DBS-C01 Deployment and Migration Practice Question

Exhibit

Refer to the exhibit.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "rds:CreateDBInstance",
                "rds:DeleteDBInstance",
                "rds:ModifyDBInstance",
                "rds:DescribeDBInstances"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Deny",
            "Action": "rds:DeleteDBInstance",
            "Resource": "arn:aws:rds:us-east-1:123456789012:db:prod-*"
        }
    ]
}

Refer to the exhibit. A database administrator has this IAM policy attached to their user. They attempt to delete the database instance 'prod-mydb' but receive an 'AccessDenied' error. Why?

⚠ Common exam trap

The trap here is that candidates often overlook the explicit Deny statement and focus only on the Allow statement, assuming the user has permission because the action is allowed for some resources, but they miss that the Deny specifically blocks the targeted instance identifier pattern.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The Deny statement explicitly denies deletion of any instance with an identifier starting with 'prod-'.

The IAM policy includes an explicit Deny statement that denies the rds:DeleteDBInstance action when the resource ARN contains an instance identifier starting with 'prod-'. Explicit Deny statements override any Allow statements, so even if another policy allows deletion, this Deny blocks it for instances like 'prod-mydb'.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The policy does not allow the rds:DeleteDBInstance action for any resource.
Why it's wrong here
The policy allows DeleteDBInstance on all resources, but then denies it for prod-*.
✗
The resource ARN in the Deny statement does not match the instance.
Why it's wrong here
The ARN matches: db:prod-* covers prod-mydb.
✗
The user does not have permission to describe the DB instance.
Why it's wrong here
The user has DescribeDBInstances permission.
✓
The Deny statement explicitly denies deletion of any instance with an identifier starting with 'prod-'.
Why this is correct
The Deny statement overrides the Allow, preventing deletion of prod instances.

Go deeper

1 more way this is tested on DBS-C01

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. A database administrator is trying to delete the RDS instance named 'prod-critical' using the AWS CLI. The IAM policy shown is attached to the user. What will happen?

hard

A.The delete will succeed only if the user includes a condition.
✓ B.The delete will fail because the Deny statement explicitly denies the action for that resource.
C.The delete will fail because the policy has a syntax error.
D.The delete will succeed because the Allow statement grants permission.

Why B: The Deny statement in the policy explicitly denies the 'rds:DeleteDBInstance' action on the resource 'arn:aws:rds:*:*:db:prod-critical'. In AWS IAM, an explicit Deny always overrides any Allow, so the delete will fail. Option A is incorrect because a condition is not relevant; the Deny is unconditional. Option C is incorrect because the policy has no syntax error. Option D is incorrect because the Allow does not apply due to the overriding Deny.

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.

DBS-C01 Deployment and Migration Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question

1 more way this is tested on DBS-C01