DVA-C02 Troubleshooting and Optimization Practice Question

A developer notices that an AWS Lambda function configured with a VPC is timing out when trying to access an Amazon S3 bucket. The function has the necessary IAM permissions. What is the most likely cause?

⚠ Common exam trap

DVA-C02 often tests the misconception that security groups block outbound traffic by default — they don't (they're stateful and allow all egress unless restricted), so the real culprit in VPC-attached Lambda timeouts is almost always missing NAT or VPC endpoint routing.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The Lambda function does not have a route to the internet or a VPC endpoint for S3.

When a Lambda function is attached to a VPC, it loses the default internet access it normally has and can only reach resources within that VPC's subnets. To reach S3, the function must either route through a NAT gateway/instance to the public internet or use an S3 Gateway VPC Endpoint, which provides private connectivity without traversing the internet.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Lambda functions cannot be configured inside a VPC.
Why it's wrong here
This is incorrect because Lambda functions can indeed be configured inside a VPC to access resources within the VPC. The issue is about routing to S3, not about whether Lambda can be in a VPC.
✗
The Lambda function's execution role lacks S3 permissions.
Why it's wrong here
While IAM permissions are fundamental for authorizing a Lambda function to perform actions like reading from or writing to S3 buckets, this option is incorrect because the problem statement implies that the necessary IAM policies are already attached to the function's execution role. The execution role grants logical access to AWS services, but it does not resolve underlying network connectivity issues that prevent the Lambda function from physically reaching the S3 service endpoints when operating within a VPC.
✓
The Lambda function does not have a route to the internet or a VPC endpoint for S3.
Why this is correct
This is correct. When a Lambda function is configured inside a VPC, it loses internet access by default. To access S3, the function needs either a VPC endpoint for S3 or a route to the internet via a NAT Gateway/Instance. Without this, the function times out.
✗
The security group attached to the Lambda function does not allow outbound traffic to S3.
Why it's wrong here
This is incorrect because security groups control traffic based on IP addresses, but S3 is accessed via DNS names and IPs may change. The real issue is the lack of a route to S3, not outbound traffic restrictions. Security groups allow outbound traffic by default, so unless explicitly blocked, it is not the cause.

Visual reference

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

DVA-C02 Troubleshooting and Optimization Practice Question

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question