DBS-C01 Database Security Practice Question
A company uses Amazon DynamoDB to store session data for a web application. The security team discovers that an IAM user has been performing unauthorized scans on the table. They need to implement controls to detect and prevent such unauthorized access in the future. Which THREE actions should the security team take? (Choose THREE.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable AWS CloudTrail logging and create a metric filter for Scan API calls.
Options A, B, and D are correct. Option A: Enabling CloudTrail logging and creating a metric filter for Scan API calls allows the security team to detect unauthorized scan attempts in real time and trigger alerts. Option B: Using fine-grained access control with IAM conditions (e.g., 'dynamodb:LeadingKeys' or 'dynamodb:Attributes') restricts access to specific items or attributes, preventing unauthorized scans from retrieving sensitive data. Option D: Creating an IAM policy that denies the 'Scan' action for unauthorized users using a condition key (e.g., 'aws:SourceIp' or custom tag) provides a preventive control to block unauthorized scans at the API level. Option C is incorrect because disabling the Scan operation on the DynamoDB table would break legitimate use cases that require scanning (e.g., admin queries, reporting) and is not a recommended control. Option E is incorrect because VPC Flow Logs capture network traffic to DynamoDB, not the DynamoDB API operations themselves, so they cannot detect scans.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable AWS CloudTrail logging and create a metric filter for Scan API calls.
Why this is correct
CloudTrail logs API calls, and metric filters can trigger alarms on unauthorized scans.
- ✓
Use fine-grained access control with IAM conditions to restrict access to specific items or attributes.
Why this is correct
This limits what data can be accessed even if a scan is allowed.
- ✗
Disable the Scan operation on the DynamoDB table.
Why it's wrong here
Scan operations are often needed; disabling them would break functionality.
- ✓
Create an IAM policy that denies the 'Scan' action for unauthorized users using a condition key.
Why this is correct
This prevents unauthorized users from performing scans.
- ✗
Enable VPC Flow Logs to monitor traffic to DynamoDB.
Why it's wrong here
VPC Flow Logs show network traffic, not DynamoDB operations.
Go deeper
Related to this question
About these practice questions
One of 1,663 original DBS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.