DOP-C02 Security and Compliance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Only s3:GetObject is allowed

  Why it's wrong here

  This is incorrect because it ignores the separate statement in the IAM policy that explicitly allows ec2:DescribeInstances (or ec2:Describe*). When you evaluate the policy, every action with an Allow effect is permitted; the CLI output would show ec2:DescribeInstances with an 'allowed' decision, so it cannot be omitted from the list of permitted actions.

• ✓

  ec2:DescribeInstances and s3:GetObject are allowed; s3:ListBucket is denied

  Why this is correct

  This matches the policy's allow statements exactly. The IAM policy grants ec2:DescribeInstances (or ec2:Describe*) and s3:GetObject, so requests to describe EC2 instances and get S3 objects will succeed. s3:ListBucket is not covered by any allow statement, so it is denied either by an explicit Deny or by the default implicit deny that applies when no allow matches. The CLI simulation confirms this by returning 'allowed' for the two granted actions and 'denied' for s3:ListBucket.

• ✗

  Only ec2:DescribeInstances is allowed

  Why it's wrong here

  This is incorrect because s3:GetObject also appears as an allowed action in the policy output. While the policy includes an allow for ec2:DescribeInstances, it contains a separate statement allowing s3:GetObject as well. A complete reading of the CLI results must include every action with an 'allowed' decision, so omitting s3:GetObject misrepresents the effective permissions.

• ✗

  All three actions are allowed

  Why it's wrong here

  This is incorrect because s3:ListBucket is not granted by the policy; the CLI output would show an 'explicit deny' or 'implicit deny' for s3:ListBucket because no statement allows it. Only the actions explicitly listed with an Allow effect—ec2:DescribeInstances and s3:GetObject—are permitted. Under IAM's default-deny model, anything not explicitly allowed is denied, so s3:ListBucket cannot be considered allowed.