DVA-C02 Security Practice Question
A developer is building a serverless application using AWS Lambda. The Lambda function needs to write logs to CloudWatch Logs. What is the recommended way to grant the necessary permissions?
⚠ Common exam trap
Test-takers frequently confuse resource-based policies (which control who can invoke the function) with execution roles (which control what the function can do), leading them to incorrectly select option C.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Attach an IAM execution role with CloudWatch Logs permissions.
AWS Lambda uses an IAM execution role to obtain temporary credentials for accessing other AWS services. To allow a Lambda function to write logs to CloudWatch Logs, you must attach an IAM role with a policy that includes permissions for the `logs:CreateLogGroup`, `logs:CreateLogStream`, and `logs:PutLogEvents` actions. This is the standard and recommended security practice for granting permissions to Lambda functions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use AWS KMS to encrypt the log data and grant permissions.
Why it's wrong here
AWS KMS is a service designed for creating and managing cryptographic keys to encrypt and decrypt data. While CloudWatch Logs can be configured to use a KMS key for encryption of log data at rest, KMS itself does not provide the necessary permissions for a Lambda function to *write* log events to CloudWatch Logs. The Lambda function requires explicit IAM permissions to perform actions like `logs:CreateLogGroup`, `logs:CreateLogStream`, and `logs:PutLogEvents` to send its output to CloudWatch.
- ✓
Attach an IAM execution role with CloudWatch Logs permissions.
Why this is correct
Attaching an IAM execution role to the Lambda function is the standard and most secure method for granting it permissions to interact with other AWS services. When the Lambda function executes, it assumes this role, which dictates its authorized actions. To enable the function to write logs to CloudWatch, the attached IAM role must include policies explicitly granting permissions such as `logs:CreateLogGroup`, `logs:CreateLogStream`, and `logs:PutLogEvents`.
- ✗
Create a resource-based policy on the Lambda function.
Why it's wrong here
A resource-based policy on a Lambda function defines which principals (e.g., other AWS services, accounts, or users) are allowed to invoke that specific Lambda function. This type of policy grants inbound permissions *to* the function, controlling who can trigger its execution. It does not grant outbound permissions *from* the function to access other AWS services like CloudWatch Logs, making it unsuitable for this purpose.
- ✗
Store AWS access keys in environment variables.
Why it's wrong here
Storing AWS access keys, comprising an Access Key ID and Secret Access Key, directly within environment variables is a highly insecure and non-recommended practice. These static credentials pose a significant security risk if exposed, as they grant long-term access and lack automatic rotation. AWS Lambda functions should instead utilize the temporary credentials provided through an assigned IAM execution role for secure and ephemeral access to AWS services.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
One of 724 original DVA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.