DBS-C01 Monitoring and Troubleshooting Practice Question
Exhibit
Refer to the exhibit.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"dynamodb:PutItem",
"dynamodb:GetItem",
"dynamodb:DeleteItem",
"dynamodb:Scan",
"dynamodb:Query"
],
"Resource": "arn:aws:dynamodb:us-east-1:123456789012:table/Orders",
"Condition": {
"ForAllValues:StringEquals": {
"dynamodb:LeadingKeys": ["CustomerID"]
}
}
}
]
}Refer to the exhibit. An IAM policy is attached to a user who is attempting to run a Scan operation on the Orders table using the AWS CLI. The Scan operation fails with an AccessDeniedException. What is the most likely reason?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The 'ForAllValues:StringEquals' condition set operator prevents the Scan operation because it requires all leading keys to match a single value, which is impossible for a Scan.
The condition 'dynamodb:LeadingKeys' applies only to Query and Scan operations when the condition key is used to restrict partition key values. However, the condition 'ForAllValues:StringEquals' requires that all leading keys in the request match the specified value. For a Scan operation without a specific partition key, the condition cannot be satisfied, leading to denial. Option A is incorrect because the resource ARN includes the table name, so it is valid. Option B is incorrect because the policy allows Scan action. Option C is incorrect because the condition is on LeadingKeys, not on the table.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The resource ARN does not include the table name.
Why it's wrong here
The ARN includes the table name 'Orders'.
- ✗
The Scan action is not allowed in the policy.
Why it's wrong here
Scan is listed in the Action array.
- ✗
The condition requires the partition key to be 'CustomerID', but the Scan operation does not specify a partition key.
Why it's wrong here
The condition 'LeadingKeys' applies to the partition key, but the issue is the use of 'ForAllValues'.
- ✓
The 'ForAllValues:StringEquals' condition set operator prevents the Scan operation because it requires all leading keys to match a single value, which is impossible for a Scan.
Why this is correct
'ForAllValues' evaluates to false if the request has no leading keys (as in Scan) or multiple keys.
Go deeper
Related to this question
About these practice questions
This DBS-C01 question is part of Courseiva's 1,663-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DBS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Refer to the exhibit. An IAM policy attached to an IAM role used by an AWS Lambda function. The Lambda function is invoked by Amazon API Gateway and reads from a DynamoDB table. The function is experiencing permission errors when calling DynamoDB GetItem. What is the most likely cause?
hard- A.The IAM role trust policy does not allow Lambda to assume the role.
- ✓ B.The policy does not grant access to DynamoDB indexes if the function uses a query on a Global Secondary Index.
- C.The dynamodb:GetItem action is not listed in the policy.
- D.The Lambda function ARN in the resource field is incorrect.
Why B: The IAM policy in the exhibit grants `dynamodb:GetItem` and `dynamodb:Query` actions on the table ARN only. When a Lambda function performs a Query operation on a Global Secondary Index (GSI), it must have permission on the index ARN (e.g., `arn:aws:dynamodb:region:account:table/table-name/index/index-name`) in addition to the table ARN. Without the index ARN in the policy's `Resource` element, DynamoDB will deny the request, resulting in permission errors. Therefore, the most likely cause is that the policy does not grant access to DynamoDB indexes, matching option B.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.