ANS-C01 Network Management and Operations Practice Question

Exhibit

Refer to the exhibit.

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ec2:CreateNetworkInterface",
                "ec2:DescribeNetworkInterfaces",
                "ec2:DeleteNetworkInterface"
            ],
            "Resource": "*"
        }
    ]
}
```

A network engineer is troubleshooting an AWS Lambda function that needs to create and manage ENIs in a VPC. The Lambda function is unable to create ENIs. The IAM policy attached to the Lambda execution role is shown in the exhibit. What is the issue?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The policy is missing the ec2:AttachNetworkInterface action.

The policy includes permissions for ec2:CreateNetworkInterface, ec2:DescribeNetworkInterfaces, and ec2:DeleteNetworkInterface, but it is missing ec2:AttachNetworkInterface. Without this action, the Lambda function cannot attach an ENI to the VPC, which is necessary for Lambda to manage ENIs. Option A is incorrect because the resource restriction in the policy is not the issue; the actions are allowed on any resource. Option B is incorrect because the policy does include ec2:CreateNetworkInterface. Option C is incorrect because it states the policy does not allow ec2:DeleteNetworkInterface, but it does.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The policy restricts the resource to a specific VPC.
Why it's wrong here
Resource is *, so no restriction.
✗
The policy does not allow the ec2:CreateNetworkInterface action.
Why it's wrong here
The policy allows it.
✗
The policy does not allow the ec2:DeleteNetworkInterface action.
Why it's wrong here
The policy allows it.
✓
The policy is missing the ec2:AttachNetworkInterface action.
Why this is correct
Lambda also needs ec2:AttachNetworkInterface to attach the ENI.

Quick reference

Cloud Service Model Comparison

Model	You Manage	Provider Manages	Examples
IaaS	OS, runtime, apps, data	Hardware, hypervisor, networking	EC2, Azure VMs, GCP Compute Engine
PaaS	Apps and data	OS, runtime, middleware, hardware	Elastic Beanstalk, Azure App Service
SaaS	Data and settings only	Everything else	Microsoft 365, Salesforce, Workday
FaaS / Serverless	Function code only	Infra, scaling, runtime	Lambda, Azure Functions, Cloud Run
CaaS	Containers and apps	Kubernetes, OS, hardware	EKS, AKS, GKE

Go deeper

ANS-C01 Network Management and Operations Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Cloud Service Model Comparison

Related to this question