DBS-C01 Database Security Practice Question
A developer is building a serverless application that uses Amazon DynamoDB. The application needs to access the database from an AWS Lambda function. The security team mandates that the Lambda function should not use long-term AWS credentials. Which TWO steps should be taken to securely grant access? (Choose TWO.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an IAM role with a policy that allows DynamoDB actions.
To securely grant an AWS Lambda function access to DynamoDB without using long-term credentials, you should create an IAM role that grants the necessary DynamoDB permissions (option B) and then attach that IAM role to the Lambda function's execution role (option E). This allows Lambda to obtain temporary credentials via the IAM role, eliminating the need for hardcoded credentials. Option A is incorrect because hardcoding credentials in environment variables is not secure and uses long-term credentials. Option C is incorrect because the function does not need internet access for authentication; IAM roles provide temporary credentials internally. Option D is incorrect because while Secrets Manager can store credentials, it still requires managing secrets and may not align with the mandate to avoid long-term credentials; IAM roles are the preferred method.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Hardcode the AWS access key ID and secret access key in the Lambda environment variables.
Why it's wrong here
Hardcoding credentials is insecure.
- ✓
Create an IAM role with a policy that allows DynamoDB actions.
Why this is correct
IAM role provides temporary credentials.
- ✗
Configure the Lambda function to access the internet for authentication.
Why it's wrong here
Lambda should use VPC endpoints, not internet.
- ✗
Store the database credentials in AWS Secrets Manager and retrieve them in the Lambda function.
Why it's wrong here
This adds complexity and still requires handling secrets.
- ✓
Attach the IAM role to the Lambda function's execution role.
Why this is correct
Attaching the role grants the function permissions.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
One of 1,663 original DBS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.