AWS Certified Security - Specialty SCS-C02 — Topic 1 Question 266

Question

A company is developing a new serverless application that uses AWS Lambda functions. The company uses AWS CloudFormation to deploy the Lambda functions. The company’s developers are trying to debug a Lambda function that is deployed. The developers cannot debug the Lambda function because the Lambda function is not logging its output to Amazon CloudWatch Logs. Which combination of steps should a security engineer take to resolve this issue? (Choose two.)

Accepted Answer

Correct answer: A, B. The correct answer is A, B. Option A: Check the role that is defined in the CloudFormation template and is passed to the Lambda function. Ensure that the role has a trust policy that allows the sts:AssumeRole action by the service principal lambda amazona... Option B: Check the execution role that is configured in the CloudFormation template for the Lambda function. Ensure that the execution role has the necessary permissions to write to CloudWatch Logs. AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. Amazon CloudWatch collects metrics, logs and alarms to monitor and react to operational health. AWS Config tracks resource configuration changes and evaluates compliance.

AWS Certified Security - Specialty SCS-C02 — Question 266