PAS-C01 IAM Policy Condition Practice Question
Exhibit
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "ec2:Describe*",
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"ec2:StartInstances",
"ec2:StopInstances"
],
"Resource": "arn:aws:ec2:us-east-1:123456789012:instance/*",
"Condition": {
"StringEquals": {
"ec2:ResourceTag/Environment": "non-production"
}
}
}
]
}Refer to the exhibit. An IAM policy is created for an automated script that starts and stops EC2 instances. The script is failing to stop an instance with the tag 'Environment: non-production'. What is the most likely cause?
⚠ Common exam trap
The trap is that candidates may assume a lack of ec2:StopInstances action is the cause, but the policy actually includes it; the issue is the tag condition not being satisfied.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The EC2 instance does not have the tag 'Environment' with value 'non-production'.
The IAM policy is configured with a condition that requires the EC2 instance to have the tag 'Environment' with value 'non-production' for both StartInstances and StopInstances actions. If the instance does not have this exact tag, the action is denied. Option B is incorrect because the policy likely includes the ec2:StopInstances action, but the condition is not met. Option C is incorrect because the policy does not require ec2:Describe* actions for the stop operation to work. Option D is incorrect because the condition is applied equally to both StartInstances and StopInstances.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The EC2 instance does not have the tag 'Environment' with value 'non-production'.
Why this is correct
The condition requires the instance to have that exact tag; otherwise, the action is denied.
- ✗
The policy does not include ec2:StopInstances action.
Why it's wrong here
The policy includes both Start and Stop.
- ✗
The policy does not allow ec2:Describe* actions for instances.
Why it's wrong here
Describe* is allowed for all resources.
- ✗
The condition is applied to the ec2:StartInstances action but not ec2:StopInstances.
Why it's wrong here
The condition applies to both actions in the list.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PAS-C01 question from scratch — 1,616 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PAS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PAS-C01 exam.