DBS-C01 Workload-Specific Database Design Practice Question

Exhibit

Refer to the exhibit.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "dynamodb:PutItem",
                "dynamodb:GetItem",
                "dynamodb:Query"
            ],
            "Resource": "arn:aws:dynamodb:us-east-1:123456789012:table/Orders"
        },
        {
            "Effect": "Allow",
            "Action": "dynamodb:DeleteItem",
            "Resource": "arn:aws:dynamodb:us-east-1:123456789012:table/Orders",
            "Condition": {
                "ForAllValues:StringEquals": {
                    "dynamodb:Attributes": ["order_id", "status"]
                }
            }
        }
    ]
}

A developer is configuring IAM permissions for a Lambda function that accesses a DynamoDB table named 'Orders'. The policy shown is attached to the Lambda execution role. The function needs to delete items but only if the item contains only 'order_id' and 'status' attributes. Which statement about this policy is correct?

⚠ Common exam trap

The DBS-C01 exam often tests the misconception that a condition on `dynamodb:Attributes` applies to the resource ARN rather than the item's attributes, leading candidates to incorrectly assume the condition is on the table itself.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The function can only delete items that contain exactly the attributes 'order_id' and 'status'

The IAM policy includes a condition key `dynamodb:Attributes` that restricts the `DeleteItem` action to items containing exactly the attributes 'order_id' and 'status'. This condition ensures the function can only delete items that match the specified attribute set, enforcing a fine-grained access control at the item attribute level.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The function can delete any item in the Orders table because the condition is on the resource
Why it's wrong here
The condition is on the action, not the resource.
✗
The function cannot delete any items because the DeleteItem action is not allowed
Why it's wrong here
DeleteItem is allowed with a condition.
✗
The function cannot call Query on the table because it is not listed in the actions
Why it's wrong here
Query is allowed in the first statement.
✓
The function can only delete items that contain exactly the attributes 'order_id' and 'status'
Why this is correct
The condition ensures only items with those attributes can be deleted.

Quick reference

Cloud Service Model Comparison

Model	You Manage	Provider Manages	Examples
IaaS	OS, runtime, apps, data	Hardware, hypervisor, networking	EC2, Azure VMs, GCP Compute Engine
PaaS	Apps and data	OS, runtime, middleware, hardware	Elastic Beanstalk, Azure App Service
SaaS	Data and settings only	Everything else	Microsoft 365, Salesforce, Workday
FaaS / Serverless	Function code only	Infra, scaling, runtime	Lambda, Azure Functions, Cloud Run
CaaS	Containers and apps	Kubernetes, OS, hardware	EKS, AKS, GKE

Go deeper

DBS-C01 Workload-Specific Database Design Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Cloud Service Model Comparison

Related to this question