PAS-C01 Technology Practice Question
An SAP system administrator needs to grant an external auditor read-only access to view EC2 instance configurations and CloudWatch logs. Which IAM policy should they use?
⚠ Common exam trap
Many exam-takers choose SecurityAudit because it sounds security-focused, but it lacks the broad read-only access to EC2 and CloudWatch logs required for this specific auditor scenario.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS managed policy: ReadOnlyAccess
The ReadOnlyAccess AWS managed policy grants read-only access to all AWS services and resources, including EC2 instance configurations and CloudWatch logs, without allowing any write or modify actions. This policy is the most appropriate for an external auditor who needs to view but not change any resources, as it provides the necessary read permissions across services while preventing any modifications.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS managed policy: SecurityAudit
Why it's wrong here
SecurityAudit is limited to security-related services, not EC2 configurations.
- ✓
AWS managed policy: ReadOnlyAccess
Why this is correct
ReadOnlyAccess provides read-only access to all services, suitable for auditors.
- ✗
AWS managed policy: AdministratorAccess
Why it's wrong here
AdministratorAccess grants full permissions, not read-only.
- ✗
AWS managed policy: PowerUserAccess
Why it's wrong here
PowerUserAccess allows creating resources, exceeding read-only.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PAS-C01 question from scratch — 1,616 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PAS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PAS-C01 exam.