PAS-C01 Design of SAP Workloads on AWS Practice Question

Exhibit

Refer to the exhibit.

```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeInstances",
        "ec2:StopInstances",
        "ec2:StartInstances"
      ],
      "Resource": "arn:aws:ec2:us-east-1:123456789012:instance/*",
      "Condition": {
        "StringEquals": {
          "ec2:ResourceTag/Environment": "Production"
        }
      }
    }
  ]
}
```

An SAP administrator created the IAM policy shown in the exhibit to allow a monitoring tool to start and stop SAP application servers tagged with Environment=Production. When testing the policy, the tool fails to start an instance. What is the most likely cause?

⚠ Common exam trap

Test-takers frequently assume the condition `ec2:InstanceState/Name` equals `running` is correct for starting instances, confusing the required state for start (stopped) with the state for stop (running).

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The policy does not allow starting instances that are already running.

The policy uses a condition that checks if the instance is already running (`ec2:InstanceState/Name` equals `running`). The `ec2:StartInstances` action is only allowed when the instance is in the `running` state, but starting an instance requires it to be in the `stopped` state. This mismatch causes the start action to fail for production-tagged instances.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The policy requires the instance to be stopped before starting.
Why it's wrong here
The policy does not require any precondition.
✗
The policy is missing the ec2:DescribeInstances action.
Why it's wrong here
The policy includes ec2:DescribeInstances.
✓
The policy does not allow starting instances that are already running.
Why this is correct
ec2:StartInstances only works on stopped instances; attempting to start a running instance fails.
✗
The resource ARN does not match the instance ID.
Why it's wrong here
The resource ARN uses a wildcard and matches all instances.

Go deeper

PAS-C01 Design of SAP Workloads on AWS Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question