DVA-C02 Development with AWS Services Practice Question
A developer is using AWS SAM to define a serverless application. The application includes an AWS Lambda function that needs to access an Amazon DynamoDB table. The developer wants to grant the Lambda function the minimum required permissions to read and write items in the table. Which resource should the developer use to define the IAM permissions?
⚠ Common exam trap
Many candidates confuse AWS::Lambda::Permission (which controls who can invoke the Lambda) with the IAM permissions needed for the Lambda to access other services, leading them to select Option D instead of the correct Policies property.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS::Serverless::Function Policies property
The AWS::Serverless::Function resource's Policies property allows you to attach IAM policies directly to the Lambda function's execution role in a declarative manner. By specifying a policy statement with dynamodb:GetItem, dynamodb:PutItem, etc., and the ARN of the DynamoDB table, you grant the minimum required permissions for read and write access without manually creating an IAM role. SAM automatically creates and associates the IAM role with the function, simplifying permission management.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS::DynamoDB::Table
Why it's wrong here
This resource type is exclusively used to declare and configure a new Amazon DynamoDB table within your AWS CloudFormation or SAM template. It defines the table's schema, including its primary key, sort key, and other attributes, along with capacity settings. However, it does not grant any IAM permissions to other AWS services, such as a Lambda function, to perform operations like reading or writing data to this table.
- ✗
AWS::IAM::Role
Why it's wrong here
`AWS::IAM::Role` defines the IAM role itself, specifying its name, trust policy, and other properties, but it does not directly define the specific permissions policy statements required for DynamoDB access within the context of an `AWS::Serverless::Function`. This option is tempting because a Lambda function absolutely requires an IAM role to operate and interact with other AWS services. It would be the correct choice if the question asked to define the underlying IAM role resource, not the specific permissions granted to the function via that role in a SAM template.
- ✓
AWS::Serverless::Function Policies property
Why this is correct
The Policies property within an AWS::Serverless::Function resource in a SAM template is the designated and most efficient way to attach IAM permissions to the Lambda function's execution role. This property allows developers to specify predefined SAM policy templates (e.g., DynamoDBReadPolicy) or define custom inline IAM policy statements, granting the function the necessary permissions to interact with other AWS services like DynamoDB. It directly modifies the function's execution role to allow specific actions.
- ✗
AWS::Lambda::Permission
Why it's wrong here
The AWS::Lambda::Permission resource serves a distinct purpose: it grants another AWS service or account permission to invoke a specific Lambda function. For instance, it's used to allow an Amazon S3 bucket to trigger a function upon object creation or an Amazon API Gateway endpoint to call a function. This resource does not define the outbound permissions that the Lambda function itself needs to access other AWS resources, such as reading from or writing to a DynamoDB table.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DVA-C02 question from scratch — 724 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.