DBS-C01 Database Security Practice Question

A developer is writing an AWS Lambda function that needs to access a Secrets Manager secret to retrieve database credentials. The Lambda function has an IAM role. Which action must be allowed in the IAM policy?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

secretsmanager:GetSecretValue

The Lambda function must call secretsmanager:GetSecretValue to retrieve the secret. Option A (kms:Decrypt) may be necessary if the secret is encrypted with a KMS key, but it is not the primary action. Option B (secretsmanager:PutSecretValue) is for updating secrets, not reading. Option C (secretsmanager:ListSecrets) only lists secret names, not the actual values.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
kms:Decrypt
Why it's wrong here
Needed if the secret uses a customer-managed KMS key, but not the primary action.
✗
secretsmanager:PutSecretValue
Why it's wrong here
PutSecretValue is for updating secrets.
✗
secretsmanager:ListSecrets
Why it's wrong here
ListSecrets only lists secret names, not values.
✓
secretsmanager:GetSecretValue
Why this is correct
This is required to retrieve the secret.

Quick reference

Cloud Service Model Comparison

Model	You Manage	Provider Manages	Examples
IaaS	OS, runtime, apps, data	Hardware, hypervisor, networking	EC2, Azure VMs, GCP Compute Engine
PaaS	Apps and data	OS, runtime, middleware, hardware	Elastic Beanstalk, Azure App Service
SaaS	Data and settings only	Everything else	Microsoft 365, Salesforce, Workday
FaaS / Serverless	Function code only	Infra, scaling, runtime	Lambda, Azure Functions, Cloud Run
CaaS	Containers and apps	Kubernetes, OS, hardware	EKS, AKS, GKE

About these practice questions

Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Last reviewed: Jun 20, 2026

Question Discussion

Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.

Loading comments…

Keep practising

Question 337 of 1,663

Next question

Practice tests

Short scored sets — answer, get feedback, read the explanation, move on.

DBS-C01 Practice Test 1 — 25 Questions→DBS-C01 Practice Test 5 — 25 Questions→

Practice by domain

Drill one exam section at a time instead of jumping between unrelated topics.

Database Security Workload-Specific Database Design Management and Operations

Filter by question format

Filter questions by type — troubleshooting, exhibit, drag-and-drop, multi-select, and more.

Browse scenarios

Go deeper on a topic

One concept per page — questions, worked explanations, and a short concept guide.

Database Security practice questions Workload-Specific Database Design practice questions Monitoring and Troubleshooting practice questions

Continue studying

All DBS-C01 questions DBS-C01 practice test Exam domains

This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.