DBS-C01 Management and Operations Practice Question

Exhibit

Refer to the exhibit.

Policy:
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "RestoreFromSnapshot",
            "Effect": "Allow",
            "Action": [
                "rds:RestoreDBInstanceFromDBSnapshot",
                "rds:DescribeDBSnapshots",
                "ec2:DescribeSecurityGroups",
                "ec2:DescribeSubnets"
            ],
            "Resource": "*"
        }
    ]
}

An IAM policy is attached to a user who needs to restore an Amazon RDS DB instance from a DB snapshot. The user attempts to restore and receives an 'Access Denied' error. Which missing permission is MOST likely causing the failure?

⚠ Common exam trap

Watch out — candidates often assume describing snapshots is sufficient for restoration, but AWS requires the write-level `CreateDBInstance` permission because restoring creates a new DB instance, not just reads existing data.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

rds:CreateDBInstance

To restore an Amazon RDS DB instance from a DB snapshot, the user must have the `rds:CreateDBInstance` permission. This is because the restore operation internally calls the CreateDBInstance API to create a new DB instance from the specified snapshot. Without this permission, the request fails with an 'Access Denied' error, even if the user has permissions to describe snapshots or instances.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
rds:DescribeDBSnapshots
Why it's wrong here
This action is already allowed.
✗
rds:DescribeDBInstances
Why it's wrong here
This is not needed for restore.
✓
rds:CreateDBInstance
Why this is correct
Restoring from snapshot creates a new DB instance, requiring CreateDBInstance.
✗
rds:CreateDBSubnetGroup
Why it's wrong here
The subnet group must already exist or be specified; creating is not required.

Go deeper

Timed practice sets

Quick scored rounds with instant marking and a written explanation per question.

DBS-C01 Practice Test 2 — 25 Questions→DBS-C01 Practice Questions 2 — 50 Questions→

Practice by domain

Each domain maps to a weighted exam section. Focus on the domain where you are weakest.

Management and Operations Database Security Monitoring and Troubleshooting

Filter by question format

Practise one question format at a time: exhibits, multi-select, drag-and-drop, troubleshooting.

Browse scenarios

Practice by topic

Each topic page collects the questions that test one concept, plus the theory behind it.

Management and Operations practice questions DBS-C01 fundamentals practice questions DBS-C01 troubleshooting practice questions Workload-Specific Database Design practice questions

Where to go next

Study guide All DBS-C01 questions Exam domains

This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.

DBS-C01 Management and Operations Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question