SAP-C02 Practice Question: Accelerate Workload Migration and Modernization

Exhibit

Refer to the exhibit.

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "dms:CreateReplicationTask",
                "dms:StartReplicationTask"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "rds:DescribeDBInstances",
                "rds:DescribeDBSnapshots"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:PutObject"
            ],
            "Resource": "arn:aws:s3:::my-migration-bucket/*"
        }
    ]
}
```

A migration engineer is setting up an AWS DMS task to migrate data from an on-premises Oracle database to Amazon RDS for PostgreSQL. The engineer attaches this IAM policy to the DMS service role. The DMS task fails with an error indicating insufficient privileges. What is the most likely cause?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The policy does not allow the dms:CreateEndpoint action

DMS needs permission to describe endpoints and test connections, which are not in the policy. The policy allows creating and starting tasks but not the prerequisite actions like creating endpoints. S3 access is correct if using S3 as a source/target, but the core issue is missing endpoint permissions.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The policy does not allow the s3:ListBucket action for the S3 bucket
Why it's wrong here
ListBucket may be needed but the error is about insufficient privileges, likely missing endpoint permissions.
✗
The policy does not allow the dms:TestConnection action
Why it's wrong here
TestConnection is needed, but the more fundamental issue is missing CreateEndpoint.
✓
The policy does not allow the dms:CreateEndpoint action
Why this is correct
Correct. DMS needs permissions to create and describe endpoints for the source and target.
✗
The policy does not allow the rds:ModifyDBInstance action
Why it's wrong here
ModifyDBInstance is not required for DMS task execution.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

SAP-C02 Practice Question: Accelerate Workload Migration and Modernization

Exhibit

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question