DOP-C02 Security and Compliance Practice Question
Network Topology
Refer to the exhibit. A DevOps engineer created an IAM role 'MyLambdaRole' for a Lambda function. The Lambda function needs to write logs to CloudWatch Logs. However, the function is not able to create log streams. What is the most likely missing configuration?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The role does not have an inline or managed policy that grants permissions for CloudWatch Logs.
The IAM role must have an inline or managed policy that grants permissions for CloudWatch Logs actions such as logs:CreateLogStream and logs:PutLogEvents. Option A is incorrect because the role name does not need a prefix; the trust policy is what matters. Option C is incorrect because the role ARN format does not affect log stream creation. Option D is incorrect because the trust policy allowing Lambda to assume the role is separate from the permissions to write logs; the question states the function is not able to create log streams, which indicates a permissions issue within the role's policies.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The role name is not prefixed with 'AWSLambda'.
Why it's wrong here
The role name does not need to begin with 'AWSLambda' or any reserved prefix. IAM role naming conventions are purely organizational; Lambda only requires a valid role that grants the necessary permissions and has a trusted relationship with the lambda.amazonaws.com service principal. Prefixes such as 'AWSLambda' are used in AWS managed policy names, not as a mandatory naming rule for customer-created roles.
- ✓
The role does not have an inline or managed policy that grants permissions for CloudWatch Logs.
Why this is correct
The correct issue is that this Lambda execution role lacks any inline or managed policy granting the required CloudWatch Logs permissions. Without a policy allowing logs:CreateLogGroup, logs:CreateLogStream, and logs:PutLogEvents, Lambda cannot write execution logs to CloudWatch, even though the trust policy is valid. This will cause runtime failures or missing log output, and is a common misconfiguration.
- ✗
The role ARN is incorrectly formatted.
Why it's wrong here
The ARN is correctly formatted for an IAM role: arn:aws:iam::ACCOUNT_ID:role/ROLE_NAME. The required format includes the 'arn:aws:iam::' prefix, the 12-digit account ID, the literal 'role' identifier, and then the role name. Since the ARN shown matches this pattern, the problem is not an ARN syntax issue, so this option is incorrect.
- ✗
The trust policy does not allow Lambda to assume the role.
Why it's wrong here
The trust policy is adequate because it grants the lambda.amazonaws.com service principal permission to assume the role. This is verified by the AssumeRolePolicyDocument containing a statement with 'Service': 'lambda.amazonaws.com' in the principal and the 'sts:AssumeRole' action. Without this, Lambda would be unable to assume the role at invocation time, but since this element is present, the trust policy is not the cause of the problem.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DOP-C02 question from scratch — 1,298 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.