ANS-C01 Network Implementation Practice Question

Exhibit

Refer to the exhibit.

```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ec2:CreateVpc",
        "ec2:CreateSubnet",
        "ec2:CreateInternetGateway",
        "ec2:AttachInternetGateway",
        "ec2:CreateRouteTable",
        "ec2:CreateRoute",
        "ec2:AssociateRouteTable"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Deny",
      "Action": "ec2:CreateVpc",
      "Resource": "arn:aws:ec2:us-east-1:123456789012:vpc/*",
      "Condition": {
        "StringEquals": {
          "ec2:VpcCidrBlock": "10.0.0.0/16"
        }
      }
    }
  ]
}
```

A network engineer is assigned an IAM policy to manage VPC resources. The engineer attempts to create a VPC with CIDR 10.0.0.0/16 and fails. What is the reason?

⚠ Common exam trap

The ANS-C01 exam often tests the misconception that an Allow statement always grants permission, but the trap here is that an explicit Deny statement with a matching condition overrides any Allow, causing the operation to fail even if the user has broad permissions.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The Deny statement overrides the Allow statement for the specific CIDR.

The IAM policy includes an explicit Deny statement that denies the CreateVpc action when the CIDR block equals 10.0.0.0/16. Since explicit Deny statements override any Allow statements, the engineer's attempt to create a VPC with that specific CIDR fails regardless of any Allow permissions. This is a fundamental IAM evaluation logic rule: an explicit Deny always takes precedence over an Allow.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The resource ARN in the Deny statement does not match the VPC being created.
Why it's wrong here
The ARN uses a wildcard for VPC ID, so it matches.
✓
The Deny statement overrides the Allow statement for the specific CIDR.
Why this is correct
Explicit deny overrides allow.
✗
The condition in the Deny statement is not evaluated correctly.
Why it's wrong here
Condition is evaluated correctly.
✗
The first statement allows only specific actions, not CreateVpc.
Why it's wrong here
CreateVpc is included in the first statement.

Visual reference

Go deeper

ANS-C01 Network Implementation Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question