DVA-C02 Development with AWS Services Practice Question
A company uses AWS Lambda functions behind an API Gateway REST API. The Lambda functions are written in Python and use the boto3 SDK to interact with DynamoDB. After a recent deployment, some users report sporadic 502 Bad Gateway errors when calling the API. The Lambda function logs show occasional 'AccessDeniedException' errors. What is the most likely cause and solution?
⚠ Common exam trap
Many exam-takers confuse 'AccessDeniedException' with throttling or timeout errors, but the specific error message in the logs directly points to an IAM permissions issue, not a capacity or performance problem.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The Lambda execution role lacks permissions to access DynamoDB. Update the role to include the necessary DynamoDB actions.
The 'AccessDeniedException' error in the Lambda logs indicates that the Lambda function's execution role does not have the necessary IAM permissions to perform the requested DynamoDB operation. This is a common misconfiguration after deployments where the role or its attached policies are not updated to include the required DynamoDB actions (e.g., dynamodb:GetItem, dynamodb:PutItem). The 502 Bad Gateway from API Gateway is a direct consequence of the Lambda function failing internally due to this permission error.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The Lambda function is timing out. Increase the timeout value in the Lambda configuration.
Why it's wrong here
A Lambda function timeout would typically result in a 504 Gateway Timeout error from API Gateway, not a 502 Bad Gateway. Furthermore, CloudWatch logs for the Lambda function would explicitly indicate a "Task timed out" message, rather than an "AccessDeniedException". The observed "AccessDeniedException" clearly points to a permissions issue, not an execution duration problem within the function.
- ✗
The DynamoDB table is throttling requests. Enable auto-scaling for the table.
Why it's wrong here
DynamoDB throttling occurs when a table's read or write capacity units are exceeded, leading to a "ProvisionedThroughputExceededException" being returned to the Lambda function. This is distinct from an "AccessDeniedException", which indicates a fundamental lack of authorization to perform any operation on the resource. While auto-scaling can mitigate throttling, it does not resolve permission failures.
- ✓
The Lambda execution role lacks permissions to access DynamoDB. Update the role to include the necessary DynamoDB actions.
Why this is correct
An "AccessDeniedException" from DynamoDB, when invoked by a Lambda function, unequivocally indicates that the Lambda function's IAM execution role does not possess the required permissions to perform the requested DynamoDB actions. Granting specific DynamoDB permissions, such as "dynamodb:GetItem" or "dynamodb:PutItem", to the Lambda's execution role will resolve this authorization error, allowing the function to interact with the table successfully.
- ✗
The API Gateway request is too large. Set the payload size limit higher in API Gateway settings.
Why it's wrong here
An excessively large API Gateway request payload would typically result in a "413 Request Entity Too Large" HTTP status code, not a 502 Bad Gateway error or an "AccessDeniedException". The "AccessDeniedException" specifically points to an authorization failure within the backend Lambda function's interaction with another AWS service, completely unrelated to the size of the initial request received by API Gateway.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
This DVA-C02 question is part of Courseiva's 724-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.