SAP-C02 Practice Question: Accelerate Workload Migration and Modernization
Exhibit
Refer to the exhibit.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ec2:DescribeInstances",
"ec2:StartInstances",
"ec2:StopInstances"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": "ec2:TerminateInstances",
"Resource": "arn:aws:ec2:us-east-1:123456789012:instance/*",
"Condition": {
"StringEquals": {
"ec2:ResourceTag/Environment": "production"
}
}
}
]
}Refer to the exhibit. A company has this IAM policy attached to a group. A user in the group tries to terminate an EC2 instance in us-east-1 with the tag 'Environment: staging'. What happens?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The termination is denied because the condition requires the 'Environment' tag to be 'production'.
The TerminateInstances action has a condition that requires the tag 'Environment: production'. Since the instance has 'staging', the condition is not met, so the action is denied. Options A, B, and D are incorrect because the condition explicitly requires 'production'.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The instance is terminated because the policy allows TerminateInstances.
Why it's wrong here
The policy has a condition that restricts to production instances.
- ✓
The termination is denied because the condition requires the 'Environment' tag to be 'production'.
Why this is correct
The condition StringEquals requires the tag value to be 'production'.
- ✗
The termination is denied because the Resource is not the instance's ARN.
Why it's wrong here
The Resource is a wildcard for all instances, so ARN matches.
- ✗
The instance is terminated because the condition is not evaluated.
Why it's wrong here
Conditions are evaluated and must be met.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAP-C02 question from scratch — 1,660 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on SAP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Refer to the exhibit. An IAM policy is attached to an IAM user. The user tries to upload an object to `s3://my-bucket/secret/data.txt` from an IP address in the 10.0.0.0/8 range. What will happen?
hard- A.The upload succeeds because the Allow statement grants s3:PutObject.
- B.The upload succeeds because the Deny statement only applies to GetObject, not PutObject.
- C.The upload fails because the Deny statement denies all s3 actions unconditionally.
- ✓ D.The upload fails because the Deny statement explicitly denies s3:PutObject for the prefix secret/ from the specified IP range.
Why D: The Deny statement explicitly denies all s3 actions (s3:*) for objects with the prefix secret/ when the source IP is in the 10.0.0.0/8 range. Since the user's IP is in that range and the object path starts with secret/, the Deny applies and overrides the Allow statement. Therefore, the upload fails. Options A and B claim success, which is incorrect. Option C says it fails because the Deny is unconditional, but the Deny is conditional on the IP range and prefix, so C is inaccurate. Option D correctly identifies the explicit Deny for s3:PutObject (which is included in s3:*) under the given conditions.
Variation 2. A company attaches the IAM policy shown in the exhibit to an IAM user. The user tries to upload an object to my-bucket using the AWS CLI without the --ssl flag (i.e., using HTTP). What will happen?
hard- A.The upload fails with an implicit denial because the Allow condition is not met.
- B.The upload succeeds because the Allow statement grants s3:PutObject.
- ✓ C.The upload fails with an explicit deny because of the Deny statement.
- D.The upload succeeds because there is no explicit Deny for s3:PutObject.
Why C: The Deny statement with aws:SecureTransport=false explicitly denies non-HTTPS requests. Option A is wrong because the Allow statement requires HTTPS. Option B is wrong because the Deny is explicit. Option D is wrong because the Deny is explicit.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.