DBS-C01 Deployment and Migration Practice Question
Exhibit
Refer to the exhibit.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "ec2.amazonaws.com"
},
"Action": "rds:CreateDBInstance",
"Resource": "*"
}
]
}An IAM role with the above trust policy is created. The role is then attached to an EC2 instance. The application on the EC2 instance tries to create an RDS DB instance using the AWS SDK. What will happen?
⚠ Common exam trap
Candidates often confuse the trust policy with the permissions policy; candidates often assume that allowing EC2 to assume the role implicitly grants all permissions to EC2, but the trust policy only controls role assumption, not the actions the role can take.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The call will fail because the role's permissions policy does not allow rds:CreateDBInstance
The call will fail because the IAM role attached to the EC2 instance lacks a permissions policy (e.g., an identity-based policy) that explicitly grants the `rds:CreateDBInstance` action. The trust policy shown in the question only defines which principal (the EC2 service) can assume the role, not what actions the role can perform. Without a permissions policy allowing RDS operations, the SDK call is denied by default.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The call will fail because the role's permissions policy does not allow rds:CreateDBInstance
Why this is correct
The role needs a permissions policy allowing the action.
- ✗
The call will succeed because the trust policy grants permissions to EC2
Why it's wrong here
Trust policy does not grant permissions to EC2; it allows EC2 to assume the role.
- ✗
The call will succeed because the trust policy allows EC2 to create RDS instances
Why it's wrong here
Trust policy only allows EC2 to assume the role; it does not grant the action.
- ✗
The call will fail because the trust policy does not include the RDS service
Why it's wrong here
Trust policy is for EC2, not RDS; that's correct.
Go deeper
Related to this question
About these practice questions
Courseiva writes every DBS-C01 question from scratch — 1,663 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.