DBS-C01 Database Security Practice Question
A development team is building a serverless application that uses Amazon DynamoDB. The team needs to ensure that only the application's Lambda function can read and write data to a specific DynamoDB table. The Lambda function uses an IAM role. How should the team configure access?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an IAM role for the Lambda function with DynamoDB access, and configure a resource-based policy on the DynamoDB table that allows only that role.
DynamoDB supports resource-based policies (also known as table policies) that allow you to specify which IAM roles or users can access the table. By attaching such a policy that grants access only to the Lambda function's execution role, you ensure that only that function can read/write to the table. Option A is incorrect because using a VPC endpoint does not inherently control access to the table; it only controls network traffic. Option B is incorrect because KMS encryption protects data at rest but does not authorize access. Option D is incomplete because while an IAM role with a DynamoDB access policy is necessary, without a resource-based policy on the table that restricts access to that role, other principals with DynamoDB permissions could still access the table.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Place the DynamoDB table and Lambda function in the same VPC and use a VPC endpoint to control access.
Why it's wrong here
VPC endpoints allow traffic but do not provide fine-grained access control to specific principals.
- ✗
Encrypt the DynamoDB table with an AWS KMS key and grant the Lambda function decryption permissions.
Why it's wrong here
Encryption protects data at rest but does not control read/write access.
- ✓
Create an IAM role for the Lambda function with DynamoDB access, and configure a resource-based policy on the DynamoDB table that allows only that role.
Why this is correct
The resource-based policy on DynamoDB restricts access to the specified IAM role, ensuring only the Lambda function can access the table.
- ✗
Create an IAM role for the Lambda function with a policy that allows DynamoDB access, and attach the role to the function.
Why it's wrong here
This allows the Lambda function to access the table but does not prevent other principals from accessing the table if they have permissions.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
This DBS-C01 question is part of Courseiva's 1,663-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.