DVA-C02 Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Attach an inline policy to the Lambda function.

  Why it's wrong here

  Attaching an inline policy directly to a Lambda function is not a supported mechanism within AWS IAM. Lambda functions do not act as direct IAM principals that can have policies attached to their resource ARN in this manner. Instead, Lambda functions assume an IAM execution role, and any necessary permissions, whether defined by inline or managed policies, must be attached to that specific role.

• ✓

  Create an IAM execution role with the necessary permissions and associate it with the function.

  Why this is correct

  Creating an IAM execution role with the necessary permissions and associating it with the Lambda function is the correct and standard approach. This execution role defines the specific actions the Lambda function is authorized to perform when it executes, such as reading from S3, writing to DynamoDB, or publishing logs to CloudWatch. The Lambda service assumes this role on behalf of your function, ensuring adherence to the principle of least privilege.

• ✗

  Use a service control policy (SCP) to allow logging.

  Why it's wrong here

  Using a Service Control Policy (SCP) to allow logging is an incorrect approach because SCPs operate at the AWS Organizations level, not at the individual resource level. SCPs define maximum permissions for all IAM principals within an account or Organizational Unit (OU), acting as guardrails to restrict what can be done. They do not grant specific permissions to individual Lambda functions or any other resource; rather, they filter the effective permissions granted by IAM policies.

• ✗

  Add a resource-based policy to the Lambda function.

  Why it's wrong here

  Adding a resource-based policy to the Lambda function is not the correct method for granting the function permissions to interact with other AWS services. A resource-based policy on a Lambda function, often called a Lambda permission policy, specifies *who* (which AWS service or account) is allowed to *invoke* that particular Lambda function. It does not define the permissions the function itself possesses to perform actions like writing logs or accessing other resources during its execution.