DBS-C01 Database Security Practice Question
A company is using Amazon DynamoDB with fine-grained access control using IAM policies. The security team wants to ensure that a specific IAM role can only read the 'status' attribute from items in a table. The table is named 'Orders'. Which IAM policy statement should be used?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Condition: { 'ForAllValues:StringEquals': { 'dynamodb:Attributes': ['status'] } }
It uses the `dynamodb:Attributes` condition key with `ForAllValues:StringEquals` to restrict the request to only access the 'status' attribute. This ensures the role can only read the 'status' attribute, meeting the requirement. Option A incorrectly uses the condition to match the literal value 'active' as an attribute name. Options C and D use invalid or irrelevant condition keys.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Condition: { 'ForAllValues:StringEquals': { 'dynamodb:Attributes': ['active'] } }
Why it's wrong here
Incorrect. The `dynamodb:Attributes` condition key is used for attribute projection, not for filtering items by attribute value. Specifying 'active' as an attribute name does not ensure that only items with status='active' are read.
- ✓
Condition: { 'ForAllValues:StringEquals': { 'dynamodb:Attributes': ['status'] } }
Why this is correct
Correct. This condition restricts access to only the 'status' attribute name, which is a step towards controlling attribute access, but it does not filter items by value. The requirement to read items with status='active' requires additional data modeling (e.g., GSI) or app-level filtering.
- ✗
Condition: { 'ForAllValues:StringEquals': { 'dynamodb:ReturnValues': 'ALL_OLD' } }
Why it's wrong here
Incorrect. The `dynamodb:ReturnValues` condition key is not used for item-level access control; it controls the ReturnValues parameter in write operations.
- ✗
Condition: { 'StringEquals': { 'dynamodb:Select': 'SPECIFIC_ATTRIBUTES' } }
Why it's wrong here
Incorrect. The `dynamodb:Select` condition key is not a valid condition key for IAM policies in DynamoDB.
Go deeper
Related to this question
About these practice questions
Courseiva writes every DBS-C01 question from scratch — 1,663 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DBS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security engineer is designing access controls for an Amazon DynamoDB table containing customer data. Which TWO actions enforce least privilege access?
medium- ✓ A.Use IAM conditions to restrict access to specific attributes.
- B.Grant dynamodb:* action to all users.
- ✓ C.Implement fine-grained access control using IAM policy conditions.
- D.Use a resource-based policy on the DynamoDB table.
- E.Attach a VPC endpoint policy that allows all actions.
Why A: Options A and C are correct. Using IAM conditions to restrict access to specific attributes (A) and implementing fine-grained access control using IAM policy conditions (C) both enforce least privilege by limiting the data and actions a user can access. Option B violates least privilege by granting all actions to all users. Option D is incorrect because Amazon DynamoDB does not support resource-based policies; access is controlled via identity-based IAM policies. Option E is incorrect because a VPC endpoint policy allowing all actions does not restrict access.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.