DBS-C01 Database Security Practice Question
Exhibit
Refer to the exhibit.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"rds:DescribeDBInstances",
"rds:CreateDBInstance"
],
"Resource": "*"
},
{
"Effect": "Deny",
"Action": "rds:DeleteDBInstance",
"Resource": "arn:aws:rds:us-east-1:123456789012:db:prod-*"
}
]
}An IAM policy is attached to a user. Which of the following actions will be allowed?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a new DB instance named 'prod-db'.
The question does not include the IAM policy text, so it is impossible to determine which actions are allowed. Without the policy, we cannot evaluate whether any specific action is permitted or denied. Therefore, none of the options can be confirmed as correct.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Delete a DB instance named 'prod-db'.
Why it's wrong here
Cannot be determined without the IAM policy.
- ✓
Create a new DB instance named 'prod-db'.
Why this is correct
Cannot be determined without the IAM policy.
- ✗
Delete a DB instance named 'test-db'.
Why it's wrong here
Cannot be determined without the IAM policy.
- ✗
Delete a DB instance named 'dev-db'.
Why it's wrong here
Cannot be determined without the IAM policy.
Go deeper
Related to this question
About these practice questions
Courseiva writes every DBS-C01 question from scratch — 1,663 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DBS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A database administrator has the IAM policy shown in the exhibit. Which action will be allowed by this policy?
hard- A.Modify the prod-db instance.
- ✓ B.Create a snapshot of the prod-db instance.
- C.Delete the prod-db instance.
- D.Describe all DB instances in the account.
Why B: The policy explicitly allows CreateDBSnapshot on the resource. Option A is denied. Option C is not in the policy. Option D is not in the policy.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.