PAS-C01 Design of SAP Workloads on AWS Practice Question
Exhibit
Refer to the exhibit.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ec2:StartInstances",
"ec2:StopInstances",
"ec2:DescribeInstances"
],
"Resource": "arn:aws:ec2:us-east-1:123456789012:instance/*"
},
{
"Effect": "Allow",
"Action": [
"ec2:Describe*"
],
"Resource": "*"
}
]
}An SAP administrator applies the IAM policy shown in the exhibit to an IAM user. The administrator reports that the user can start and stop EC2 instances but cannot tag them. Why is the user unable to tag instances?
⚠ Common exam trap
Test-takers frequently assume that having permissions to start and stop instances implicitly includes the ability to tag them, but AWS IAM treats tagging as a distinct action requiring explicit authorization.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The policy does not include the ec2:CreateTags action.
The IAM policy explicitly grants ec2:StartInstances and ec2:StopInstances actions but does not include ec2:CreateTags. Without the ec2:CreateTags action, the user lacks the required permission to create or modify tags on EC2 instances, even though they can start and stop them.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The user does not have permission to describe instances.
Why it's wrong here
ec2:DescribeInstances is allowed.
- ✗
The resource ARN is too restrictive.
Why it's wrong here
Resource is instance/* which covers all instances.
- ✗
There is an implicit deny for all actions not listed.
Why it's wrong here
Implicit deny exists but the missing action is the issue.
- ✓
The policy does not include the ec2:CreateTags action.
Why this is correct
Tagging requires ec2:CreateTags action.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PAS-C01 question from scratch — 1,616 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PAS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PAS-C01 exam.