DBS-C01 Database Security Practice Question
A company is using Amazon DynamoDB and wants to restrict access to a specific table so that only users in a particular IAM group can perform read and write operations. Which THREE steps should be taken to achieve this?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an IAM policy that allows dynamodb:GetItem, dynamodb:PutItem, etc. on the specific table ARN.
The correct answers are A, B, and D. To restrict access to a specific DynamoDB table, you create an IAM policy that allows the required DynamoDB actions on that table's ARN (A). You then attach that policy to an IAM group (B), and add the users who need access to that group (D). Options C and E are incorrect because DynamoDB does not support resource-based policies, and IAM roles are not directly assigned to tables for access control.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create an IAM policy that allows dynamodb:GetItem, dynamodb:PutItem, etc. on the specific table ARN.
Why this is correct
This defines the allowed actions on the table.
- ✓
Attach the IAM policy to an IAM group.
Why this is correct
Attaching to the group applies the policy to all group members.
- ✗
Attach a resource-based policy to the DynamoDB table allowing access from the group.
Why it's wrong here
DynamoDB does not support resource-based policies; IAM policies are used.
- ✓
Add the users to the IAM group.
Why this is correct
Users inherit the permissions of the group.
- ✗
Create an IAM role and assign it to the table.
Why it's wrong here
IAM roles are assumed by users or services, not attached to tables.
Go deeper
Related to this question
About these practice questions
One of 1,663 original DBS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on DBS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company wants to restrict access to an Amazon DynamoDB table so that only specific IAM users can read and write data. What is the BEST way to achieve this?
easy- A.Use a resource-based policy on the DynamoDB table.
- ✓ B.Create an IAM policy that grants access to the DynamoDB table and attach it to the specific IAM users.
- C.Use DynamoDB Accelerator (DAX) with IAM authentication.
- D.Create a VPC endpoint for DynamoDB and allow only traffic from that VPC.
Why B: Using an IAM policy attached to specific IAM users is the most precise method to restrict access to a DynamoDB table. Resource-based policies are not supported for DynamoDB (Option A is wrong). VPC endpoints control network traffic but do not restrict which users can access the table (Option D is wrong). DynamoDB Accelerator (DAX) with IAM authentication handles caching and authentication, not table-level access control (Option C is wrong).
Variation 2. A developer wants to grant an IAM user read-only access to an Amazon DynamoDB table named 'Orders' in the 'us-east-1' region. Which IAM policy should be attached to the user?
easy- ✓ A.{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["dynamodb:GetItem","dynamodb:Query","dynamodb:Scan"],"Resource":"arn:aws:dynamodb:us-east-1:123456789012:table/Orders"}]}
- B.{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["dynamodb:*"],"Resource":"arn:aws:dynamodb:us-east-1:123456789012:table/Orders"}]}
- C.{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["dynamodb:GetItem","dynamodb:PutItem","dynamodb:UpdateItem"],"Resource":"arn:aws:dynamodb:us-east-1:123456789012:table/Orders"}]}
- D.{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":["dynamodb:PutItem","dynamodb:UpdateItem","dynamodb:DeleteItem"],"Resource":"arn:aws:dynamodb:us-east-1:123456789012:table/Orders"}]}
Why A: It grants only the read-only actions GetItem, Query, and Scan on the specified DynamoDB table. Option B is incorrect because it grants full DynamoDB access (dynamodb:*) to the table, allowing write and delete operations. Option C is incorrect because it includes PutItem and UpdateItem, which are write operations. Option D is incorrect because it uses a Deny effect for write operations, but an explicit deny is not necessary and could conflict with other policies; additionally, it does not explicitly allow read actions, so the user would have no access.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.