictions.

C The delete operation is allowed only for specific tables.

D The delete operation is logged but still allowed.

💡 Hint

Look at the Effect and Action fields in the policy.

The policy explicitly denies the DeleteItem action, so any delete request through this endpoint will be blocked.

📝 Syntax

advanced

Which VPC endpoint configuration is valid for DynamoDB private access?

Select the correct AWS CLI command to create a VPC endpoint for DynamoDB with private access in your VPC.

A aws ec2 create-vpc-endpoint --vpc-id vpc-123abc --service-name com.amazonaws.us-east-1.s3 --vpc-endpoint-type Gateway

B aws ec2 create-vpc-endpoint --vpc-id vpc-123abc --service-name com.amazonaws.us-east-1.dynamodb --vpc-endpoint-type Interface

C aws ec2 create-vpc-endpoint --vpc-id vpc-123abc --service-name com.amazonaws.us-east-1.dynamodb --vpc-endpoint-type Gateway

D aws ec2 create-vpc-endpoint --vpc-id vpc-123abc --service-name com.amazonaws.us-east-1.dynamodb --vpc-endpoint-type GatewayLoadBalancer

💡 Hint

DynamoDB uses a specific type of VPC endpoint.

DynamoDB uses Gateway type VPC endpoints, not Interface or GatewayLoadBalancer types.

❓ optimization

advanced

How to optimize DynamoDB access latency using VPC endpoints?

You notice high latency accessing DynamoDB from your VPC. Which action can reduce latency when using VPC endpoints?

A Create VPC endpoints in multiple Availability Zones and configure your application to use them.

B Switch from Gateway to Interface VPC endpoints for DynamoDB.

C Disable VPC endpoints and access DynamoDB over the public internet.

D Increase the provisioned throughput of your DynamoDB tables.

💡 Hint

Think about network proximity and redundancy.

Creating endpoints in multiple Availability Zones reduces network hops and improves availability and latency.

🔧 Debug

expert

Why does DynamoDB access fail despite VPC endpoint setup?

You created a Gateway VPC endpoint for DynamoDB in your VPC. However, your EC2 instances cannot access DynamoDB privately and get timeout errors. What is the most likely cause?

A The DynamoDB table is in a different AWS region.

B The VPC endpoint policy denies all DynamoDB actions.

C The EC2 instances lack IAM permissions to access DynamoDB.

D The route tables for the subnets do not have routes pointing to the VPC endpoint.

💡 Hint

Check network routing configuration in your VPC.

Gateway endpoints require route table entries directing traffic to the endpoint. Without these, traffic won't reach DynamoDB privately.