DBS-C01 Deployment and Migration Practice Question
Exhibit
Refer to the exhibit.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"dms:CreateReplicationTask",
"dms:StartReplicationTask"
],
"Resource": "arn:aws:dms:us-east-1:123456789012:replication-task:*"
},
{
"Effect": "Allow",
"Action": [
"ec2:CreateNetworkInterface",
"ec2:DescribeVpcs",
"ec2:DescribeSubnets"
],
"Resource": "*"
}
]
}An administrator is setting up an AWS DMS replication instance and attaches the IAM policy shown in the exhibit. The administrator receives an error that the replication instance cannot be created. Which missing permission is the MOST likely cause?
⚠ Common exam trap
The trap here is that candidates often focus on the DMS-specific action (`dms:CreateReplicationInstance`) or assume network interface creation is the missing permission, overlooking that DMS requires read-only EC2 describe permissions to validate the VPC resources before creation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ec2:DescribeSecurityGroups
When creating a DMS replication instance, AWS DMS needs to create and manage network interfaces in the customer's VPC. The `ec2:DescribeSecurityGroups` permission is required for DMS to validate and describe the security groups specified during replication instance creation. Without this permission, the service cannot verify the security group IDs, leading to a creation failure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
ec2:DescribeVpcPeeringConnections
Why it's wrong here
DescribeVpcs is already present; peering connections are not required.
- ✓
ec2:DescribeSecurityGroups
Why this is correct
DMS needs to describe security groups to attach to the replication instance.
- ✗
ec2:CreateNetworkInterfacePermission
Why it's wrong here
The policy already includes ec2:CreateNetworkInterface, which is sufficient.
- ✗
dms:CreateReplicationInstance
Why it's wrong here
While this action is needed, the error is likely due to missing EC2 permissions to describe security groups.
Go deeper
Related to this question
About these practice questions
Courseiva writes every DBS-C01 question from scratch — 1,663 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.