DVA-C02 Development with AWS Services Practice Question
A developer is creating an AWS Lambda function that needs to access files from an Amazon EFS file system. The Lambda function must be configured to access the VPC. Which of the following is required to allow the Lambda function to mount the EFS file system?
⚠ Common exam trap
Many exam-takers confuse the VPC networking permissions required for Lambda to mount EFS (AWSLambdaVPCAccessExecutionRole) with EFS-specific API permissions (AmazonElasticFileSystemClientReadWriteAccess) or a nonexistent efs:MountFileSystem action, leading them to select the wrong policy or permission.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The Lambda function must have the AWSLambdaVPCAccessExecutionRole managed policy attached.
The AWSLambdaVPCAccessExecutionRole managed policy provides the necessary permissions for Lambda to manage elastic network interfaces (ENIs) in a VPC, which is required for Lambda to connect to an EFS file system via mount targets. Without this policy, the Lambda function cannot create or manage the ENI needed to route traffic to the EFS mount target within the VPC.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The Lambda function must have the AWSLambdaVPCAccessExecutionRole managed policy attached.
Why this is correct
The AWSLambdaVPCAccessExecutionRole managed policy is essential because it grants the necessary IAM permissions for Lambda to create, describe, and delete Elastic Network Interfaces (ENIs) within the specified VPC subnets. When a Lambda function is configured to access resources in a VPC, AWS Lambda provisions these ENIs to establish network connectivity, allowing the function to communicate with private resources like EFS file systems. Without these permissions, Lambda cannot integrate into the VPC and therefore cannot reach EFS.
- ✗
The Lambda function must be in the same Availability Zone as the EFS mount target.
Why it's wrong here
This statement is incorrect because EFS is a regional service, and while mount targets are indeed created per Availability Zone, Lambda functions can access EFS from any Availability Zone within the same VPC. EFS provides highly available and durable storage that can be accessed across AZs. As long as the Lambda function is configured within the VPC and has appropriate network connectivity (security groups, routing), it can connect to any EFS mount target in the VPC, regardless of the specific AZ.
- ✗
The Lambda function must have the AmazonElasticFileSystemClientReadWriteAccess managed policy attached.
Why it's wrong here
While the AmazonElasticFileSystemClientReadWriteAccess managed policy grants permissions for data plane operations like mounting, reading, and writing to an EFS file system, it is not the fundamental requirement for a Lambda function to *access* files from EFS via a VPC connection. The primary hurdle for Lambda accessing EFS is establishing network connectivity to the VPC, which is handled by the AWSLambdaVPCAccessExecutionRole. Data access permissions are typically managed by the EFS client within the Lambda runtime, and while this policy *could* be attached, it's not the *minimum* or *core* requirement for the initial VPC-based access.
- ✗
The Lambda function must have the efs:MountFileSystem permission in its execution role.
Why it's wrong here
The efs:MountFileSystem permission is not used by a Lambda function's execution role to connect to an EFS file system. This permission is typically associated with creating or managing EFS mount targets themselves, which is a control plane operation performed by an administrator. Lambda functions, acting as clients, connect to *existing* EFS mount targets using standard NFSv4.1 protocols over the network. The actual "mounting" process within the Lambda execution environment is handled by the EFS client library, relying on network connectivity and security group rules, not an IAM permission for the execution role.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
This DVA-C02 question is part of Courseiva's 724-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.