DBS-C01 Database Security Practice Question
A developer is troubleshooting an issue where an IAM user cannot perform a 'DescribeTable' action on a DynamoDB table. The IAM policy attached to the user is: {"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["dynamodb:GetItem","dynamodb:PutItem"],"Resource":"*"}]}. What is the most likely reason for the failure?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The policy does not include the 'dynamodb:DescribeTable' action.
The IAM policy only includes the actions 'dynamodb:GetItem' and 'dynamodb:PutItem', but does not include 'dynamodb:DescribeTable'. Therefore, the IAM user is denied the DescribeTable action by default. Option A is incorrect because although action names are case-sensitive, the policy uses the correct lowercase 'dynamodb' and the actions are properly cased. Option B is incorrect because there is no implicit Deny; the policy grants access to GetItem and PutItem, and DescribeTable is simply not allowed. Service control policies could apply, but they are not the most likely reason given the policy's explicit lack of the required action. Option D is incorrect because the resource '*' does include all tables; the problem is the missing action, not the resource specification.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The policy uses lowercase 'dynamodb' but the action is case-sensitive.
Why it's wrong here
The service prefix is lowercase and actions are PascalCase; 'dynamodb:GetItem' is correct.
- ✗
There is an implicit Deny for DescribeTable due to a service control policy.
Why it's wrong here
No SCP mentioned; the policy itself lacks the action.
- ✓
The policy does not include the 'dynamodb:DescribeTable' action.
Why this is correct
The policy only allows GetItem and PutItem.
- ✗
The resource specified in the policy is '*' which does not include the table.
Why it's wrong here
'*' does include all tables.
Go deeper
Related to this question
About these practice questions
This DBS-C01 question is part of Courseiva's 1,663-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.