PAS-C01 IAM Policy Evaluation Logic Practice Question
Exhibit
Refer to the exhibit.
IAM policy attached to an EC2 instance role:
```json
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ec2:DescribeInstances",
"ec2:CreateSnapshot",
"ec2:CreateTags",
"ec2:DeleteSnapshot"
],
"Resource": "*"
},
{
"Effect": "Deny",
"Action": "ec2:DeleteSnapshot",
"Resource": "arn:aws:ec2:us-east-1:123456789012:snapshot/snap-0abcdef1234567890"
}
]
}
```Refer to the exhibit. An operations team uses an EC2 instance with this IAM policy to manage EBS snapshots for SAP HANA backups. The backup script calls the DeleteSnapshot API for snapshot snap-0abcdef1234567890. What will happen?
⚠ Common exam trap
A common trap is to assume that an Allow statement always grants access. In AWS IAM, an explicit Deny takes precedence over any Allow, even if the Allow appears more specific.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The DeleteSnapshot API call will be denied.
The IAM policy evaluation logic dictates that an explicit Deny overrides any Allow. Since the policy explicitly denies DeleteSnapshot for the specific snapshot snap-0abcdef1234567890, the API call will be denied even if an Allow statement exists. Option A is incorrect because the Deny is not restricted to 'other snapshots'; it specifically targets the snapshot in question. Option B is incorrect because the Allow does not override an explicit Deny. Option C is incorrect because the policy is syntactically valid; the explicit Deny is a legitimate policy statement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The snapshot will be deleted because the Deny applies only to other snapshots.
Why it's wrong here
Incorrect. The Deny statement explicitly lists the snapshot ARN, so it applies directly to snap-0abcdef1234567890, not just 'other snapshots'.
- ✗
The snapshot will be deleted because the Allow statement grants permission.
Why it's wrong here
Incorrect. Even though there is an Allow statement, the explicit Deny overrides it, so the DeleteSnapshot call will be denied.
- ✗
The policy is invalid and will cause an error.
Why it's wrong here
Incorrect. The policy is valid; explicit Deny statements are a common and valid way to restrict actions on specific resources.
- ✓
The DeleteSnapshot API call will be denied.
Why this is correct
Correct. The explicit Deny on the specific snapshot ARN ensures the DeleteSnapshot API call is denied.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PAS-C01 question from scratch — 1,616 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PAS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PAS-C01 exam.