DVA-C02 Security Practice Question
A developer is building a serverless application using AWS Lambda. The Lambda function needs to read messages from an Amazon SQS queue and write items to an Amazon DynamoDB table. The developer wants to follow the principle of least privilege and avoid hardcoding credentials. Which approach should the developer use to grant the Lambda function the necessary permissions?
⚠ Common exam trap
A common mix-up: candidates confuse Lambda resource policies with execution roles; resource policies control who can invoke the function, not what the function can access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an IAM role with the required permissions and configure it as the Lambda function's execution role. Lambda will assume this role automatically.
The Lambda execution role is assumed by the function at runtime, providing temporary credentials with the permissions defined in the role's policies. This approach eliminates the need to manage long-term credentials and adheres to least privilege. Other methods either involve long-term credentials or misunderstand the purpose of resource policies.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create an IAM role with the required permissions and configure it as the Lambda function's execution role. Lambda will assume this role automatically.
Why this is correct
Lambda functions assume an execution role to obtain temporary credentials for accessing AWS services. By attaching an IAM role with the necessary SQS and DynamoDB permissions, the function can securely interact with these services without hardcoded credentials. This follows least privilege and is the AWS-recommended approach for Lambda permissions.
- ✗
Create an IAM user with programmatic access and store the access key ID and secret access key as environment variables in the Lambda function configuration.
Why it's wrong here
Storing long-term IAM user credentials as environment variables violates least privilege and security best practices. If the Lambda function is compromised, the attacker gains persistent access. Additionally, rotating credentials requires manual intervention. Lambda execution roles are the correct mechanism for granting permissions to Lambda functions without embedding credentials.
- ✗
Attach an IAM policy directly to the Lambda function's resource policy that grants access to SQS and DynamoDB.
Why it's wrong here
Lambda resource policies control which AWS services or accounts can invoke the function, not what the function can access. They do not grant permissions for the function to call other AWS services. The correct way to grant outbound permissions is through the execution role, not a resource policy.
- ✗
Store the AWS credentials in AWS Secrets Manager and have the Lambda function retrieve them at runtime using the Secrets Manager API.
Why it's wrong here
While Secrets Manager is useful for storing sensitive data, using it to store IAM user credentials for Lambda is unnecessary and less secure than using an execution role. The Lambda function would still require permissions to access Secrets Manager, and the retrieved credentials would be long-term, increasing risk. Execution roles provide temporary credentials automatically.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DVA-C02 question from scratch — 1,135 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.