DBS-C01 Deployment and Migration Practice Question

Exhibit

Refer to the exhibit.

IAM Policy JSON:
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "rds:CreateDBInstance",
        "rds:ModifyDBInstance",
        "rds:DeleteDBInstance"
      ],
      "Resource": "arn:aws:rds:us-east-1:123456789012:db:prod-*"
    },
    {
      "Effect": "Deny",
      "Action": "rds:DeleteDBInstance",
      "Resource": "arn:aws:rds:us-east-1:123456789012:db:prod-critical"
    }
  ]
}

A database administrator is trying to delete the RDS instance named 'prod-critical' using the AWS CLI. The IAM policy shown is attached to the user. What will happen?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The delete will fail because the Deny statement explicitly denies the action for that resource.

The Deny statement in the policy explicitly denies the 'rds:DeleteDBInstance' action on the resource 'arn:aws:rds:*:*:db:prod-critical'. In AWS IAM, an explicit Deny always overrides any Allow, so the delete will fail. Option A is incorrect because a condition is not relevant; the Deny is unconditional. Option C is incorrect because the policy has no syntax error. Option D is incorrect because the Allow does not apply due to the overriding Deny.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The delete will succeed only if the user includes a condition.
Why it's wrong here
No condition is needed; the Deny is unconditional.
✓
The delete will fail because the Deny statement explicitly denies the action for that resource.
Why this is correct
Deny overrides Allow, so the delete fails.
✗
The delete will fail because the policy has a syntax error.
Why it's wrong here
The policy syntax is valid.
✗
The delete will succeed because the Allow statement grants permission.
Why it's wrong here
The Deny overrides the Allow.

Go deeper

DBS-C01 Deployment and Migration Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question