DEA-C01 Data Store Management Practice Question
Which TWO of the following are valid approaches to implement fine-grained access control for Amazon DynamoDB items based on user attributes? (Choose 2.)
⚠ Common exam trap
Many candidates confuse DynamoDB's fine-grained access control with S3 bucket policies or Lake Formation row-level security, mistakenly applying S3 or data lake concepts to DynamoDB item-level permissions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Amazon Cognito identity pools with IAM roles that include conditions based on user attributes.
Amazon Cognito identity pools can be configured to assume IAM roles with fine-grained policies that use condition keys such as `dynamodb:LeadingKeys` or custom attribute-based conditions. This allows access to DynamoDB items to be restricted based on user-specific attributes (e.g., user ID) without hardcoding permissions per user.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable row-level security in DynamoDB using AWS Lake Formation.
Why it's wrong here
Lake Formation does not integrate with DynamoDB for row-level security.
- ✗
Configure a VPC endpoint with a bucket policy to restrict access to specific items.
Why it's wrong here
VPC endpoints control network access, not item-level access.
- ✓
Use Amazon Cognito identity pools with IAM roles that include conditions based on user attributes.
Why this is correct
Cognito can map user attributes to IAM roles with fine-grained policies.
- ✗
Store user-specific items in separate S3 buckets and use IAM policies to restrict bucket access.
Why it's wrong here
This is for S3, not DynamoDB.
- ✓
Use IAM policies with condition keys like 'dynamodb:LeadingKeys' to restrict access to items with a specific partition key value.
Why this is correct
The LeadingKeys condition allows restricting access to items with a specific partition key.
Go deeper
Related to this question
About these practice questions
This DEA-C01 question is part of Courseiva's 1,711-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.