DBS-C01 Database Security Practice Question
Exhibit
Refer to the exhibit.
```
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"rds:DescribeDBInstances",
"rds:ModifyDBInstance"
],
"Resource": "arn:aws:rds:us-east-1:123456789012:db:prod-db"
},
{
"Effect": "Allow",
"Action": "rds:DescribeDBInstances",
"Resource": "*"
}
]
}
```A database administrator has the IAM policy shown above attached to their user. When they try to run the AWS CLI command `aws rds describe-db-instances --region us-west-2`, they receive an access denied error. Why does this fail?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The policy explicitly restricts the resource to a specific DB instance ARN in us-east-1, and the command specifies a different region.
The IAM policy includes two Allow statements. The first statement grants rds:DescribeDBInstances only on a specific DB instance ARN in us-east-1. The second statement grants the same action on any resource (*). Because IAM evaluates the effective permissions as the union of all statements, the user is only allowed to describe that specific instance in us-east-1; describing instances in any other region (such as us-west-2) is not explicitly allowed for that resource, so the request is denied. Option D is correct because it acknowledges that the resource ARN restriction from the first statement limits the allowed region. Option A is incorrect because there is no MFA condition in the policy. Option B is incorrect because the user can describe the specific instance in us-east-1. Option C is incorrect because the policy restricts access via a resource ARN, not a condition key.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The user must use multi-factor authentication (MFA) to perform the describe action.
Why it's wrong here
No MFA requirement is in the policy.
- ✗
The user does not have permission to describe DB instances in any region.
Why it's wrong here
The policy allows DescribeDBInstances on the specific instance in us-east-1.
- ✗
The policy includes a condition key that denies access when the region is not us-east-1.
Why it's wrong here
No condition is present.
- ✓
The policy explicitly restricts the resource to a specific DB instance ARN in us-east-1, and the command specifies a different region.
Why this is correct
The resource ARN includes region us-east-1, so it does not apply to us-west-2.
Go deeper
Related to this question
About these practice questions
Courseiva writes every DBS-C01 question from scratch — 1,663 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.