Verify the Lambda function’s security group allows outbound traffic to 0.0.0.0/0 and Create a NAT gateway in the VPC and route 0.0.0.0/0 from the Lambda private subnets to the NAT gateway are correct because the function is running in private subnets and requires both a routed egress path and permissive security group egress to reach external endpoints while still connecting to the RDS database.

When a Lambda function is placed in private subnets the ENIs receive only private IP addresses and cannot reach the internet directly. A Create a NAT gateway in the VPC and route 0.0.0.0/0 from the Lambda private subnets to the NAT gateway provides a managed translation hop in a public subnet so outbound requests to the third party GraphQL API succeed without exposing the function to inbound internet traffic.

A restrictive security group egress rule can still block outbound connections even with a NAT in place so you must Verify the Lambda function’s security group allows outbound traffic to 0.0.0.0/0 or allow the specific destination ports and IP ranges required by the GraphQL endpoint.

Attach an internet gateway to the VPC and run the function in a public subnet is incorrect because Lambda ENIs created for functions in a VPC do not receive public IP addresses so moving them to a public subnet with an internet gateway will not, by itself, enable outbound internet access.

Submit a request to increase the function’s reserved concurrency limit is incorrect because reserved concurrency controls how many concurrent executions are allowed and it does not affect network routing or internet connectivity.

Create an interface VPC endpoint for the external GraphQL API is incorrect because interface endpoints support specific AWS services and PrivateLink integrated services and cannot be used to reach arbitrary public internet endpoints unless the API provider offers a PrivateLink endpoint.

Full AWS Practitioner Certification Question