DVA-C02 Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  The Lambda execution role lacks kms:Encrypt and kms:Decrypt permissions on the customer-managed KMS key.

  Why this is correct

  The Lambda execution role requires kms:Encrypt and kms:Decrypt permissions on the customer-managed KMS key (CMK) when interacting with a DynamoDB table encrypted with that CMK. Although DynamoDB handles the actual encryption and decryption at rest, it performs these KMS operations on behalf of the calling principal, which is the Lambda function in this scenario. Without these specific KMS permissions granted to its execution role, the Lambda function cannot authorize DynamoDB to use the CMK for data operations, leading to access denied errors when attempting to write or read items.

• ✗

  The Lambda execution role does not have DynamoDB write permissions.

  Why it's wrong here

  This option is incorrect because the existing note explicitly states the Lambda execution role *does* have dynamodb:PutItem permission. dynamodb:PutItem is the specific and primary permission required for a Lambda function to write new items into a DynamoDB table. Therefore, a general lack of DynamoDB write permissions is not the root cause of the problem, as the necessary permission for the intended write operation is already in place.

• ✗

  The DynamoDB table has a resource-based policy that denies access.

  Why it's wrong here

  DynamoDB tables do not support resource-based policies in the same manner as services like S3 or KMS, which allow direct attachment of policies to the resource itself to control access. Access to DynamoDB tables is primarily governed by IAM policies attached to the calling principal's role or user. While IAM policies can deny access, the premise of a "resource-based policy on the DynamoDB table" directly denying access is fundamentally inaccurate for DynamoDB's security model.

• ✗

  The Lambda function is not in a VPC, so it cannot access the KMS key.

  Why it's wrong here

  AWS Key Management Service (KMS) is a global service accessible via public API endpoints over the internet. Consequently, a Lambda function does not need to be deployed within a Virtual Private Cloud (VPC) to establish communication with KMS and perform cryptographic operations. VPC configuration for Lambda is typically necessary only when the function needs to access private resources within a VPC or utilize VPC endpoints for specific AWS services, which is not the case for standard KMS interactions.