PAS-C01 Operations and Maintenance Practice Question
Exhibit
Refer to the exhibit.
```
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "ec2:Describe*",
"Resource": "*"
},
{
"Effect": "Allow",
"Action": "ec2:StartInstances",
"Resource": "arn:aws:ec2:us-east-1:123456789012:instance/*",
"Condition": {
"StringEquals": {
"ec2:ResourceTag/Environment": "production"
}
}
},
{
"Effect": "Allow",
"Action": "ec2:StopInstances",
"Resource": "arn:aws:ec2:us-east-1:123456789012:instance/*",
"Condition": {
"StringEquals": {
"ec2:ResourceTag/Environment": "production"
}
}
}
]
}
```Refer to the exhibit. An IAM policy is attached to a user who manages SAP EC2 instances. Which of the following actions can the user perform?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Describe all EC2 instances, but start and stop only those with the tag Environment=production.
The IAM policy grants ec2:Describe* on all resources, allowing the user to describe any EC2 instance. However, ec2:StartInstances and ec2:StopInstances are only allowed on instances with the tag Environment=production, so the user can start and stop only those instances. Option B is incorrect because the user cannot start/stop all instances—only those with the production tag. Option C is incorrect because the user cannot start/stop any instance; the tag condition restricts these actions. Option D is incorrect because the policy does not allow the ec2:TerminateInstances action at all.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Describe all EC2 instances, but start and stop only those with the tag Environment=production.
Why this is correct
The describe action is wildcard; start/stop have condition.
- ✗
Describe, start, and stop all EC2 instances regardless of tags.
Why it's wrong here
Start/stop are restricted by tag.
- ✗
Start and stop any EC2 instance in the account.
Why it's wrong here
The condition restricts to production-tagged instances.
- ✗
Terminate any EC2 instance with the tag Environment=production.
Why it's wrong here
The policy does not include the ec2:TerminateInstances action.
Go deeper
Related to this question
About these practice questions
One of 1,616 original PAS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PAS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PAS-C01 exam.