SAP-C02 Continuous Improvement for Existing Solutions Practice Question

Exhibit

Refer to the exhibit.

iam-policy.json:
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "ec2:Describe*",
      "Resource": "*"
    },
    {
      "Effect": "Deny",
      "Action": "ec2:TerminateInstances",
      "Resource": "arn:aws:ec2:us-east-1:123456789012:instance/*"
    }
  ]
}

An IAM policy is attached to a group. A user in the group tries to terminate an EC2 instance in us-east-1 using the AWS CLI. What will happen?

⚠ Common exam trap

A common mix-up: candidates assume that a Deny on a specific action (terminate) also blocks related read actions (describe), but IAM evaluates each action independently, so describe is still allowed.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The user can describe instances but cannot terminate instances in any region.

The IAM policy attached to the group allows the user to describe instances (ec2:DescribeInstances) but explicitly denies the ability to terminate instances (ec2:TerminateInstances) in any region. Since the policy is attached to the group, the user inherits these permissions, so they can list instances but any attempt to terminate them will be denied by AWS IAM, regardless of the region specified.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The user cannot describe instances or terminate instances.
Why it's wrong here
Describe is allowed by the first statement.
✗
The user can terminate instances and describe instances.
Why it's wrong here
Deny overrides Allow for termination.
✓
The user can describe instances but cannot terminate instances in any region.
Why this is correct
The Deny resource uses a wildcard for instance ID, effectively denying termination of any instance in the account in us-east-1.
✗
The user can describe instances but cannot terminate any instances.
Why it's wrong here
The user can describe, but the Deny prevents termination.

Go deeper

SAP-C02 Continuous Improvement for Existing Solutions Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question