DVA-C02 Deployment Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  The policy does not allow ec2:DescribeImages.

  Why it's wrong here

  This is incorrect because the IAM policy shown in the exhibit already grants ec2:DescribeImages, so CloudFormation can freely resolve the AMI ID referenced in the template. The failure occurs later in the deployment sequence, when CloudFormation attempts to call iam:PassRole to assign an instance profile to the EC2 instance. A deny for ec2:DescribeImages would produce an "unauthorized to perform ec2:DescribeImages" error, not the PassRole authorization error you're seeing. Therefore, this option is not the cause of the failure.

• ✓

  The IAM role specified in the CloudFormation template is not the same as the one in the PassRole resource.

  Why this is correct

  This is correct. When CloudFormation creates an EC2 instance with an IAM instance profile, the user or role making the API calls must have iam:PassRole permission with a Resource that explicitly includes the ARN of the role being passed. In this case, the template specifies one IAM role (via its instance profile), but the PassRole statement in the policy points to a different role ARN. Because the role ARN in the policy resource does not match the role ARN in the template, CloudFormation is denied the iam:PassRole action, which prevents the instance from launching even though all EC2 actions are allowed. To fix it, either change the template to use the role allowed by the PassRole policy or extend the policy's Resource to include the template's role ARN, using least privilege.

• ✗

  The policy does not allow ec2:RunInstances.

  Why it's wrong here

  This is incorrect because the policy explicitly includes ec2:RunInstances, so CloudFormation has the necessary permission to create the instance. The deployment never reaches the point of successfully executing RunInstances because the earlier iam:PassRole call fails. If ec2:RunInstances were missing, the error would name ec2:RunInstances as the unauthorized action, not iam:PassRole. Thus, a lack of RunInstances permission cannot explain the observed failure.

• ✗

  The policy does not allow ec2:TerminateInstances.

  Why it's wrong here

  This is incorrect because ec2:TerminateInstances is not called during initial stack creation; it is only needed if CloudFormation must clean up resources during stack deletion or a rollback triggered after a failure. The deployment failed during the create phase at the iam:PassRole authorization check, before any instance was launched and before termination could be relevant. Even if TerminateInstances were denied, that would not cause this error on a fresh deployment, so this option is irrelevant to the question.

Go deeper

Related to this question