DBS-C01 Database Security Practice Question
A retail company uses Amazon DynamoDB to store product catalog data. The security team wants to ensure that only authorized applications can read and write to the table. The applications are running on Amazon EC2 instances. The current setup uses an IAM role attached to the EC2 instance with a policy that grants dynamodb:* on the specific table. However, during a security audit, it was discovered that any process on the EC2 instance can access the table because the instance has access to the temporary credentials from the instance metadata service. The security team requires that only specific processes (the application) can access the credentials, and that the credentials cannot be extracted from the instance. What should be done to meet these requirements?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a VPC endpoint for DynamoDB with a policy that restricts access to the specific IAM role, and configure the EC2 instance to use IMDSv2 with a hop limit.
Using a VPC endpoint for DynamoDB with a policy that restricts access to the specific IAM role ensures that only requests from that role are allowed, and using IMDSv2 with a hop limit prevents credential theft by ensuring that only the intended application process on the EC2 instance can access the credentials. Option B is incorrect because security groups control network traffic but do not enforce IAM role usage. Option C is incorrect because storing AWS access keys on the instance is less secure and exposes credentials to any process. Option D is incorrect because DynamoDB does not support resource-based policies; IAM roles are authorized via identity-based policies attached to the role.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a VPC endpoint for DynamoDB with a policy that restricts access to the specific IAM role, and configure the EC2 instance to use IMDSv2 with a hop limit.
Why this is correct
VPC endpoint policy and IMDSv2 enhance security.
- ✗
Modify the security group to only allow traffic from the EC2 instance's private IP.
Why it's wrong here
Does not restrict credential usage.
- ✗
Store AWS access keys on the EC2 instance and use them in the application.
Why it's wrong here
Access keys are less secure and can be extracted.
- ✗
Attach a resource-based policy to the DynamoDB table allowing only the EC2 instance's IAM role.
Why it's wrong here
DynamoDB does not support resource-based policies.
Go deeper
Related to this question
About these practice questions
Courseiva writes every DBS-C01 question from scratch — 1,663 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.