SOA-C02 Security and Compliance Practice Question
A SysOps administrator is troubleshooting an issue where an IAM user can launch EC2 instances but cannot terminate them. The user's permissions are based on an IAM group policy. Which action should the administrator take to resolve this?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Review and modify the IAM group policy to include ec2:TerminateInstances action
The administrator should review the group policy to ensure it includes ec2:TerminateInstances. The issue is likely a missing action in the policy, not a service control policy (SCP) or session policy issue, and simply adding the user to a new group won't fix the underlying policy gap.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Attach a managed policy that includes ec2:TerminateInstances directly to the user
Why it's wrong here
Attaching a managed policy directly to the user would grant the required permission, but this bypasses IAM's recommended group-based access management and does not address the underlying group policy defect. It also creates a maintenance burden because future users in the same group will still be unable to terminate instances, and any cross-group explicit denies would still apply.
- ✗
Add the user to a different IAM group that has the required permissions
Why it's wrong here
Adding the user to a different IAM group is unreliable because the new group's policies may also lack ec2:TerminateInstances, and doing so grants the user the aggregate permissions of both groups, potentially violating least privilege. It shifts the user out of the intended group rather than fixing the actual misconfiguration in the original group's policy, so the root cause remains.
- ✗
Check the user's permissions boundary for any restrictions
Why it's wrong here
A permissions boundary is an advanced IAM feature that sets the maximum permissions a principal can receive, but it is not the first thing to check when a user cannot perform an action because a group policy is typically the source. Even if a boundary is present, the explicit issue is that the group policy does not include the terminate action; reviewing the effective permissions would confirm the boundary only narrows, not trivially blocks, unless a specific deny exists.
- ✓
Review and modify the IAM group policy to include ec2:TerminateInstances action
Why this is correct
The most likely root cause is that the IAM group policy attached to the user's group does not include an ec2:TerminateInstances action, so modifying that policy to allow the API call resolves the issue for every member of the group. Use a statement with "Effect": "Allow" for ec2:TerminateInstances on the appropriate resource, then test with the IAM policy simulator to verify effective access.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every SOA-C02 question from scratch — 247 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.