DEA-C01 Data Operations and Support Practice Question

A data engineer has set up an AWS Lambda function that processes files uploaded to an S3 bucket. The function is triggered by S3 event notifications. However, the function is not being invoked when a file is uploaded. The engineer checks the Lambda function's CloudWatch Logs and finds no execution logs. What should the engineer check FIRST?

⚠ Common exam trap

DEA-C01 often tests the misconception that a Lambda failure is always a code or IAM issue — candidates must remember that 'no invocation, no logs' points to the trigger configuration (S3 event notification) being missing or misconfigured.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Verify that the S3 bucket has an event notification configured for the Lambda function.

The symptom is that the Lambda function is not invoked at all and there are no CloudWatch execution logs — meaning the function never ran. The first thing to verify is whether the S3 bucket actually has an event notification configured to trigger the Lambda function, since without that configuration no invocation occurs. This is the most direct cause of 'no invocation, no logs.'

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Check the Lambda function's code for errors.
Why it's wrong here
Code errors would produce execution logs and failed invocations, so absent logs indicate the trigger never fired. It is tempting because faulty handler logic is a common Lambda failure, and would be the right first check if logs showed errors or timeouts after invocation.
✗
Verify that the Lambda function's IAM role has permissions to read from S3.
Why it's wrong here
IAM permissions govern what the function can do once running; a denied S3 read still produces an invocation and CloudWatch logs. It is tempting because permission errors are frequent, and would be the right check if logs showed AccessDenied after the function was triggered.
✓
Verify that the S3 bucket has an event notification configured for the Lambda function.
Why this is correct
Without an S3 event notification targeting the Lambda function, uploads never generate an invocation, so no CloudWatch execution logs appear. Confirming the notification configuration first isolates whether the trigger exists before investigating permissions or code.
✗
Check if the Lambda function is attached to a VPC.
Why it's wrong here
VPC attachment affects outbound network access from inside the function, not whether S3 event notifications invoke it; invocation still occurs and logs appear. It is tempting because VPC misconfiguration breaks Lambda connectivity, and would be correct if the function ran but could not reach resources.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

DEA-C01 Data Operations and Support Practice Question

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question