DOP-C02 Configuration Management and IaC Practice Question
Exhibit
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ec2:DescribeInstances",
"ec2:StartInstances",
"ec2:StopInstances"
],
"Resource": "*"
},
{
"Effect": "Deny",
"Action": "ec2:TerminateInstances",
"Resource": "arn:aws:ec2:us-east-1:123456789012:instance/*",
"Condition": {
"StringNotEquals": {
"ec2:ResourceTag/Environment": "Production"
}
}
}
]
}Refer to the exhibit. A DevOps engineer is troubleshooting an issue where an IAM user is unable to stop an EC2 instance with the tag 'Environment: Development'. The attached IAM policy is shown. Which statement explains the failure?
⚠ Common exam trap
The trap here is that candidates misread the Deny statement's action (ec2:RunInstances) and condition (StringNotEquals) as applying to stopping instances, when in fact it only affects launching instances, leading them to incorrectly select Option A or B without noticing the action mismatch.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The Allow statement only grants ec2:DescribeInstances, not start/stop.
The IAM policy in the exhibit only grants ec2:DescribeInstances and explicitly denies ec2:RunInstances with a condition. It does not include an Allow for ec2:StopInstances. By default, IAM denies any action that is not explicitly allowed. Therefore, the user lacks permission to stop instances, including the Development-tagged instance. Option C correctly identifies this as the reason for the failure. Option D is incorrect because the policy itself denies stop implicitly due to the missing Allow; it is not necessary to invoke another policy or SCP.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The Deny statement condition incorrectly uses StringNotEquals, which denies all instances except those with the Production tag.
Why it's wrong here
The Deny statement uses StringNotEquals to deny ec2:RunInstances for non-Production requests, but its action is limited to RunInstances and its condition evaluates only at launch time. It never applies to ec2:StopInstances, so it cannot 'deny all instances' for stop operations. Further, StringNotEquals is a legitimate condition operator; the issue is that the stop action has no Allow, not that the operator is malformed.
- ✗
The Deny statement includes ec2:StopInstances implicitly because stop is a termination action.
Why it's wrong here
IAM action coverage is explicit; ec2:StopInstances is a distinct API action from ec2:RunInstances and ec2:TerminateInstances, so it is not included implicitly by a Deny that mentions only RunInstances. Stopping an instance is not a termination action in IAM terms, and resource/condition elements in that Deny apply only to instance launches. Thus this rationale misreads the statement's scope and cannot explain the stop failure.
- ✓
The Allow statement only grants ec2:DescribeInstances, not start/stop.
Why this is correct
The policy's only explicit Allow is ec2:DescribeInstances; because ec2:StopInstances is a separate action in the IAM action namespace, no permission is granted to perform a stop. When the user calls StopInstances, IAM finds no allow and defaults to an implicit deny, so the API request fails. The Deny statement on RunInstances does not counteract this, so the missing start/stop Allow is precisely the cause.
- ✗
The policy does not prevent stopping instances with the Development tag; the failure must be caused by another policy or service control policy.
Why it's wrong here
In IAM, actions not explicitly allowed are implicitly denied, so the absence of ec2:StopInstances in the Allow statement alone prevents stopping instances regardless of their Development tag. There is no need to invoke another identity-based policy or an SCP; while such policies can broaden or further restrict permissions, they are not required to produce the failure. Therefore the tag-based reasoning does not identify the actual cause.
Go deeper
Related to this question
About these practice questions
This DOP-C02 question is part of Courseiva's 251-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.