SAP-C02 Continuous Improvement for Existing Solutions Practice Question

Exhibit

Refer to the exhibit.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeInstances",
        "ec2:StartInstances",
        "ec2:StopInstances"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "ec2:ResourceTag/Environment": "production"
        }
      }
    }
  ]
}

Refer to the exhibit. An IAM policy is attached to an IAM group. When a user in the group tries to start a stopped EC2 instance with the tag 'Environment: production', the action fails. What is the MOST likely reason?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The 'ec2:StartInstances' action does not support resource-level conditions.

The policy includes a condition requiring the resource tag 'Environment: production', but the ec2:StartInstances action does not support resource-level condition keys (like ec2:ResourceTag). Therefore, the condition is never evaluated, and the action is denied by default. Option A is incorrect because attaching the policy to a group effectively applies it to all group members. Option B is incorrect because the policy does not require MFA. Option C is incorrect because the policy does allow ec2:StartInstances on specific resources, but the condition is the issue.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The policy is attached to a group, not directly to the user.
Why it's wrong here
Group attachment works fine.
✗
The user does not have MFA enabled.
Why it's wrong here
No MFA condition in the policy.
✗
The policy does not allow 'ec2:StartInstances' on all resources.
Why it's wrong here
It does allow with a condition, but the condition may not be evaluated properly.
✓
The 'ec2:StartInstances' action does not support resource-level conditions.
Why this is correct
StartInstances only supports instance-level conditions, but the condition is on the resource tag; however, the condition must be on the request, not resource, for such actions.

Go deeper

SAP-C02 Continuous Improvement for Existing Solutions Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question