DEA-C01 Data Operations and Support Practice Question

Exhibit

Refer to the exhibit.
```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "lambda:InvokeFunction"
      ],
      "Resource": [
        "arn:aws:lambda:us-east-1:123456789012:function:my-function"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "kinesis:DescribeStream",
        "kinesis:GetRecords",
        "kinesis:GetShardIterator",
        "kinesis:ListShards"
      ],
      "Resource": [
        "arn:aws:kinesis:us-east-1:123456789012:stream/my-stream"
      ]
    }
  ]
}
```

Refer to the exhibit. A data engineer is configuring an AWS Lambda function to process records from a Kinesis stream. The function is set up with an event source mapping, but no records are being processed. The Lambda function's IAM role has the policy shown. What is the most likely reason for the issue?

⚠ Common exam trap

DEA-C01 often tests the specific IAM permissions required for Lambda event source mappings; candidates may assume that only `GetRecords` is needed, but multiple actions are required.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The IAM policy does not include all the necessary Kinesis actions for the event source mapping to work.

The most likely reason is that the IAM policy does not include all necessary Kinesis actions for the event source mapping to work. Lambda's event source mapping requires permissions to perform actions like `kinesis:GetRecords`, `kinesis:GetShardIterator`, `kinesis:DescribeStream`, and `kinesis:ListStreams`. If any of these are missing, the mapping cannot poll the stream, resulting in no records processed.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The policy does not grant permission to describe the Kinesis stream.
Why it's wrong here
DescribeStream is not required for the event source mapping to poll and invoke; Lambda uses its own service-linked permissions for that. The mapping fails because the role lacks kinesis:GetRecords, GetShardIterator and ListShards. DescribeStream permissions would matter for custom monitoring or tooling that inspects stream metadata.
✓
The IAM policy does not include all the necessary Kinesis actions for the event source mapping to work.
Why this is correct
The event source mapping requires kinesis:GetRecords, GetShardIterator, DescribeStream, ListStreams and ListShards. If the role's policy omits any of these, Lambda cannot poll the stream, so no records are read or invoked despite the mapping existing.
✗
The policy includes too many actions, which causes a conflict.
Why it's wrong here
IAM policies are additive; listing extra actions never conflicts or blocks the required kinesis:GetRecords, GetShardIterator, DescribeStream and ListShards permissions. It is tempting because least-privilege hygiene matters, but over-broad grants are a security concern, not a functional failure — the missing or malformed resource ARN is what actually stops polling.
✗
The resource ARN for the Lambda function in the policy is incorrect.
Why it's wrong here
The policy grants Kinesis stream actions, not Lambda invocation, so the Lambda function's ARN is irrelevant here; the event source mapping polls using the role's kinesis:GetRecords, GetShardIterator, DescribeStream and ListShards permissions on the stream ARN. It is tempting because resource ARNs are a common misconfiguration, but that applies to policies scoped to the wrong stream.

Quick reference

Cloud Service Model Comparison

Model	You Manage	Provider Manages	Examples
IaaS	OS, runtime, apps, data	Hardware, hypervisor, networking	EC2, Azure VMs, GCP Compute Engine
PaaS	Apps and data	OS, runtime, middleware, hardware	Elastic Beanstalk, Azure App Service
SaaS	Data and settings only	Everything else	Microsoft 365, Salesforce, Workday
FaaS / Serverless	Function code only	Infra, scaling, runtime	Lambda, Azure Functions, Cloud Run
CaaS	Containers and apps	Kubernetes, OS, hardware	EKS, AKS, GKE

Go deeper

DEA-C01 Data Operations and Support Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Cloud Service Model Comparison

Related to this question