SAP-C02 Design for New Solutions Practice Question
A company is designing a new serverless application using AWS Lambda. The application must be invoked by an Amazon S3 bucket event. The company wants to ensure that the Lambda function has the necessary permissions to be invoked. Which THREE steps are required?
⚠ Common exam trap
Watch out — candidates often confuse event source mappings (used for polling-based triggers like SQS or DynamoDB Streams) with S3 event notifications, which are push-based and require only a resource-based policy and a bucket notification configuration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add a resource-based policy to the Lambda function that grants S3 permission to invoke it.
Lambda uses a resource-based policy (also known as a function policy) to grant other AWS services, such as S3, permission to invoke the function. Without this policy, S3 does not have the necessary invoke permissions, and the Lambda function will reject the invocation request.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Add a resource-based policy to the Lambda function that grants S3 permission to invoke it.
Why this is correct
A resource-based policy (function policy) allows S3 to invoke the Lambda function.
- ✓
Configure an S3 bucket notification event to send events to the Lambda function.
Why this is correct
S3 bucket notification configuration triggers Lambda on events.
- ✗
Attach an IAM role to the S3 bucket that allows it to invoke Lambda functions.
Why it's wrong here
S3 does not assume an IAM role to invoke Lambda; it uses resource-based policies.
- ✗
Create an event source mapping in Lambda for the S3 bucket.
Why it's wrong here
S3 events use push model; no event source mapping is needed.
- ✓
Create an IAM role for the Lambda function with permissions to read from the S3 bucket.
Why this is correct
The Lambda function needs IAM permissions to access the S3 object.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,660 original SAP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SAP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company is designing a new serverless application using AWS Lambda. The application must process files uploaded to an S3 bucket. Each file can be up to 1 GB in size. The processing time for each file is expected to be up to 15 minutes. The company wants to minimize cost and operational overhead. Which TWO configuration choices should the company make? (Choose TWO.)
medium- A.Mount an Amazon EFS file system to the Lambda function for temporary storage.
- B.Use S3 event notifications to send the file content directly to Lambda.
- C.Extend the Lambda function timeout to 30 minutes.
- ✓ D.Configure S3 to send event notifications to the Lambda function.
- ✓ E.Set the Lambda function timeout to 15 minutes.
Why D: S3 event notifications can be configured to invoke a Lambda function when an object is created, providing an event-driven architecture that eliminates the need for polling or custom triggers. Option E is correct because the maximum execution timeout for AWS Lambda is 15 minutes (900 seconds), and setting it to 15 minutes allows the function to process files up to the expected processing time without exceeding the service limit.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.