DBS-C01 Database Security Practice Question
A company is using Amazon DynamoDB with AWS Lambda to process data. The Lambda function needs to read and write items to a DynamoDB table. The security team wants to follow the principle of least privilege. Which IAM policy statement should be attached to the Lambda execution role?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
{"Effect":"Allow","Action":["dynamodb:GetItem","dynamodb:PutItem","dynamodb:UpdateItem","dynamodb:DeleteItem"],"Resource":"arn:aws:dynamodb:us-east-1:123456789012:table/MyTable"}
It grants only the necessary DynamoDB actions (GetItem, PutItem, UpdateItem, DeleteItem) on the specific table. Option A is wrong because it grants full DynamoDB access on all resources, which is too permissive. Option B is wrong because it only allows DescribeTable and ListTables on all tables, which does not provide the read/write permissions needed. Option D is wrong because it allows all DynamoDB actions on a specific table, which is overly permissive and violates least privilege.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
{"Effect":"Allow","Action":"dynamodb:*","Resource":"*"}
Why it's wrong here
This policy grants full access to all DynamoDB resources, violating the principle of least privilege.
- ✗
{"Effect":"Allow","Action":["dynamodb:DescribeTable","dynamodb:ListTables"],"Resource":"*"}
Why it's wrong here
This policy only allows DescribeTable and ListTables on all tables, but does not grant the required read/write operations.
- ✓
{"Effect":"Allow","Action":["dynamodb:GetItem","dynamodb:PutItem","dynamodb:UpdateItem","dynamodb:DeleteItem"],"Resource":"arn:aws:dynamodb:us-east-1:123456789012:table/MyTable"}
Why this is correct
This policy grants only the necessary read/write actions (GetItem, PutItem, UpdateItem, DeleteItem) on the specific table, following least privilege.
- ✗
{"Effect":"Allow","Action":"dynamodb:*","Resource":"arn:aws:dynamodb:us-east-1:123456789012:table/MyTable"}
Why it's wrong here
This policy grants all DynamoDB actions on the specific table, which is too permissive; it should restrict actions to only those needed.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
This DBS-C01 question is part of Courseiva's 1,663-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DBS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company is using Amazon DynamoDB to store user session data. The security team requires that all access to the table be authenticated and authorized using AWS IAM. Which mechanism should the developer use to achieve this?
easy- A.Create a VPC endpoint for DynamoDB and allow only traffic from the VPC.
- B.Use Amazon Cognito identity pools to grant access to the DynamoDB table.
- ✓ C.Use IAM policies to grant permissions to the DynamoDB table.
- D.Use a DynamoDB resource-based policy to restrict access.
Why C: DynamoDB is integrated with AWS IAM for authentication and authorization. IAM policies can be attached to users, groups, or roles to grant specific permissions to DynamoDB tables. Option A is wrong because VPC endpoints provide network isolation but do not authenticate or authorize access. Option B is wrong because Amazon Cognito identity pools are used for federated user authentication, not for direct IAM-based access to DynamoDB. Option D is wrong because DynamoDB does not support resource-based policies; access control is managed through IAM policies.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.