SCS-C02 Identity and Access Management Practice Question

Correct answer & explanation

The most likely reason is that the user has another policy attached (such as an identity-based policy or a service control policy) that explicitly denies ec2:RunInstances. The IAM Policy Simulator evaluates all applicable policies, so even if the provided policy only contains an Allow, an explicit deny from another policy overrides and results in an explicitDeny. Option B (syntax error) is not likely because a syntax error typically causes an error or implicit deny, not an explicit deny. Option C is incorrect because the simulate-custom-policy command does support ec2:RunInstances. Option D is incorrect because an incorrect resource ARN would result in an implicit deny, not an explicit deny.