DBS-C01 Management and Operations Practice Question
Exhibit
Refer to the exhibit.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"rds:DescribeDBInstances",
"rds:CreateDBSnapshot",
"rds:DeleteDBSnapshot",
"rds:RestoreDBInstanceFromDBSnapshot"
],
"Resource": "*"
},
{
"Effect": "Deny",
"Action": "rds:DeleteDBInstance",
"Resource": "arn:aws:rds:us-east-1:123456789012:db:production-*"
}
]
}Refer to the exhibit. A database administrator is writing an IAM policy to manage Amazon RDS snapshots. The policy allows actions on all RDS resources but denies deletion of any DB instance with the prefix 'production-'. A developer attempts to delete a snapshot named 'production-snapshot-2020'. Will this action be allowed?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Yes, because the Deny statement only applies to deleting DB instances, not snapshots.
The Deny statement in the policy only applies to the 'rds:DeleteDBInstance' action, not to 'rds:DeleteDBSnapshot'. The Allow statement explicitly allows all actions including 'rds:DeleteDBSnapshot' on all resources. Since there is no explicit deny for deleting snapshots, the allow takes effect. Option A is incorrect because the developer's permissions are not relevant; the policy allows the action. Option B is incorrect because the Deny does not apply to snapshots. Option D is incorrect because the Deny condition only matches deletions of DB instances, not snapshots.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Yes, but only if the developer has the necessary permissions.
Why it's wrong here
The policy explicitly allows 'rds:DeleteDBSnapshot' on all resources, so the developer can delete the snapshot.
- ✗
No, because the Deny statement overrides the Allow statement.
Why it's wrong here
The Deny statement only applies to 'rds:DeleteDBInstance', not to 'rds:DeleteDBSnapshot'.
- ✓
Yes, because the Deny statement only applies to deleting DB instances, not snapshots.
Why this is correct
The Deny is specific to 'rds:DeleteDBInstance', so snapshot deletion is allowed.
- ✗
No, because the snapshot name starts with 'production-', which matches the resource pattern in the Deny statement.
Why it's wrong here
The Deny statement's resource is for db:production-*, not snapshot:production-*.
Go deeper
Related to this question
About these practice questions
One of 1,663 original DBS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.