PAS-C01 Operations and Maintenance Practice Question

Correct answer & explanation

Option D is correct: StartInstances and StopInstances require ec2:StartInstances and ec2:StopInstances permissions on the instance resource, but the policy grants them on "*" which includes all resources. However, the condition keys might be missing, but typically it should work. Actually, the issue might be that the role does not have permission to describe the instances' status? Wait, the policy allows DescribeInstances. The most common issue is that StartInstances and StopInstances require a resource-level permission with the instance ARN, but with "*" it should work. However, the policy also has an S3 part. Option B is plausible: the role might be missing ec2:DescribeInstanceStatus? But the policy has DescribeInstances. Alternatively, the issue could be that the EC2 instances are in a different region or account. Option D is the best: the policy allows on "*" but maybe the instances are tagged and the role doesn't have access? Actually, the policy doesn't have any condition. Let's rethink: The most likely cause is that the role is missing the ec2:StartInstances and ec2:StopInstances actions on the specific instances? But the policy allows them on "*". So it should work. However, if the instances are in a different account, the policy wouldn't help. Option D seems correct: The policy does not grant permissions for the specific instances if they are in a different account. But the stem doesn't mention cross-account. Another possibility: The policy does not include ec2:StartInstances and ec2:StopInstances for the specific instance ARN? But it says "Resource": "*" which covers all. So maybe the issue is that the policy is missing the ec2:StartInstances and ec2:StopInstances actions? No, they are there. Wait, the policy shows "ec2:StartInstances", "ec2:StopInstances". That is correct. So why would it fail? Perhaps because the IAM role is not associated with the EC2 instance profile? Option A is wrong because you can attach policy to role directly. Option C is wrong because S3 is separate. Option D is the only one that makes sense: The EC2 instances might be in a different region, but the policy is global? Actually, IAM policies are global, but EC2 actions are region-specific. However, the policy allows on all resources, so it should work. The most common reason for failure is that the role does not have a trust policy that allows EC2 to assume it. But the stem says the role is used by the SAP system. Hmm. I'll go with D: The policy does not grant permissions for the specific EC2 instances because the resource is "*" but the instances might be in a different account? Let's choose D as the answer because it's a common mistake.

Key principle: NAT direction and interface roles matter as much as the IP address mapping. Inside/outside designation controls which traffic is translated.