SAP-C02 Continuous Improvement for Existing Solutions Practice Question

Exhibit

Refer to the exhibit.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeInstances",
        "ec2:StartInstances",
        "ec2:StopInstances"
      ],
      "Resource": "*"
    }
  ]
}

A company has an IAM policy attached to a user. When the user tries to stop an EC2 instance using the AWS CLI, they receive an 'AccessDenied' error. The instance is tagged with 'Environment=Production'. What is the most likely cause?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

A service control policy (SCP) or a resource-based policy is denying the action.

The 'AccessDenied' error despite having the StopInstances permission indicates that something else is denying the action. The most likely cause is a service control policy (SCP) attached at the account or organizational level, or a resource-based policy on the EC2 instance itself that explicitly denies the action. Option A is wrong because incorrect CLI syntax would cause a different error. Option B is wrong because the policy may not have a tag-based condition; the issue is not about missing tag permissions. Option C is wrong because the policy can use a wildcard for the Resource field, so not specifying an instance ID does not cause AccessDenied. Option D correctly identifies that an SCP or resource-based policy is denying the action.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The user is using an incorrect CLI command syntax.
Why it's wrong here
An incorrect CLI command syntax would result in a syntax error, not an 'AccessDenied' error. The 'AccessDenied' error indicates a permissions issue.
✗
The policy does not allow the ec2:StopInstances action for instances with the 'Environment=Production' tag.
Why it's wrong here
The policy likely does not include a condition that denies based on tags. The user has the StopInstances permission, but the AccessDenied suggests a broader denial.
✗
The policy does not specify the instance ID in the Resource field.
Why it's wrong here
IAM policies can use wildcard (*) in the Resource field to allow actions on all resources. The error is not due to missing instance ID in the policy.
✓
A service control policy (SCP) or a resource-based policy is denying the action.
Why this is correct
A service control policy (SCP) or resource-based policy can deny actions even if the user's IAM policy allows them. This is the most likely cause of the 'AccessDenied' error.

Go deeper

SAP-C02 Continuous Improvement for Existing Solutions Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question