DVA-C02 Security Practice Question
A developer notices that an IAM user has permissions to terminate EC2 instances, but the user should only be allowed to stop instances. The developer needs to update the policy to prevent termination while allowing stop. Which IAM policy statement should be added?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
{"Effect":"Deny","Action":"ec2:TerminateInstances","Resource":"*"}
A Deny statement explicitly blocks the specified action, overriding any Allow policies. Since the IAM user currently has permission to terminate EC2 instances (via an Allow policy), adding a Deny for ec2:TerminateInstances will prevent termination while still allowing the user to stop instances (if allowed by another policy). Option A provides this Deny. Option B is an Allow that would not block termination. Option C allows both stop and terminate. Option D is unrelated.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
{"Effect":"Deny","Action":"ec2:TerminateInstances","Resource":"*"}
Why this is correct
An explicit Deny statement takes precedence over any Allow, so even if the user's other policies grant ec2:TerminateInstances, this line will effectively block the action. The wildcard resource scopes the denial to all EC2 instances in the account, meaning no running instance can be terminated by that user. This directly implements the developer's requirement to prevent termination.
- ✗
{"Effect":"Allow","Action":"ec2:TerminateInstances","Resource":"*"}
Why it's wrong here
This policy explicitly grants the permission that the developer wants to revoke, so the user would be allowed to terminate any EC2 instance. Because IAM is additive, an Allow statement adds capability; it does not restrict it. The desired behavior is the opposite, making this statement incorrect despite its valid syntax.
- ✗
{"Effect":"Allow","Action":["ec2:StopInstances","ec2:TerminateInstances"],"Resource":"*"}
Why it's wrong here
This statement combines two lifecycle actions, but its effect is still Allow, so it both permits termination and additionally authorizes stopping instances. The developer's requirement is to block termination, not to broaden the user's instance management abilities. Adding StopInstances alongside TerminateInstances makes the policy more permissive, not protective, and fails to deny the critical action.
- ✗
{"Effect":"Allow","Action":"ec2:RebootInstances","Resource":"*"}
Why it's wrong here
Rebooting an instance restarts the operating system without changing the instance's stopped or terminated state, so this action is unrelated to the requested guardrail. Even if it were allowed, the user would still lack a direct permission to terminate, but that omission is not the same as a Deny. The policy doesn't meaningfully protect against termination since another Allow policy could grant that action.
Go deeper
Related to this question
About these practice questions
This DVA-C02 question is part of Courseiva's 724-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.