Question 1,234 of 724
DVA-C02 Troubleshooting and Optimization Practice Question
A developer notices that an AWS Lambda function, configured to access an Amazon RDS database in the same VPC, is timing out. The function has a 30-second timeout. CloudWatch Logs show that the function starts execution but never reaches the database. The VPC configuration includes private subnets without a NAT gateway. The RDS database is in the same VPC. What is the most likely cause of the timeout?
⚠ Common exam trap
Many exam-takers assume the Lambda function needs internet access or a NAT gateway to communicate with an RDS database in the same VPC, overlooking the fact that security group rules are the primary control for inbound traffic within a VPC.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The security group of the RDS database does not allow inbound traffic from the Lambda function's security group.
The Lambda function is timing out when trying to connect to the RDS database, which is in the same VPC. The most likely cause is that the RDS database's security group does not have an inbound rule allowing traffic from the Lambda function's security group on the database port (e.g., 3306 for MySQL, 5432 for PostgreSQL). Without this rule, the TCP connection attempt is silently dropped or rejected, causing the Lambda function to wait until its 30-second timeout expires.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The Lambda function does not have internet access because it is in a VPC without a public IP.
Why it's wrong here
Lambda functions deployed within a VPC connect to other resources *within the same VPC* using private IP addresses. Amazon RDS instances are typically deployed in private subnets and are accessed via their private IP within the VPC. Therefore, the Lambda function does not need internet access or a public IP to establish a connection to an RDS instance residing in the same VPC. This option is incorrect because the lack of internet access is irrelevant for intra-VPC communication.
- ✓
The security group of the RDS database does not allow inbound traffic from the Lambda function's security group.
Why this is correct
For a Lambda function to successfully connect to an Amazon RDS database, the RDS instance's security group must explicitly permit inbound traffic on the database port (e.g., 3306 for MySQL, 5432 for PostgreSQL). A common best practice is to configure the RDS security group to allow inbound connections from the *security group associated with the Lambda function's ENIs*. If this rule is missing or incorrectly configured, the connection will be blocked, making this a highly probable cause of connectivity issues.
- ✗
The Amazon RDS database is not publicly accessible and the Lambda function cannot resolve the database endpoint.
Why it's wrong here
When a Lambda function is configured within a VPC, it utilizes the VPC's DNS resolution services. Amazon RDS provides a DNS endpoint that resolves to the private IP address of the database instance within the VPC, regardless of whether the RDS instance is publicly accessible or not. Therefore, the Lambda function can resolve the RDS endpoint and connect to it privately within the VPC, even if the database lacks public accessibility. This option incorrectly assumes public accessibility is required for internal DNS resolution.
- ✗
The VPC does not have a VPC endpoint for Amazon RDS, and the Lambda function cannot access the database through the NAT gateway.
Why it's wrong here
A VPC endpoint for Amazon RDS is specifically used for making API calls to the RDS service (e.g., DescribeDBInstances, CreateDBInstance) from within a VPC, not for establishing direct database connections to an RDS instance. Furthermore, since the Lambda function and the RDS database are both within the same VPC, direct private network connectivity is established. A NAT Gateway is only necessary for resources in private subnets to initiate outbound connections to the internet, which is irrelevant for intra-VPC database communication.
Visual reference
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DVA-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A developer is using AWS Lambda with a VPC configuration. The function needs to access an Amazon RDS instance in the same VPC. The function is timing out after 3 seconds. What is the MOST likely cause?
hard- A.The Lambda function's execution role does not have rds:Connect permission.
- ✓ B.The Lambda function's security group does not allow outbound traffic to the RDS instance.
- C.The Lambda function does not have an RDS proxy configured.
- D.The Lambda function timeout is set too low.
Why B: The most likely cause of the Lambda function timing out when accessing an RDS instance in the same VPC is that the Lambda function's security group does not allow outbound traffic to the RDS instance's security group. Lambda functions in a VPC require security group rules that permit outbound traffic to the database, and inbound rules on the RDS security group to allow traffic from the Lambda function. Option A is incorrect because IAM permissions like rds:Connect are not used for network connectivity; they control API actions. Option C is incorrect because an RDS proxy is not required for Lambda to connect to RDS; it's an optional feature for connection pooling. Option D is incorrect because although increasing the timeout might temporarily mask the issue, the root cause is a network connectivity problem, not the timeout value itself.
Last reviewed: Jun 11, 2026
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.