PAS-C01 Technology Practice Question
Exhibit
Refer to the exhibit.
```
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ec2:AttachVolume",
"ec2:DetachVolume"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"ec2:ResourceTag/Environment": "production"
}
}
},
{
"Effect": "Deny",
"Action": "ec2:DeleteVolume",
"Resource": "*"
}
]
}
```An IAM policy is attached to a user who manages SAP HANA volumes. The policy is shown in the exhibit. What is the effect of this policy?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The user can attach and detach volumes that have the tag Environment=production, but cannot delete any volume.
The first statement allows ec2:AttachVolume and ec2:DetachVolume only if the volume has tag Environment=production. The second statement denies ec2:DeleteVolume for all volumes. Therefore, the user can attach and detach volumes that have the tag Environment=production, but cannot delete any volume. Option A is incorrect because attach/detach are allowed only with the condition. Option B is incorrect because delete is denied for all volumes. Option D is incorrect because the allow statement is conditional on the specific tag value, not just the production environment.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The user can attach and detach any volume regardless of tags.
Why it's wrong here
Incorrect because the attach and detach actions are conditional on the volume having the tag Environment=production.
- ✗
The user can delete any volume.
Why it's wrong here
Incorrect because the policy explicitly denies the DeleteVolume action for all volumes.
- ✓
The user can attach and detach volumes that have the tag Environment=production, but cannot delete any volume.
Why this is correct
Correct: The first statement allows AttachVolume and DetachVolume only when the volume has the tag Environment=production. The second statement denies DeleteVolume for all volumes. Thus, the user can attach/detach volumes with that tag but cannot delete any volume.
- ✗
The user can attach and detach any volume in the production environment.
Why it's wrong here
Incorrect because the allow statement is conditional on the specific tag key-value pair, not just the 'production environment' notion.
Go deeper
Related to this question
About these practice questions
This PAS-C01 question is part of Courseiva's 1,616-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PAS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PAS-C01 exam.