ANS-C01 Network Security, Compliance and Governance Practice Question

Exhibit

Refer to the exhibit.
```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ec2:DescribeInstances",
                "ec2:StartInstances",
                "ec2:StopInstances"
            ],
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "ec2:ResourceTag/Environment": "production"
                }
            }
        }
    ]
}
```

An IAM policy is created and attached to a user. The user reports they cannot stop a production EC2 instance. What is the most likely reason?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The EC2 instance does not have the tag Environment=production

The IAM policy likely includes a condition key such as ec2:ResourceTag/Environment requiring the instance to have the tag 'Environment=production'. If the instance lacks that tag, the action is denied, even if the user has the permission to stop instances. Options B, C, and D are incorrect because the issue is specifically due to the missing tag, not a region condition, group attachment, or missing action.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
The EC2 instance does not have the tag Environment=production
Why this is correct
Condition requires the tag.
✗
The policy is missing a region condition
Why it's wrong here
No region condition needed.
✗
The policy is not attached to the user's group
Why it's wrong here
Policy is attached directly to user.
✗
The policy does not include ec2:StopInstances
Why it's wrong here
It does include ec2:StopInstances.

Go deeper

ANS-C01 Network Security, Compliance and Governance Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question