Courseiva
← PAS-C01
Full test
Technology →mediumMultiple ChoiceObjective-mapped

PAS-C01 Technology Practice Question

Exhibit

{"content":"Refer to the exhibit.\n\n```json\n{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Effect\": \"Allow\",\n      \"Action\": [\n        \"ec2:AttachVolume\",\n        \"ec2:DetachVolume\"\n      ],\n      \"Resource\": \"arn:aws:ec2:us-east-1:123456789012:volume/*\",\n      \"Condition\": {\n        \"StringEquals\": {\n          \"ec2:ResourceTag/SAPSystem\": \"PRD\"\n        }\n      }\n    },\n    {\n      \"Effect\": \"Allow\",\n      \"Action\": [\n        \"ec2:AttachVolume\",\n        \"ec2:DetachVolume\"\n      ],\n      \"Resource\": \"arn:aws:ec2:us-east-1:123456789012:instance/*\",\n      \"Condition\": {\n        \"StringEquals\": {\n          \"ec2:ResourceTag/SAPSystem\": \"PRD\"\n        }\n      }\n    }\n  ]\n}\n```","description":"IAM policy for SAP administrators"}

Refer to the exhibit. An SAP administrator has the IAM policy shown. The administrator needs to attach an EBS volume to an EC2 instance that is tagged with SAPSystem=DEV. Will the administrator be able to perform the attach operation?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

No, because the condition requires the tag SAPSystem=PRD

The policy allows AttachVolume and DetachVolume actions, but only when the volume or instance resource has the tag SAPSystem=PRD. Since the instance is tagged DEV, the condition is not met, and the operation will be denied.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✓

    No, because the condition requires the tag SAPSystem=PRD

    Why this is correct

    The condition StringEquals requires the tag to be PRD, not DEV.

  • ✗

    No, because the policy does not allow attaching volumes

    Why it's wrong here

    The policy does allow the actions, but only under conditions.

  • ✗

    Yes, because the policy allows the actions

    Why it's wrong here

    The policy includes a condition that restricts to PRD tag.

  • ✗

    Yes, because the resource is not restricted

    Why it's wrong here

    The resource is restricted by the condition.

About these practice questions

One of 1,616 original PAS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Same concept, more angles

1 more way this is tested on PAS-C01

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. An SAP administrator attaches this IAM policy to a user. Which action will the user be allowed to perform on an EC2 instance with the tag 'Environment: Production'?

hard
  • A.Start the instance
  • B.Terminate the instance
  • ✓ C.Reboot the instance
  • D.Modify the instance type

Why C: The IAM policy grants the ec2:RebootInstances action with a condition that the resource must have the tag 'Environment: Production'. Therefore, the user is allowed to reboot any EC2 instance that carries that tag. The other actions (start, terminate, modify instance type) are not explicitly allowed by the policy, so they are denied by default.

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This PAS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PAS-C01 exam.