DBS-C01 Database Security Practice Question

Exhibit

Refer to the exhibit.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "dynamodb:GetItem",
      "Resource": "arn:aws:dynamodb:us-east-1:123456789012:table/Orders",
      "Condition": {
        "ForAllValues:StringEquals": {
          "dynamodb:Attributes": ["order_id", "customer_id", "status"]
        }
      }
    }
  ]
}

An IAM policy is attached to a user. What does this policy allow the user to do?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Get an item from the Orders table but only return the order_id, customer_id, and status attributes.

The IAM policy allows the GetItem action on the Orders table, with a condition that restricts the returned attributes to order_id, customer_id, and status. This matches option D. Option A is incorrect because the policy does not allow UpdateItem. Option B is incorrect because the policy does not allow Scan (it only allows GetItem). Option C is incorrect because the policy does not allow DeleteItem.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Update an item in the Orders table.
Why it's wrong here
The policy only allows GetItem.
✗
Scan the entire Orders table and return all attributes.
Why it's wrong here
The policy only allows GetItem, not Scan.
✗
Delete an item from the Orders table.
Why it's wrong here
The policy does not allow DeleteItem.
✓
Get an item from the Orders table but only return the order_id, customer_id, and status attributes.
Why this is correct
The policy allows GetItem with attribute restriction.

Go deeper

DBS-C01 Database Security Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question