SOA-C02 Security and Compliance Practice Question
A SysOps administrator is troubleshooting an issue where an IAM user can launch EC2 instances but cannot terminate them. The user's permissions are based on an IAM group policy. Which action should the administrator take to resolve this?
⚠ Common exam trap
SOA-C02 often tests whether candidates jump to user-level policy attachments instead of fixing the group policy that is explicitly identified as the permission source — the exam rewards least-disruption, best-practice fixes.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Review and modify the IAM group policy to include ec2:TerminateInstances action
Since the user's permissions come from an IAM group policy, the missing ec2:TerminateInstances action must be added to that group policy — that's the source of the user's effective permissions. Modifying the group policy grants the permission to all members consistently and follows AWS best practice of managing permissions at the group level.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Attach a managed policy that includes ec2:TerminateInstances directly to the user
Why it's wrong here
Attaching a managed policy directly to the user would grant the required permission, but this bypasses IAM's recommended group-based access management and does not address the underlying group policy defect. It also creates a maintenance burden because future users in the same group will still be unable to terminate instances, and any cross-group explicit denies would still apply.
- ✗
Add the user to a different IAM group that has the required permissions
Why it's wrong here
Adding the user to a different IAM group is unreliable because the new group's policies may also lack ec2:TerminateInstances, and doing so grants the user the aggregate permissions of both groups, potentially violating least privilege. It shifts the user out of the intended group rather than fixing the actual misconfiguration in the original group's policy, so the root cause remains.
- ✗
Check the user's permissions boundary for any restrictions
Why it's wrong here
A permissions boundary is an advanced IAM feature that sets the maximum permissions a principal can receive, but it is not the first thing to check when a user cannot perform an action because a group policy is typically the source. Even if a boundary is present, the explicit issue is that the group policy does not include the terminate action; reviewing the effective permissions would confirm the boundary only narrows, not trivially blocks, unless a specific deny exists.
- ✓
Review and modify the IAM group policy to include ec2:TerminateInstances action
Why this is correct
The most likely root cause is that the IAM group policy attached to the user's group does not include an ec2:TerminateInstances action, so modifying that policy to allow the API call resolves the issue for every member of the group. Use a statement with "Effect": "Allow" for ec2:TerminateInstances on the appropriate resource, then test with the IAM policy simulator to verify effective access.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every SOA-C02 question from scratch — 1,169 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.