SAP-C02 Continuous Improvement for Existing Solutions Practice Question

Exhibit

Refer to the exhibit.
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeInstances",
        "ec2:StartInstances",
        "ec2:StopInstances"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "ec2:ResourceTag/Environment": "production"
        }
      }
    }
  ]
}

Refer to the exhibit. An IAM policy is attached to a group. A user in the group tries to stop an EC2 instance with the tag 'Environment=production'. The action fails. What is the MOST likely reason?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The ec2:ResourceTag condition key is not supported for ec2:StopInstances.

The ec2:ResourceTag condition key is not supported for the ec2:StopInstances action; it is only supported for read actions such as ec2:DescribeInstances. Therefore, even though the instance has the tag 'Environment=production', the condition is not evaluated and the action fails. Option B is incorrect because the Resource element '*' includes all instances. Option C is incorrect because the policy does include ec2:StopInstances. Option D is incorrect because a resource ARN is not required for the condition to work; the issue is the unsupported condition key.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
The ec2:ResourceTag condition key is not supported for ec2:StopInstances.
Why this is correct
The ec2:ResourceTag condition key is not supported for ec2:StopInstances or ec2:StartInstances actions.
✗
The Resource element is set to '*', which does not include the specific instance.
Why it's wrong here
'*' includes all resources.
✗
The ec2:StopInstances action is not listed in the policy.
Why it's wrong here
It is listed.
✗
The policy requires a resource ARN for the condition to work.
Why it's wrong here
Resource ARN is not required for condition evaluation.

Go deeper

1 more way this is tested on SAP-C02

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. Refer to the exhibit. An IAM policy is attached to an IAM group. When a user in the group tries to start a stopped EC2 instance with the tag 'Environment: production', the action fails. What is the MOST likely reason?

medium

A.The policy is attached to a group, not directly to the user.
B.The user does not have MFA enabled.
C.The policy does not allow 'ec2:StartInstances' on all resources.
✓ D.The 'ec2:StartInstances' action does not support resource-level conditions.

Why D: The policy includes a condition requiring the resource tag 'Environment: production', but the ec2:StartInstances action does not support resource-level condition keys (like ec2:ResourceTag). Therefore, the condition is never evaluated, and the action is denied by default. Option A is incorrect because attaching the policy to a group effectively applies it to all group members. Option B is incorrect because the policy does not require MFA. Option C is incorrect because the policy does allow ec2:StartInstances on specific resources, but the condition is the issue.

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.

SAP-C02 Continuous Improvement for Existing Solutions Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question

1 more way this is tested on SAP-C02