SAP-C02 Practice Question: Design Solutions for Organizational Complexity

Exhibit

Refer to the exhibit.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Action": "ec2:RunInstances",
      "Resource": "arn:aws:ec2:*:*:instance/*",
      "Condition": {
        "StringNotEquals": {
          "ec2:InstanceType": ["t3.micro", "t3.small"]
        }
      }
    }
  ]
}

An administrator attached the above IAM policy to a group of developers. A developer tries to launch a t3.medium EC2 instance and receives an 'AccessDenied' error. What is the MOST likely reason?

⚠ Common exam trap

The trap here is that candidates may overlook the explicit Deny statement and assume the error is due to a missing Allow, but AWS IAM requires both an Allow and no matching Deny for the action to succeed, and the Deny here is the direct cause of the failure.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The policy denies all instance types except t3.micro and t3.small.

The IAM policy includes a Deny statement that explicitly denies ec2:RunInstances for any instance type that is not t3.micro or t3.small. Since the developer is attempting to launch a t3.medium instance, which is not listed in the allowed types, the Deny statement matches and overrides any Allow, resulting in an AccessDenied error. This is the most likely reason because explicit Deny always takes precedence over Allow in IAM policy evaluation logic.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
The policy denies all instance types except t3.micro and t3.small.
Why this is correct
The condition denies if the instance type is not in the list.
✗
The policy has a syntax error that causes all actions to be denied.
Why it's wrong here
The policy syntax is valid.
✗
The policy does not explicitly allow ec2:RunInstances.
Why it's wrong here
An explicit deny overrides any allow, so the allow is not needed here.
✗
The policy requires a specific Amazon Machine Image (AMI) that the developer is not using.
Why it's wrong here
The policy does not reference AMIs.

Go deeper

SAP-C02 Practice Question: Design Solutions for Organizational Complexity

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question