DVA-C02 Deployment Practice Question
Network Topology
A developer is trying to update a CloudFormation stack that includes a Lambda function. The stack rolls back with the error shown. What is the most likely cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The Lambda function's execution role does not have a trust policy that allows Lambda to assume it.
The error message indicates that the IAM role cannot be assumed by Lambda. This typically means the trust policy of the execution role does not include 'lambda.amazonaws.com' as a trusted entity. Option A is incorrect because the error is about assuming the role, not about writing logs. Option B is incorrect because the error is not about the deployment package location. Option C is incorrect because the error is not about code size.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The Lambda function's execution role lacks permissions to write logs to CloudWatch.
Why it's wrong here
An error indicating that the Lambda function's execution role cannot be assumed (e.g., `AccessDeniedException` on `sts:AssumeRole`) occurs during the initial setup or invocation phase. This is distinct from a lack of permissions to write logs to CloudWatch, which would manifest as a runtime error within the function's execution environment, typically an `AccessDenied` error on `logs:CreateLogStream` or `logs:PutLogEvents` after the role has been successfully assumed.
- ✗
The Lambda function's deployment package is not stored in Amazon S3.
Why it's wrong here
CloudFormation deployment errors related to the Lambda function's code package typically manifest as issues with S3 object retrieval, such as 'NoSuchBucket' or 'AccessDenied' for the specified S3 bucket, or 'InvalidParameterValue' if the S3 key is incorrect. The problem described, however, points to a fundamental inability for the Lambda service to take on the specified execution role, which is distinct from package location or accessibility issues.
- ✗
The Lambda function's code is too large for the deployment.
Why it's wrong here
Lambda function code size limits are a deployment constraint, with a maximum zipped package size of 50 MB and an unzipped size of 250 MB. Exceeding these limits would result in a specific error message indicating a 'Code size too large' or 'InvalidParameterValue' during the function creation, not an `sts:AssumeRole` failure related to the role's trust policy, which governs who can assume the role.
- ✓
The Lambda function's execution role does not have a trust policy that allows Lambda to assume it.
Why this is correct
The execution role for an AWS Lambda function requires a trust policy that explicitly permits the `lambda.amazonaws.com` service principal to perform the `sts:AssumeRole` action. Without this crucial trust relationship, the Lambda service is unable to assume the specified role, preventing the successful creation or update of the function and resulting in an `AccessDeniedException` during the CloudFormation deployment.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DVA-C02 question from scratch — 1,135 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.