DOP-C02 Monitoring and Logging Practice Question

Exhibit

Refer to the exhibit.

```
Resources:
  MyLambdaFunction:
    Type: AWS::Lambda::Function
    Properties:
      Handler: index.handler
      Role: !GetAtt LambdaExecutionRole.Arn
      Code:
        ZipFile: |
          exports.handler = async (event) => {
            console.log(JSON.stringify(event));
            return { statusCode: 200 };
          };
      Runtime: nodejs18.x
      TracingConfig:
        Mode: Active
  LambdaExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
```

Refer to the exhibit. A CloudFormation template deploys a Lambda function with X-Ray tracing enabled. However, traces are not appearing in the X-Ray console. What is the most likely missing configuration?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The Lambda execution role does not have permissions to upload trace data to X-Ray.

The Lambda function's execution role must have permissions to upload trace data to AWS X-Ray. The default AWSLambdaBasicExecutionRole only grants CloudWatch Logs permissions. To enable X-Ray tracing, the role needs the AWSXRayDaemonWriteAccess policy or equivalent permissions. Option A is incorrect because the Node.js 18 runtime does support X-Ray tracing. Option C is incorrect because setting TracingConfig to 'Active' is correct for enabling tracing; 'PassThrough' would only send traces if the upstream request was sampled, which is not the issue here. Option D is incorrect because the function code does not need to explicitly use the X-Ray SDK to generate traces; when tracing is enabled at the service level, the X-Ray daemon automatically sends invocation traces. The absence of traces points to a permissions issue, not a missing SDK.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The Lambda runtime (nodejs18.x) does not support X-Ray tracing.
Why it's wrong here
The Node.js 18 Lambda runtime fully supports AWS X-Ray; the X-Ray SDK has official packages for Node.js and the runtime includes the required support for service-side tracing. Runtime version determines language support, not whether X-Ray is available, so this cannot be the cause of missing trace data. In fact, nodejs18.x is one of the actively traced runtimes in AWS Lambda.
✓
The Lambda execution role does not have permissions to upload trace data to X-Ray.
Why this is correct
This is the correct diagnosis. When TracingConfig is Active, Lambda runs the X-Ray daemon and attempts to send trace segments and telemetry records on your behalf, but the function's execution role must explicitly allow xray:PutTraceSegments and xray:PutTelemetryRecords. Without those permissions, the daemon cannot upload the trace data to AWS X-Ray, leaving no traces visible in the console even though the function executes normally.
✗
The TracingConfig mode is set to 'Active' but should be 'PassThrough'.
Why it's wrong here
TracingConfig mode should be Active when you want X-Ray to trace every invocation; PassThrough would only emit trace data when a parent tracing header already exists, which is not appropriate for unconditionally enabling tracing. Active is the correct setting for this use case, so the complaint that it 'should be PassThrough' is incorrect. The problem is not the mode but the role permissions.
✗
The Lambda function code does not use the AWS X-Ray SDK.
Why it's wrong here
Using the AWS X-Ray SDK in function code is required only to instrument downstream HTTP calls, databases, and to create custom subsegments; it is not required for Lambda itself to generate and upload the basic service trace. With Active tracing, Lambda automatically creates the invocation segment and the daemon uploads it if the execution role has the right permissions. Missing SDK usage would produce less detailed traces, but it would not prevent the function's own trace from reaching X-Ray.

Quick reference

Cloud Service Model Comparison

Model	You Manage	Provider Manages	Examples
IaaS	OS, runtime, apps, data	Hardware, hypervisor, networking	EC2, Azure VMs, GCP Compute Engine
PaaS	Apps and data	OS, runtime, middleware, hardware	Elastic Beanstalk, Azure App Service
SaaS	Data and settings only	Everything else	Microsoft 365, Salesforce, Workday
FaaS / Serverless	Function code only	Infra, scaling, runtime	Lambda, Azure Functions, Cloud Run
CaaS	Containers and apps	Kubernetes, OS, hardware	EKS, AKS, GKE

Go deeper

DOP-C02 Monitoring and Logging Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Cloud Service Model Comparison

Related to this question