PAS-C01 Operations and Maintenance Practice Question

Exhibit

Refer to the exhibit.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeInstances",
        "ec2:StartInstances",
        "ec2:StopInstances"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Deny",
      "Action": "ec2:TerminateInstances",
      "Resource": "*",
      "Condition": {
        "StringNotEquals": {
          "ec2:ResourceTag/Environment": "Production"
        }
      }
    }
  ]
}

The operations team uses the IAM policy above for a group of administrators. An administrator tries to terminate an EC2 instance that is tagged with Environment=Production. What will happen?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The termination will be denied because there is no explicit Allow for TerminateInstances

The Deny statement has a condition that denies termination only when the tag is NOT Production. Since the instance is tagged Production, the condition is not met, so the Deny does not apply. The Allow statement does not include TerminateInstances, so there is no explicit Allow for termination. The default is implicit Deny, so the action is denied.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The termination will be denied because the Deny condition applies to all instances
Why it's wrong here
The Deny condition explicitly excludes Production instances.
✗
The termination will be allowed because the Deny condition is not met
Why it's wrong here
The Deny condition not being met does not create an Allow.
✗
The termination will be allowed because the Deny does not apply to Production instances
Why it's wrong here
Even if Deny doesn't apply, there is no explicit Allow, so it is implicitly denied.
✓
The termination will be denied because there is no explicit Allow for TerminateInstances
Why this is correct
Without an explicit Allow, the action is implicitly denied.

Go deeper

PAS-C01 Operations and Maintenance Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question