DVA-C02 Troubleshooting and Optimization Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Lambda functions cannot be configured inside a VPC.

  Why it's wrong here

  This is incorrect because Lambda functions can indeed be configured inside a VPC to access resources within the VPC. The issue is about routing to S3, not about whether Lambda can be in a VPC.

• ✗

  The Lambda function's execution role lacks S3 permissions.

  Why it's wrong here

  While IAM permissions are fundamental for authorizing a Lambda function to perform actions like reading from or writing to S3 buckets, this option is incorrect because the problem statement implies that the necessary IAM policies are already attached to the function's execution role. The execution role grants logical access to AWS services, but it does not resolve underlying network connectivity issues that prevent the Lambda function from physically reaching the S3 service endpoints when operating within a VPC.

• ✓

  The Lambda function does not have a route to the internet or a VPC endpoint for S3.

  Why this is correct

  This is correct. When a Lambda function is configured inside a VPC, it loses internet access by default. To access S3, the function needs either a VPC endpoint for S3 or a route to the internet via a NAT Gateway/Instance. Without this, the function times out.

• ✗

  The security group attached to the Lambda function does not allow outbound traffic to S3.

  Why it's wrong here

  This is incorrect because security groups control traffic based on IP addresses, but S3 is accessed via DNS names and IPs may change. The real issue is the lack of a route to S3, not outbound traffic restrictions. Security groups allow outbound traffic by default, so unless explicitly blocked, it is not the cause.