DBS-C01 Database Security Practice Question
Exhibit
Refer to the exhibit.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "rds:ModifyDBInstance",
"Resource": "arn:aws:rds:us-east-1:123456789012:db:prod-*"
},
{
"Effect": "Allow",
"Action": "rds:ModifyDBInstance",
"Resource": "arn:aws:rds:us-east-1:123456789012:db:dev-*",
"Condition": {
"Bool": {
"aws:MultiFactorAuthPresent": "true"
}
}
}
]
}A security engineer reviews the IAM policy attached to a user. The user is unable to modify any RDS DB instance, even when MFA is enabled. What is the most likely cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The user does not have MFA enabled, or the instance name does not match the allowed prefixes.
The scenario states that the user cannot modify any RDS DB instance even when MFA is enabled. This suggests that the IAM policy likely includes a condition requiring MFA or a specific resource prefix (e.g., 'prod-*' or 'dev-*'). If MFA is not actually enabled on the user's account, or if the instance name does not match the allowed prefixes, the condition would fail, denying all ModifyDBInstance actions. Option A is incorrect because EC2 permissions are irrelevant to RDS. Option B is incorrect because the absence of a Deny statement does not cause failure; the issue is an Allow condition not being met. Option D is incorrect because the console versus API distinction does not explain the inability to modify any instance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The policy is missing the ec2:ModifyInstance permission.
Why it's wrong here
Incorrect. Modifying an RDS DB instance requires rds:ModifyDBInstance, not ec2:ModifyInstance.
- ✗
The policy does not include a Deny statement for RDS actions.
Why it's wrong here
Incorrect. A Deny statement would explicitly deny actions, but the issue is likely a missing Allow with proper conditions.
- ✓
The user does not have MFA enabled, or the instance name does not match the allowed prefixes.
Why this is correct
Correct. The most likely cause is that the IAM policy requires MFA and matching instance name prefixes, which are not satisfied.
- ✗
The user is trying to use the RDS console, but the policy only allows API calls.
Why it's wrong here
Incorrect. The RDS console uses API calls, so the same IAM policy applies regardless of the interface.
Go deeper
Related to this question
About these practice questions
Courseiva writes every DBS-C01 question from scratch — 1,663 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.