DVA-C02 Development with AWS Services Practice Question
Exhibit
Refer to the exhibit.
```json
{
"Statement": [
{
"Effect": "Allow",
"Action": [
"dynamodb:GetItem",
"dynamodb:PutItem"
],
"Resource": "arn:aws:dynamodb:us-east-1:123456789012:table/MyTable"
}
]
}
```The above IAM policy is attached to an IAM role used by a Lambda function. The function tries to scan the table 'MyTable' but receives an AccessDenied error. What is the MOST likely cause?
⚠ Common exam trap
The trap here is that candidates often focus on resource ARN or table existence, overlooking that the policy must explicitly include the specific DynamoDB action (e.g., 'dynamodb:Scan') being called by the Lambda function.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The policy does not include the 'dynamodb:Scan' action.
The IAM policy shown in the question does not include the 'dynamodb:Scan' action. Without this action explicitly allowed, the Lambda function's role lacks permission to perform a Scan operation on the DynamoDB table, resulting in an AccessDenied error. The policy must grant the specific action required by the API call.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The DynamoDB table does not exist.
Why it's wrong here
If the DynamoDB table did not exist, the error returned by the DynamoDB service would typically be a `ResourceNotFoundException` or a similar error indicating the resource could not be located. An `AccessDeniedException`, however, explicitly signifies that the principal (the Lambda function's IAM role) successfully identified the target resource but was explicitly prevented from performing the requested action due to insufficient permissions. The service successfully processed the request up to the point of permission evaluation.
- ✗
The IAM role is not attached to the Lambda function.
Why it's wrong here
If the IAM role were not attached to the Lambda function, or if it was improperly configured, the Lambda service itself would typically fail during the function's invocation setup, often with an `InvalidParameterValueException` or an `AccessDeniedException` related to Lambda's ability to assume the role. The error would not originate from the target service (DynamoDB) as an `AccessDeniedException` for a specific DynamoDB action, because the Lambda function would not have successfully assumed a role to even attempt the DynamoDB API call.
- ✗
The resource ARN is incorrect.
Why it's wrong here
An incorrect resource ARN in the IAM policy's `Resource` element would mean the policy grants permissions to a different, non-existent, or unintended resource, effectively not granting permission to the desired table. However, if the Lambda function's code attempts to access the *correct* table ARN, and the policy's `Resource` element is wrong, the error would still be an `AccessDeniedException` because the policy does not apply to the *actual* resource being accessed. If the ARN in the *code* was incorrect, DynamoDB would likely return a `ResourceNotFoundException` for the specified (but wrong) table.
- ✓
The policy does not include the 'dynamodb:Scan' action.
Why this is correct
The `AccessDeniedException` from DynamoDB is the definitive indicator that the IAM principal (the Lambda function's execution role) attempted an API action for which it lacks explicit authorization within its attached IAM policies. If the Lambda function's code is attempting to execute the `Scan` operation, but the IAM policy only permits actions like `GetItem` or `PutItem`, then the `dynamodb:Scan` request will be implicitly denied. IAM operates on an 'explicit allow' model, meaning any action not explicitly allowed is implicitly denied.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
One of 1,135 original DVA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.