mediumMultiple ChoiceObjective-mapped

CV0-004 Practice Question: A cloud architect reviews the above IAM policy…

Exhibit

Refer to the exhibit.

```
{
  "PolicyDocument": {
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "ec2:StopInstances",
          "ec2:StartInstances"
        ],
        "Resource": "arn:aws:ec2:us-east-1:111122223333:instance/*",
        "Condition": {
          "StringEquals": {
            "ec2:ResourceTag/Environment": "production"
          }
        }
      },
      {
        "Effect": "Deny",
        "Action": [
          "ec2:TerminateInstances"
        ],
        "Resource": "*"
      }
    ]
  }
}
```

A cloud architect reviews the above IAM policy attached to a user. What is the effect of this policy on the user's ability to stop or terminate instances?

⚠ Common exam trap

CompTIA often tests the nuance that a Deny with a condition does not implicitly allow the action for matching resources—you must have an explicit Allow statement for the action to be permitted, and here termination is never allowed.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The user can stop only production-tagged instances and cannot terminate any instances

The policy uses a Condition block with StringNotEquals to explicitly deny ec2:StopInstances and ec2:TerminateInstances when the resource tag 'environment' is not equal to 'production'. Since the Deny effect overrides any Allow, the user can only stop instances tagged with 'environment=production' and cannot terminate any instances because the TerminateInstances action is also denied for non-production tags and there is no Allow for termination.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The user can stop any instance but cannot terminate any instance
Why it's wrong here
The Allow statement is conditional; only production-tagged instances can be stopped.
✓
The user can stop only production-tagged instances and cannot terminate any instances
Why this is correct
Allow is scoped to production-tagged, and Deny explicitly blocks termination.
✗
The user can stop only production-tagged instances and terminate only production-tagged instances
Why it's wrong here
Deny applies to all resources, blocking termination entirely.
✗
The user can stop any instance and terminate any instance
Why it's wrong here
The Deny on termination overrides any allow.

Go deeper

CV0-004 Practice Question: A cloud architect reviews the above IAM policy…

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question