DBS-C01 Database Security Practice Question
A company is using Amazon DynamoDB to store user session data. The security team requires that all access to the table be authenticated and authorized using AWS IAM. Which mechanism should the developer use to achieve this?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use IAM policies to grant permissions to the DynamoDB table.
DynamoDB is integrated with AWS IAM for authentication and authorization. IAM policies can be attached to users, groups, or roles to grant specific permissions to DynamoDB tables. Option A is wrong because VPC endpoints provide network isolation but do not authenticate or authorize access. Option B is wrong because Amazon Cognito identity pools are used for federated user authentication, not for direct IAM-based access to DynamoDB. Option D is wrong because DynamoDB does not support resource-based policies; access control is managed through IAM policies.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a VPC endpoint for DynamoDB and allow only traffic from the VPC.
Why it's wrong here
VPC endpoints provide network-level isolation but do not authenticate or authorize requests; IAM is still needed.
- ✗
Use Amazon Cognito identity pools to grant access to the DynamoDB table.
Why it's wrong here
Amazon Cognito identity pools authenticate users and provide temporary AWS credentials, but the actual authorization to access DynamoDB requires IAM policies.
- ✓
Use IAM policies to grant permissions to the DynamoDB table.
Why this is correct
Correct. IAM policies are the mechanism for authenticating and authorizing access to DynamoDB tables.
- ✗
Use a DynamoDB resource-based policy to restrict access.
Why it's wrong here
DynamoDB does not support resource-based policies; access is managed via IAM policies attached to users, groups, or roles.
Go deeper
Related to this question
About these practice questions
This DBS-C01 question is part of Courseiva's 1,663-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.