DVA-C02 Troubleshooting and Optimization Practice Question
A developer is using AWS Lambda with a VPC configuration. The function needs to access an Amazon RDS instance in the same VPC. The function is timing out after 3 seconds. What is the MOST likely cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The Lambda function's security group does not allow outbound traffic to the RDS instance.
The most likely cause of the Lambda function timing out when accessing an RDS instance in the same VPC is that the Lambda function's security group does not allow outbound traffic to the RDS instance's security group. Lambda functions in a VPC require security group rules that permit outbound traffic to the database, and inbound rules on the RDS security group to allow traffic from the Lambda function. Option A is incorrect because IAM permissions like rds:Connect are not used for network connectivity; they control API actions. Option C is incorrect because an RDS proxy is not required for Lambda to connect to RDS; it's an optional feature for connection pooling. Option D is incorrect because although increasing the timeout might temporarily mask the issue, the root cause is a network connectivity problem, not the timeout value itself.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The Lambda function's execution role does not have rds:Connect permission.
Why it's wrong here
The rds:Connect permission is primarily used when connecting to an RDS instance via IAM database authentication, which allows IAM users or roles to authenticate directly with the database. For standard database connections, a Lambda function typically uses traditional username and password credentials stored securely, for example, in AWS Secrets Manager. Therefore, the absence of rds:Connect in the Lambda execution role would not prevent connectivity if traditional authentication methods are being employed.
- ✓
The Lambda function's security group does not allow outbound traffic to the RDS instance.
Why this is correct
When a Lambda function is configured within a VPC, its associated security groups govern both inbound and outbound network traffic. For the Lambda function to successfully establish a connection to an RDS instance, its security group must explicitly have an outbound rule permitting traffic to the RDS instance's private IP address or its security group, specifically on the database's listening port (e.g., 3306 for MySQL, 5432 for PostgreSQL). Without this crucial outbound rule, network packets cannot reach the database, resulting in connection failures.
- ✗
The Lambda function does not have an RDS proxy configured.
Why it's wrong here
An RDS Proxy is an optional, fully managed database proxy that helps improve application scalability, resilience, and security by managing database connections and connection pooling. While it offers significant benefits for production workloads, such as reducing the number of open connections on the database and handling failovers, it is not a mandatory component for a Lambda function to establish a direct connection to an RDS instance. A Lambda function can connect directly to an RDS endpoint without an intermediary proxy.
- ✗
The Lambda function timeout is set too low.
Why it's wrong here
A low Lambda function timeout primarily affects operations that take longer than the configured duration to complete, causing the function to terminate prematurely. If the underlying problem is a fundamental network connectivity issue, such as blocked outbound traffic by a security group, the connection attempt will fail almost immediately or after a short network timeout, long before the Lambda function's execution timeout is reached. Increasing the timeout would only prolong the waiting period for a connection that will never be established due to network configuration errors.
Visual reference
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
One of 1,135 original DVA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.