DBS-C01 Workload-Specific Database Design Practice Question
Exhibit
Refer to the exhibit.
IAM policy:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"dynamodb:GetItem",
"dynamodb:PutItem",
"dynamodb:UpdateItem",
"dynamodb:DeleteItem",
"dynamodb:Query"
],
"Resource": "arn:aws:dynamodb:us-east-1:123456789012:table/Orders"
},
{
"Effect": "Deny",
"Action": "dynamodb:Scan",
"Resource": "*"
}
]
}An application using the above IAM policy is trying to perform a Scan operation on the 'Orders' table. What will happen?
⚠ Common exam trap
Test-takers frequently assume a resource-specific Allow (e.g., on the 'Orders' table) will override a broad Deny on all resources, but AWS IAM's explicit deny always wins, regardless of resource specificity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The Scan operation will fail because the explicit Deny on dynamodb:Scan overrides the Allow.
D is correct because IAM policy evaluation follows an explicit deny override: any explicit Deny statement for an action overrides any Allow for that same action, regardless of resource specificity. Since the policy includes an explicit Deny on dynamodb:Scan for all resources, the Scan operation on the 'Orders' table will be denied, even though an Allow statement grants other DynamoDB actions on that table.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The Scan operation will succeed because the Deny is on all resources but the Allow is specific to the table.
Why it's wrong here
Deny applies to all resources including the table.
- ✗
The Scan operation will succeed because the policy allows other operations on the table.
Why it's wrong here
Explicit Deny overrides Allow.
- ✗
The Scan operation will fail because the policy does not explicitly allow Scan.
Why it's wrong here
Implicit Deny is not the only reason; there is an explicit Deny.
- ✓
The Scan operation will fail because the explicit Deny on dynamodb:Scan overrides the Allow.
Why this is correct
Explicit Deny always overrides Allow.
Go deeper
Related to this question
About these practice questions
Courseiva writes every DBS-C01 question from scratch — 1,663 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.