DBS-C01 Workload-Specific Database Design Practice Question
Exhibit
Refer to the exhibit.
```
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"dynamodb:GetItem",
"dynamodb:Query"
],
"Resource": "arn:aws:dynamodb:us-east-1:123456789012:table/UserSessions"
},
{
"Effect": "Deny",
"Action": "dynamodb:*",
"Resource": "arn:aws:dynamodb:us-east-1:123456789012:table/UserSessions/index/*"
}
]
}
```A security engineer created the IAM policy above for an application that reads from a DynamoDB table named UserSessions. The application reports that it cannot query the table using a Global Secondary Index (GSI). The table's GSI is named GSI_UserSessions. Why is the application unable to query the index?
⚠ Common exam trap
A common mix-up: candidates assume that granting permissions on a DynamoDB table automatically covers its Global Secondary Indexes, but AWS IAM treats indexes as separate resources requiring explicit ARN-based permissions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The Query action is not allowed on the index because the Allow statement only applies to the table, not the index.
The IAM policy's Allow statement grants the Query action only on the table resource (arn:aws:dynamodb:...:table/UserSessions) but not on the index resource (arn:aws:dynamodb:...:table/UserSessions/index/GSI_UserSessions). In DynamoDB, a Global Secondary Index is a separate subresource, and IAM policies must explicitly include the index ARN to allow operations like Query on that index. Without an explicit Allow on the index, the default implicit deny prevents the query. Option B is incorrect because while a Deny statement would override any Allow, the primary reason the application fails is the lack of an Allow on the index; the Deny statement, if present, is an additional but not necessary condition.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The Query action is not allowed on the index because the Allow statement only applies to the table, not the index.
Why this is correct
Correct. The Allow statement only applies to the table, not the index, so the Query action is implicitly denied on the index.
- ✗
The Deny statement explicitly denies all DynamoDB actions on the index resource, overriding the Allow statement.
Why it's wrong here
Incorrect. Although a Deny statement would block access, the question's scenario does not specify that a Deny exists; the core issue is the missing Allow on the index resource.
- ✗
The application is using GetItem instead of Query to access the index.
Why it's wrong here
Incorrect. The application is using Query, not GetItem, as stated in the question.
- ✗
The policy allows Query on the table, which automatically includes the index.
Why it's wrong here
Incorrect. Allowing Query on the table does not automatically extend to the index; indexes require separate permissions.
Go deeper
Related to this question
About these practice questions
Courseiva writes every DBS-C01 question from scratch — 1,663 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.