IAM Policy Evaluation: Explicit Deny Overrides Allow
Exhibit
Refer to the exhibit.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ec2:DescribeInstances",
"ec2:StartInstances",
"ec2:StopInstances"
],
"Resource": "*"
},
{
"Effect": "Deny",
"Action": "*",
"Resource": "*",
"Condition": {
"StringNotEquals": {
"aws:SourceIp": "203.0.113.0/24"
}
}
}
]
}Refer to the exhibit. An IAM policy is attached to a group. An IAM user in that group attempts to stop an EC2 instance from IP address 198.51.100.10. What will happen?
Quick Answer
The answer is that the action is denied because the source IP does not match the allowed range. This occurs because the IAM policy includes an explicit deny statement with a `NotIpAddress` condition that restricts all actions to the `10.0.0.0/8` range, and the user’s IP of `198.51.100.10` falls outside it. In IAM policy evaluation, an explicit deny always overrides any allow, meaning the deny statement takes precedence regardless of the allow block in the same policy. On the AWS Certified Security Specialty SCS-C02 exam, this concept tests your understanding of the explicit deny override principle, often appearing in scenarios where a condition key like `aws:SourceIp` is used to restrict access. A common trap is assuming an allow statement can bypass a deny with a mismatched condition; remember that explicit deny is the final authority. Memory tip: “Deny is the final say—if the condition doesn’t match, the action won’t dispatch.”
⚠ Common exam trap
Candidates often assume the allow statement with `Effect: Allow` and `Action: ec2:StopInstances` will grant permission, forgetting that an explicit deny with a condition that does not match the request context takes precedence over any allow.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The action is denied because the source IP does not match the allowed range
The IAM policy includes a `Deny` statement with a `NotIpAddress` condition that restricts all actions (including `StopInstances`) to the IP range `10.0.0.0/8`. Since the user's source IP is `198.51.100.10`, which falls outside this range, the deny statement explicitly blocks the action. In IAM, an explicit deny always overrides any allow, so the request is denied regardless of the allow statement in the first policy block.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The action is allowed because the first statement allows StopInstances
Why it's wrong here
Deny overrides allow regardless of order.
- ✗
The action is allowed because the resource is '*'
Why it's wrong here
The Deny applies to all resources.
- ✓
The action is denied because the source IP does not match the allowed range
Why this is correct
The Deny statement blocks requests from IPs not in the allowed range.
- ✗
The action is denied only if the user is not using MFA
Why it's wrong here
The condition does not mention MFA.
Go deeper
Related to this question
About these practice questions
One of 376 original SCS-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SCS-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Refer to the exhibit. An IAM user has this policy attached. Can the user create a new IAM user in the us-east-1 region?
easy- A.Yes, because the Allow statement explicitly permits CreateUser.
- B.No, because IAM is a global service and region conditions do not apply.
- C.Yes, because the Deny only applies to us-east-1.
- ✓ D.No, because the Deny statement blocks all IAM actions in us-east-1.
Why D: The Deny statement blocks all IAM actions in us-east-1, which overrides the Allow for CreateUser. Since the Deny is explicit, it blocks the action even though there is an Allow. The request fails.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.