PAS-C01 Migration Practice Question
Exhibit
Refer to the exhibit.
```
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "rds:*",
"Resource": "*"
},
{
"Effect": "Allow",
"Action": "ec2:Describe*",
"Resource": "*"
},
{
"Effect": "Deny",
"Action": "rds:DeleteDBInstance",
"Resource": "arn:aws:rds:us-east-1:123456789012:db:prod-sap-db"
}
]
}
```A company is migrating a SAP database to Amazon RDS. The IAM policy shown in the exhibit is attached to a user. Which action is allowed by this policy?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Modify the production SAP RDS instance.
The policy allows all RDS actions (rds:*) on all resources, with an explicit deny for DeleteDBInstance on the prod-sap-db resource. This means the user can perform any RDS operation except deleting the specific production SAP RDS instance. Therefore, the user is allowed to modify the production SAP RDS instance (ModifyDBInstance), making Option B the correct answer. Creating a new RDS instance (CreateDBInstance) is generally allowed, but it is not the action directly related to the production instance in this scenario. Option C is denied explicitly. Option D is incorrect because the policy allows write operations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a new RDS instance.
Why it's wrong here
Creating a new RDS instance is allowed by the policy because rds:* includes CreateDBInstance, but the question expects the action specifically allowed on the production SAP RDS instance; thus, this is not the correct answer.
- ✓
Modify the production SAP RDS instance.
Why this is correct
Modifying the production SAP RDS instance is allowed because ModifyDBInstance is covered by rds:* and is not denied for prod-sap-db.
- ✗
Delete the production SAP RDS instance.
Why it's wrong here
Deleting the production SAP RDS instance is explicitly denied by the policy.
- ✗
Only read RDS instances.
Why it's wrong here
The policy allows many actions beyond just reading, so this statement is false.
Go deeper
Related to this question
About these practice questions
This PAS-C01 question is part of Courseiva's 1,616-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PAS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PAS-C01 exam.