DOP-C02 Incident and Event Response Practice Question
Exhibit
Refer to the exhibit.
```
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ec2:DescribeInstances",
"ec2:DescribeVolumes",
"ec2:CreateSnapshot",
"ec2:CreateTags"
],
"Resource": "*",
"Condition": {
"IpAddress": {
"aws:SourceIp": [
"203.0.113.0/24",
"198.51.100.0/24"
]
},
"Bool": {
"aws:ViaAWSService": "false"
}
}
},
{
"Effect": "Deny",
"Action": "ec2:DeleteSnapshot",
"Resource": "arn:aws:ec2:*:*:snapshot/*",
"Condition": {
"StringNotEquals": {
"aws:SourceIdentity": "admin"
}
}
}
]
}
```An incident response team is analyzing an IAM policy attached to a role used by a forensic tool. The tool needs to create snapshots of EBS volumes during an incident. However, when the tool runs from an IP address in the 203.0.113.0/24 range, the CreateSnapshot API call fails with an access denied error. What is the MOST likely cause?
⚠ Common exam trap
The trap here is that candidates focus on the IP address condition and assume the error is due to an IP mismatch, overlooking the subtle aws:ViaAWSService condition that denies calls made through AWS services even when the source IP is allowed.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The aws:ViaAWSService condition is set to false, but the tool is invoked by an AWS service such as Systems Manager, making the condition evaluate to true and denying access.
The aws:ViaAWSService condition key evaluates to true when an API call is made by an AWS service on behalf of a principal. If the policy sets this condition to false, it denies any call that originates from an AWS service (e.g., Systems Manager Automation). In this scenario, the forensic tool is likely invoked by Systems Manager, causing the condition to evaluate to true and triggering the deny, even though the source IP is allowed. This explains why CreateSnapshot fails with access denied despite the IP being in the allowed range.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The policy does not grant ec2:CreateSnapshot on specific resource ARNs, only on all resources.
Why it's wrong here
Resource ARNs are not the issue because the policy's Allow statement grants ec2:CreateSnapshot on '*', which matches the snapshot ARN the request targets. In IAM, Resource '*' covers all possible resource-specific ARNs, so if the call were denied solely on resource scope, the Allow would be sufficient. The request fails instead because the condition key aws:ViaAWSService does not evaluate to the required value, making the Allow statement itself inapplicable.
- ✓
The aws:ViaAWSService condition is set to false, but the tool is invoked by an AWS service such as Systems Manager, making the condition evaluate to true and denying access.
Why this is correct
The aws:ViaAWSService global condition key is true when an AWS service, such as Systems Manager, makes the API call on the principal's behalf rather than the principal making a direct call. The policy's condition requires this key to be false, so when the tool is invoked via Systems Manager the actual value is true and the Allow statement does not match. With no other matching Allow, the request is implicitly denied, which is exactly the error observed.
- ✗
The Deny statement explicitly denies ec2:DeleteSnapshot, but the error is for CreateSnapshot, so it is unrelated.
Why it's wrong here
IAM policy evaluation is action-specific: a Deny statement that names ec2:DeleteSnapshot is only considered when the requested API action is exactly ec2:DeleteSnapshot. It cannot affect an ec2:CreateSnapshot call, so it is not part of the evaluation path for the reported error. The failure must be caused by a statement that actually targets CreateSnapshot or by missing applicable allows.
- ✗
The source IP address 203.0.113.0/24 is not included in the Condition block, so access is implicitly denied.
Why it's wrong here
The condition block with IpAddress includes 203.0.113.0/24, so the request's source IP satisfies that part of the statement; there is no implicit deny coming from the IP condition. An implicit deny only occurs when no statement both allows the action and has all of its conditions satisfied, and here the IP is not the failing condition. The real mismatch is that aws:ViaAWSService evaluates to true, not false.
Go deeper
Related to this question
About these practice questions
Courseiva writes every DOP-C02 question from scratch — 251 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.