PAS-C01 Operations and Maintenance Practice Question
Exhibit
Refer to the exhibit.
```
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ec2:DescribeInstances",
"ec2:StartInstances",
"ec2:StopInstances"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::sap-backups/*"
}
]
}
```An SAP administrator is troubleshooting an issue where an AWS Lambda function is unable to start an EC2 instance. The Lambda execution role has the IAM policy shown in the exhibit. What is the likely cause of the failure?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The Lambda function is not configured with the correct VPC subnet or security group to reach the EC2 instance.
The issue is likely that the Lambda function is not configured with the correct VPC subnet or security group to reach the EC2 instance. Lambda functions running in a VPC require proper networking configuration to interact with EC2 instances in the same VPC. The IAM policy shown allows ec2:StartInstances, ec2:DescribeInstances, and s3:GetObject on the specified resources, so IAM permissions are not the problem. Option A is correct because networking misconfiguration is a common cause of such failures. Options B, C, and D are incorrect as the policy does grant the necessary permissions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The Lambda function is not configured with the correct VPC subnet or security group to reach the EC2 instance.
Why this is correct
Lambda may need VPC access to start instances in a VPC, but the policy is fine.
- ✗
The policy does not allow ec2:DescribeInstances.
Why it's wrong here
The policy allows ec2:DescribeInstances.
- ✗
The policy does not allow ec2:StartInstances.
Why it's wrong here
The policy explicitly allows ec2:StartInstances on all resources.
- ✗
The policy does not allow s3:GetObject on the specific backup object.
Why it's wrong here
The policy allows s3:GetObject on any object in the sap-backups bucket.
Visual reference
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every PAS-C01 question from scratch — 1,616 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PAS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PAS-C01 exam.