DVA-C02 Development with AWS Services Practice Question
A developer is deploying an application on Amazon ECS using the Fargate launch type. The application needs to communicate with a DynamoDB table. The developer creates a VPC with private subnets and configures the ECS service to use those subnets. However, the tasks cannot reach DynamoDB. What is the MOST likely cause?
⚠ Common exam trap
A common mix-up: candidates assume IAM permissions (Option A) are the sole cause of access failures, overlooking the network-layer requirement that private subnets need a route to public AWS services via a NAT gateway or VPC endpoint.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The VPC does not have a VPC endpoint for DynamoDB, and there is no NAT gateway.
ECS tasks using the Fargate launch type in private subnets cannot reach public AWS services like DynamoDB unless the VPC has either a NAT gateway (to route traffic through an internet gateway) or a VPC endpoint for DynamoDB. Without one of these, the private subnets have no route to the DynamoDB API endpoints, causing connectivity failures. The IAM role and security group are configured correctly, but the network path is missing.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The task IAM role does not have permissions to access DynamoDB.
Why it's wrong here
While an IAM role grants authorization to perform actions on DynamoDB, it does not establish network connectivity. If the ECS task cannot reach the DynamoDB service endpoint over the network, due to VPC configuration or routing issues, the request will fail regardless of the permissions granted by the IAM role. Network reachability is a prerequisite for successful API calls.
- ✗
The security group of the tasks does not allow outbound traffic to DynamoDB.
Why it's wrong here
AWS security groups are stateful, meaning that if inbound traffic is allowed, the corresponding outbound response is automatically permitted, and vice-versa. By default, security groups allow all outbound traffic, including HTTPS (port 443) to external AWS services like DynamoDB. Therefore, a specific outbound rule to DynamoDB is generally not required unless the default outbound rule has been explicitly restricted.
- ✓
The VPC does not have a VPC endpoint for DynamoDB, and there is no NAT gateway.
Why this is correct
When an ECS task runs in a private subnet, it lacks a direct route to the internet, which is necessary to reach public AWS service endpoints like DynamoDB. Without a NAT Gateway to provide outbound internet access or a VPC endpoint for DynamoDB (a Gateway Endpoint for DynamoDB specifically), the task has no network path to communicate with the DynamoDB service. This configuration prevents any successful API calls from the private subnet.
- ✗
The task definition does not have a network mode that supports DynamoDB.
Why it's wrong here
The network mode specified in an ECS task definition, such as `awsvpc`, `bridge`, `host`, or `none`, primarily dictates how the container's network interface is configured and how it interacts with other containers or the underlying EC2 instance's network. These modes do not inherently grant or deny access to external AWS services like DynamoDB; network reachability is determined by the VPC, subnet, and security group configurations of the underlying infrastructure.
Visual reference
Go deeper
Related to this question
About these practice questions
This DVA-C02 question is part of Courseiva's 724-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.