ANS-C01 Network Security, Compliance and Governance Practice Question

Exhibit

Refer to the exhibit.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ec2:CreateVpc",
        "ec2:CreateSubnet",
        "ec2:CreateInternetGateway",
        "ec2:AttachInternetGateway",
        "ec2:CreateRouteTable",
        "ec2:CreateRoute"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:RequestedRegion": "us-east-1"
        }
      }
    },
    {
      "Effect": "Deny",
      "Action": "ec2:CreateInternetGateway",
      "Resource": "*",
      "Condition": {
        "StringNotEquals": {
          "aws:ResourceTag/purpose": "production"
        }
      }
    }
  ]
}

A network administrator attached the IAM policy shown to a user. The user tries to create an internet gateway in us-east-1 without any tags. What will happen?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The internet gateway creation is denied because the Deny statement applies.

The first statement allows CreateInternetGateway in us-east-1. The second statement denies CreateInternetGateway if the resource tag 'purpose' is not 'production'. When creating a resource without tags, the condition StringNotEquals evaluates to true (since no tag, it's not equal to 'production'), so the Deny applies. The Deny overrides the Allow, so the action is denied. Therefore, option C is correct because the Deny statement applies. Option A is incorrect because the first statement does allow it in us-east-1, but the Deny overrides. Option B is incorrect because the creation is denied, not permitted with a warning. Option D is incorrect because the Deny overrides the Allow.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The internet gateway creation fails because the first statement does not allow it in us-east-1.
Why it's wrong here
The first statement does allow it in us-east-1.
✗
The internet gateway is created but the user receives a warning.
Why it's wrong here
IAM denies the action, no warning.
✓
The internet gateway creation is denied because the Deny statement applies.
Why this is correct
Without the required tag, the Deny blocks the action.
✗
The internet gateway is created successfully because the first statement allows it.
Why it's wrong here
The Deny overrides the Allow.

Visual reference

Go deeper

ANS-C01 Network Security, Compliance and Governance Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question