DBS-C01 Workload-Specific Database Design Practice Question
Exhibit
Refer to the exhibit.
```
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"dynamodb:GetItem",
"dynamodb:PutItem",
"dynamodb:UpdateItem",
"dynamodb:DeleteItem",
"dynamodb:Query",
"dynamodb:Scan"
],
"Resource": "arn:aws:dynamodb:us-east-1:123456789012:table/Orders"
},
{
"Effect": "Deny",
"Action": "dynamodb:DeleteTable",
"Resource": "arn:aws:dynamodb:us-east-1:123456789012:table/Orders"
}
]
}
```Refer to the exhibit. An IAM policy is attached to a role used by an application that accesses the DynamoDB 'Orders' table. The application needs to perform a Scan operation on the table. According to the policy, is the Scan operation allowed?
⚠ Common exam trap
The trap here is that candidates misread the Deny statement's `NotAction` as a blanket denial of all actions, when in fact it only denies actions not explicitly listed, allowing the explicit Allow for Scan to take effect.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Yes, because the policy explicitly allows Scan
The IAM policy includes an explicit Allow statement for the `dynamodb:Scan` action on the `Orders` table. In IAM policy evaluation logic, an explicit Allow overrides any default implicit Deny, and the Deny statement in the policy only blocks actions that match its `NotAction` element, which does not include Scan. Therefore, the Scan operation is allowed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Yes, but only if the scan uses a filter expression
Why it's wrong here
Filter expression is not required for permission.
- ✗
No, because the Deny statement blocks all actions
Why it's wrong here
Deny only applies to 'DeleteTable', not all actions.
- ✓
Yes, because the policy explicitly allows Scan
Why this is correct
The Allow statement includes 'Scan', so it is permitted.
- ✗
No, because the policy does not specify a condition
Why it's wrong here
Conditions are not required for the action to be allowed.
Go deeper
Related to this question
About these practice questions
Courseiva writes every DBS-C01 question from scratch — 1,663 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.