DVA-C02 Development with AWS Services Practice Question
Network Topology
A developer is investigating why an AWS Lambda function is not writing logs to CloudWatch Logs. The function has been invoked multiple times, but the log group shows 0 stored bytes. What is the most likely cause?
⚠ Common exam trap
Watch out — candidates often assume a missing log group (Option A) is the root cause, when in fact the log group is automatically created if the IAM permissions are correct, making the permission issue the more fundamental problem.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The Lambda execution role lacks permissions to write to CloudWatch Logs.
The most likely cause is that the Lambda execution role lacks the necessary IAM permissions to write logs to CloudWatch Logs. Without permissions such as `logs:CreateLogGroup`, `logs:CreateLogStream`, and `logs:PutLogEvents`, the Lambda function cannot create the log group or stream, nor can it write log events, resulting in 0 stored bytes despite successful invocations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The CloudWatch Logs log group does not exist.
Why it's wrong here
AWS Lambda functions are designed to automatically create their default CloudWatch Logs log group (named `/aws/lambda/<function-name>`) if it does not already exist, provided the associated execution role has the necessary `logs:CreateLogGroup` permission. Therefore, the absence of a log group is rarely the primary reason for a complete lack of logs. If the function has been invoked multiple times without any log entries, it points to a more fundamental permission issue preventing log creation or writing, rather than the log group simply not existing.
- ✓
The Lambda execution role lacks permissions to write to CloudWatch Logs.
Why this is correct
For an AWS Lambda function to successfully send its runtime logs and any application-specific output (e.g., from `console.log`) to CloudWatch Logs, its associated IAM execution role must possess specific permissions. Crucially, these include `logs:CreateLogStream` to create a new log stream within the log group and `logs:PutLogEvents` to send log data to that stream. Without these explicit permissions, the function will execute, but its logging attempts will silently fail, resulting in no log entries appearing in CloudWatch.
- ✗
The Lambda function is failing before any logging code is executed.
Why it's wrong here
While a function failing early in its execution could prevent application-specific logging statements from being reached, the Lambda service itself generates fundamental runtime logs, such as `START`, `END`, and `REPORT` lines, along with any unhandled exceptions. If *no* logs whatsoever appear in CloudWatch, even these basic service-generated entries, it strongly indicates an issue with the Lambda execution role's permissions to CloudWatch Logs, rather than just an application code failure preventing user-defined logs.
- ✗
The Lambda function is configured to use a different log group name.
Why it's wrong here
AWS Lambda functions, by default, send their logs to a CloudWatch Logs log group named `/aws/lambda/<function-name>`. While it is technically possible to configure a Lambda function to use a custom log group name via environment variables or custom logging libraries, this is not the default behavior. Given that no logs are appearing at all, and assuming standard configuration, it is highly improbable that the function is successfully writing logs to an *entirely different*, unknown log group without any indication.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
This DVA-C02 question is part of Courseiva's 724-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.