DOP-C02 Configuration Management and IaC Practice Question
Exhibit
Refer to the exhibit.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ec2:Describe*",
"ec2:StartInstances",
"ec2:StopInstances"
],
"Resource": "*"
},
{
"Effect": "Deny",
"Action": "ec2:TerminateInstances",
"Resource": "arn:aws:ec2:us-east-1:123456789012:instance/*"
}
]
}Refer to the exhibit. An IAM policy is attached to a group. A user in the group tries to stop an EC2 instance in us-east-1. What will happen?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The action is allowed because StopInstances is explicitly allowed and not denied.
The policy explicitly allows ec2:StopInstances for all resources, and there is no explicit deny for StopInstances. The Deny only applies to TerminateInstances. Option A is incorrect because StopInstances is allowed. Option B is incorrect because the Deny is not ambiguous. Option C is incorrect because there is no condition key about instance state.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The action is denied because the policy does not explicitly allow stopping an instance that is running.
Why it's wrong here
The Allow statement grants StopInstances on all instances without any condition on the instance state, so the action is authorized whether the instance is running, stopped, or in another state. In IAM, an explicit Allow is sufficient to grant the permission; there is no requirement to separately authorize based on the resource's runtime status. Because no Deny applies to StopInstances, the user can stop a running instance.
- ✗
The action is denied because the Deny statement is ambiguous and could apply to StopInstances.
Why it's wrong here
IAM policy evaluation is exact and literal: a Deny statement affects only the actions explicitly listed in its Action element. The Deny here names TerminateInstances, not StopInstances, so it has no bearing on a StopInstances call. Ambiguity is not a basis for denial—if an action is not listed in a Deny, that statement never causes a deny.
- ✗
The action is allowed only if the instance is in a stopped state.
Why it's wrong here
This misreads the policy as containing a condition on the EC2 instance state, but the Allow statement has no Condition element. StopInstances is an API call to transition a running instance to stopped; if the instance were already stopped, the call would be a no-op but the IAM authorization would still be allowed. The permission is unconditional, so the instance state is irrelevant to whether the action is permitted.
- ✓
The action is allowed because StopInstances is explicitly allowed and not denied.
Why this is correct
The IAM policy includes an explicit Allow for ec2:StopInstances, and no explicit Deny statement covers StopInstances. Under IAM evaluation logic, an explicit Allow overrides the default implicit Deny, and since no explicit Deny applies, the request is permitted. Therefore, the user can stop the instance regardless of its running state.
Go deeper
Related to this question
About these practice questions
This DOP-C02 question is part of Courseiva's 1,339-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.