DBS-C01 Database Security Practice Question
A company uses Amazon DynamoDB with DAX and wants to implement fine-grained access control using IAM. Which THREE conditions can be used in an IAM policy to restrict access to specific items based on the primary key?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
dynamodb:Attributes
Options A, D, and E are correct. DynamoDB supports fine-grained access control using IAM conditions: dynamodb:LeadingKeys restricts access based on partition key, dynamodb:Attributes controls access to specific attributes, and dynamodb:Select restricts the use of Select parameters. Option B (dynamodb:ReturnValues) is a write operation parameter, not a condition for access control. Option C (dynamodb:TableName) identifies the table, not specific items.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
dynamodb:Attributes
Why this is correct
Restricts access to specific attributes (columns).
- ✗
dynamodb:ReturnValues
Why it's wrong here
This is a parameter for write operations, not a condition key for access control.
- ✗
dynamodb:TableName
Why it's wrong here
This identifies the table but not the items within it.
- ✓
dynamodb:LeadingKeys
Why this is correct
Restricts access to items with a specific partition key value.
- ✓
dynamodb:Select
Why this is correct
Controls whether the query can use SELECT (e.g., ALL_ATTRIBUTES, SPECIFIC_ATTRIBUTES).
Go deeper
Related to this question
About these practice questions
This DBS-C01 question is part of Courseiva's 1,663-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on DBS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company has an Amazon DynamoDB table with a global secondary index (GSI). The security team wants to ensure that only certain attributes are returned in query results based on the IAM policy of the calling user. What is the most secure and scalable approach?
hard- A.Use an AWS Lambda function as a middleware to filter attributes before returning results.
- B.Create multiple global secondary indexes that include only the allowed attributes for each user group.
- ✓ C.Use IAM condition keys with 'dynamodb:Attributes' to restrict access to specific attributes.
- D.Create a VPC endpoint for DynamoDB and attach a bucket policy that limits attribute access.
Why C: Using IAM condition keys with 'dynamodb:Attributes' allows fine-grained access control at the attribute level. This is the recommended way to restrict access to specific attributes. Option A is incorrect because using a Lambda middleware adds latency and complexity, and it is not the most secure or scalable approach compared to native IAM attribute-level conditions. Option B is incorrect because creating multiple GSIs for attribute access would be costly and not scalable, and GSIs are not designed for attribute-level access control; they are for querying. Option D is incorrect because VPC endpoints do not control attribute access; they provide network-level security. A bucket policy is for S3, not DynamoDB.
Variation 2. A company uses Amazon DynamoDB with a global secondary index (GSI). The security team requires that only specific IAM users can query the GSI. Which THREE conditions must be met to restrict access to the GSI?
hard- A.The policy must include a condition 'dynamodb:IndexName' with the index name.
- B.The policy must include a condition key 'dynamodb:Attributes' to restrict which attributes are returned.
- ✓ C.The user must have permission to query the base table as well.
- ✓ D.The policy must allow the 'dynamodb:Query' action on the index.
- ✓ E.The IAM policy must specify the index ARN in the Resource element.
Why C: The correct answers are C, D, and E. To restrict access to a GSI, you must ensure the user has permission to query the base table (C), allow the dynamodb:Query action on the index (D), and specify the index ARN in the Resource element (E). Option A is incorrect because the dynamodb:IndexName condition key is not used for IAM authorization; access to a GSI is controlled via the resource ARN, not a condition key. Option B is incorrect because the dynamodb:Attributes condition key restricts which attributes are returned, not access to the GSI itself.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.