DEA-C01 Data Ingestion and Transformation Practice Question
Exhibit
Refer to the exhibit. Resource: "arn:aws:logs:us-east-1:123456789012:log-group:my-log-group:*"
An IAM policy includes the above resource ARN for CloudWatch Logs. A data engineer needs to allow a Lambda function to create log streams and put logs to the log group 'my-log-group'. However, the Lambda function is failing with access denied. What is the issue?
⚠ Common exam trap
Watch out — candidates often assume granting access to the log group ARN implicitly covers log streams, but AWS IAM requires explicit resource-level permissions for each subresource in the ARN hierarchy.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The ARN does not include the log-stream portion.
The ARN provided in the policy is for the log group itself (arn:aws:logs:region:account-id:log-group:my-log-group), but CloudWatch Logs requires separate permissions for the log-stream subresource. To allow a Lambda function to create log streams and put logs, the ARN must include the log-stream portion, typically with a wildcard like arn:aws:logs:region:account-id:log-group:my-log-group:log-stream:*. Without this, the IAM policy does not grant access to the log-stream actions (CreateLogStream, PutLogEvents), causing an access denied error even if the log group ARN is correct.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The region in the ARN does not match the Lambda function's region.
Why it's wrong here
The region matches.
- ✗
The Lambda function does not have an execution role.
Why it's wrong here
The function must have an execution role, but the issue is with the ARN.
- ✓
The ARN does not include the log-stream portion.
Why this is correct
The correct ARN for log streams should be 'arn:aws:logs:us-east-1:123456789012:log-group:my-log-group:log-stream:*'.
- ✗
The ARN is incorrectly formatted because of the wildcard.
Why it's wrong here
Wildcard is allowed.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
One of 1,711 original DEA-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.