ANS-C01 Network Design Practice Question

Exhibit

Refer to the exhibit.

IAM Policy JSON:
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ec2:Describe*",
        "elasticloadbalancing:Describe*",
        "cloudwatch:GetMetricStatistics"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "ec2:CreateNetworkInterface",
        "ec2:DeleteNetworkInterface"
      ],
      "Resource": "arn:aws:ec2:us-east-1:123456789012:network-interface/*"
    }
  ]
}

A network engineer needs to create a set of IAM permissions for a DevOps team to monitor network resources. The policy above is proposed. What critical missing permission is required to allow the team to list and describe VPCs?

⚠ Common exam trap

AWS often tests the distinction between read and write permissions, and the trap here is that candidates confuse `ec2:CreateVpc` (a write action) with the ability to list VPCs, or assume that broader EC2 describe permissions like `ec2:Describe*` are implicitly granted.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

ec2:DescribeVpcs

The correct permission to list and describe VPCs is `ec2:DescribeVpcs`. This API call returns information about one or more VPCs, including their CIDR blocks, state, and tags. Without this specific permission, the DevOps team cannot retrieve VPC details, even if they have other EC2 describe permissions.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
ec2:DescribeVpcPeeringConnections
Why it's wrong here
Not required for basic VPC listing.
✓
ec2:DescribeVpcs
Why this is correct
The policy does not include describe for VPCs; it only allows DescribeInstances and DescribeSecurityGroups.
✗
ec2:DescribeSubnets
Why it's wrong here
Not needed for listing VPCs.
✗
ec2:CreateVpc
Why it's wrong here
Create permission is not required for listing.

Visual reference

Go deeper

ANS-C01 Network Design Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question