ANS-C01 Network Security, Compliance and Governance Practice Question

Exhibit

Refer to the exhibit.

Exhibit: IAM Policy JSON
```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "ec2:*",
      "Resource": "*",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": "10.0.0.0/8"
        }
      }
    }
  ]
}
```

A security engineer attaches the above IAM policy to an IAM user. The user then attempts to launch an EC2 instance from an IP address outside the 10.0.0.0/8 range. What will happen?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The request will be denied because the condition is not satisfied.

The policy allows ec2:* only when the source IP is within 10.0.0.0/8. If the user is coming from outside that range, the condition is not met, so the action is not allowed. The default is implicit deny, so the request will be denied. Option B is correct. Option A is wrong because the condition is not met. Option C is wrong because the policy does not deny explicitly; it just doesn't allow. Option D is wrong because the condition evaluates to false.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The request will be allowed because the policy allows ec2:* on all resources.
Why it's wrong here
The condition restricts the allow to a specific IP range.
✓
The request will be denied because the condition is not satisfied.
Why this is correct
Since the source IP is outside the allowed range, the condition fails, resulting in implicit deny.
✗
The request will be denied because the policy does not include a Deny statement.
Why it's wrong here
Denial is due to condition not met, not lack of Deny statement.
✗
The request will be allowed because the condition evaluates to true.
Why it's wrong here
Condition evaluates to false for IP outside 10.0.0.0/8.

Go deeper

ANS-C01 Network Security, Compliance and Governance Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question