DVA-C02 Troubleshooting and Optimization Practice Question
A developer is troubleshooting an AWS Lambda function that returns timeout errors when calling an external HTTPS API. The function is configured with a 30-second timeout and runs in a VPC with a public subnet and NAT Gateway. The developer checks CloudWatch logs and sees that the function is timing out at exactly 30 seconds. What is the most likely cause?
⚠ Common exam trap
Watch out — candidates often assume a NAT Gateway alone provides internet access to Lambda, overlooking that security group egress rules must explicitly allow outbound traffic to the destination.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The Lambda function's security group does not allow outbound traffic.
Lambda functions running in a VPC do not automatically get internet access; they require a route to a NAT Gateway or NAT instance. Even with a NAT Gateway, the Lambda function's security group must allow outbound traffic (e.g., HTTPS on port 443) to reach the external API. Without this rule, outbound packets are dropped, causing the function to hang until the configured timeout (30 seconds) expires, resulting in a timeout error.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The NAT Gateway is not configured with a route to the internet.
Why it's wrong here
If the NAT Gateway itself were not configured with a route to the internet (e.g., its route table lacked a default route to an Internet Gateway), outbound traffic from the private subnet would indeed fail. However, a routing issue typically results in packets being dropped or a different network error, not necessarily a timeout that precisely matches the Lambda function's configured execution timeout. The exact timeout duration strongly suggests a connection attempt is being actively blocked at a firewall level, rather than a routing black hole.
- ✓
The Lambda function's security group does not allow outbound traffic.
Why this is correct
This is the correct explanation. When a Lambda function is configured within a VPC, its network interfaces are subject to the associated security group rules. If the egress (outbound) rules of the security group do not explicitly permit traffic on the required port (e.g., HTTPS on port 443) to the external API's IP range or `0.0.0.0/0`, the connection attempt will be blocked. This blockage prevents the TCP handshake from completing, causing the function to wait indefinitely until its configured execution timeout is reached.
- ✗
The external API's response time exceeds 30 seconds.
Why it's wrong here
If the API response time were the issue, the function would likely hang until the timeout, but the function should have a sensible timeout. The pattern of exactly 30 seconds indicates the function timeout is being reached, not the API delay.
- ✗
The Lambda function's VPC does not have an internet gateway.
Why it's wrong here
The absence of an Internet Gateway (IGW) would prevent any internet-bound traffic from leaving the VPC, including traffic routed through a NAT Gateway. However, a NAT Gateway inherently requires an IGW to function correctly, as it routes traffic to the internet via the IGW. If a NAT Gateway is present and intended to provide internet access, it implies an IGW is also attached to the VPC and properly configured in the public subnet's route table. Therefore, the lack of an IGW is unlikely to be the specific issue if a NAT Gateway is already part of the setup.
Visual reference
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
One of 724 original DVA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.