DVA-C02 Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  The Lambda function is not configured to use a VPC.

  Why it's wrong here

  Lambda functions, by default, execute within AWS's internal network and possess outbound internet access. CloudWatch Logs is an AWS service accessible over the public internet, or optionally via VPC endpoints. Therefore, a Lambda function does not require configuration within a Virtual Private Cloud (VPC) to send its logs to CloudWatch Logs; it can access the service directly from its default execution environment. This VPC configuration is entirely irrelevant to the function's ability to write logs.

• ✗

  The IAM role does not have a trust policy that allows Lambda to assume it.

  Why it's wrong here

  A trust policy is an essential component of an IAM role, defining which entities are permitted to assume that role. If the trust policy were missing or incorrectly configured (e.g., not allowing 'lambda.amazonaws.com' to assume it), the Lambda function would fail to invoke at all, as it would be unable to assume its designated execution role. Since the question implies the function is running but specifically failing to write logs, this foundational invocation issue is not the specific cause of only the logging failure.

• ✓

  The IAM policy does not include logs:CreateLogStream.

  Why this is correct

  For a Lambda function to successfully write logs to CloudWatch Logs, its execution role requires specific permissions. While `logs:PutLogEvents` is necessary to transmit the actual log data, the function also crucially needs `logs:CreateLogStream` to establish a new log stream within the designated log group if one does not already exist for that particular invocation or execution environment. Without this `CreateLogStream` permission, the function cannot initialize the required logging infrastructure, leading to a failure in log delivery, even if it possesses the permission to put events.

• ✗

  The CloudWatch Logs log group does not exist.

  Why it's wrong here

  Lambda functions are designed to automatically create their default log groups (e.g., `/aws/lambda/function-name`) if they do not already exist, provided the associated execution role has the `logs:CreateLogGroup` permission. Even when a custom log group name is specified, Lambda can provision it on demand if the necessary permission is present in the role. Therefore, the non-existence of a CloudWatch Logs log group itself is not inherently a problem, as Lambda can often create it as part of its logging process.