Courseiva
Management and OperationsmediumMultiple ChoiceObjective-mapped

DBS-C01 Management and Operations Practice Question

Exhibit

Refer to the exhibit.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "rds:DescribeDBInstances",
                "rds:CreateDBSnapshot",
                "rds:DeleteDBSnapshot",
                "rds:RestoreDBInstanceFromDBSnapshot"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Deny",
            "Action": "rds:DeleteDBInstance",
            "Resource": "arn:aws:rds:us-east-1:123456789012:db:production-*"
        }
    ]
}

Refer to the exhibit. A database administrator is writing an IAM policy to manage Amazon RDS snapshots. The policy allows actions on all RDS resources but denies deletion of any DB instance with the prefix 'production-'. A developer attempts to delete a snapshot named 'production-snapshot-2020'. Will this action be allowed?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

Yes, because the Deny statement only applies to deleting DB instances, not snapshots.

The Deny statement in the policy only applies to the 'rds:DeleteDBInstance' action, not to 'rds:DeleteDBSnapshot'. The Allow statement explicitly allows all actions including 'rds:DeleteDBSnapshot' on all resources. Since there is no explicit deny for deleting snapshots, the allow takes effect. Option A is incorrect because the developer's permissions are not relevant; the policy allows the action. Option B is incorrect because the Deny does not apply to snapshots. Option D is incorrect because the Deny condition only matches deletions of DB instances, not snapshots.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • Yes, but only if the developer has the necessary permissions.

    Why it's wrong here

    The policy explicitly allows 'rds:DeleteDBSnapshot' on all resources, so the developer can delete the snapshot.

  • No, because the Deny statement overrides the Allow statement.

    Why it's wrong here

    The Deny statement only applies to 'rds:DeleteDBInstance', not to 'rds:DeleteDBSnapshot'.

  • Yes, because the Deny statement only applies to deleting DB instances, not snapshots.

    Why this is correct

    The Deny is specific to 'rds:DeleteDBInstance', so snapshot deletion is allowed.

  • No, because the snapshot name starts with 'production-', which matches the resource pattern in the Deny statement.

    Why it's wrong here

    The Deny statement's resource is for db:production-*, not snapshot:production-*.

About these practice questions

One of 1,663 original DBS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.