PAS-C01 Operations and Maintenance Practice Question

Exhibit

Refer to the exhibit.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "ec2:CreateSnapshot",
      "Resource": "arn:aws:ec2:us-east-1:123456789012:volume/*",
      "Condition": {
        "StringLike": {
          "ec2:ResourceTag/Name": "SAP-HANA-*"
        }
      }
    }
  ]
}

An administrator created the IAM policy shown in the exhibit for the operations team. The team needs to create snapshots of EBS volumes that have the tag 'Name' with a value starting with 'SAP-HANA-'. However, the policy is not working as expected. What is the most likely reason?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The 'ec2:CreateSnapshot' action does not support the 'ec2:ResourceTag' condition key.

The ec2:CreateSnapshot action does not support the ec2:ResourceTag condition key. Condition keys must be supported by the action. Option A is incorrect because the resource ARN is correct for volumes. Option B is incorrect because the action 'ec2:CreateSnapshot' is correct; the plural form is not valid. Option C is incorrect because 'ec2:ResourceTag' is the proper format for EC2 resource tags, but this condition key is not supported for the ec2:CreateSnapshot action.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The resource ARN is incorrect; it should specify the snapshot resource type.
Why it's wrong here
The resource ARN is correct for volumes. Option A is wrong.
✗
The action 'ec2:CreateSnapshot' should be 'ec2:CreateSnapshots' (plural).
Why it's wrong here
The action is allowed, so Option B is wrong.
✗
The condition key should be 'aws:ResourceTag' instead of 'ec2:ResourceTag'.
Why it's wrong here
The condition is not about the snapshot resource, so Option C is wrong.
✓
The 'ec2:CreateSnapshot' action does not support the 'ec2:ResourceTag' condition key.
Why this is correct
The ec2:CreateSnapshot action does not support the ec2:ResourceTag condition key. Condition keys must be supported by the action. Option D is correct.

Go deeper

PAS-C01 Operations and Maintenance Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question