mediumMultiple ChoiceObjective-mapped

CV0-004 IAM Policy Evaluation Practice Question

Exhibit

Refer to the exhibit.

```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeInstances",
        "ec2:StartInstances",
        "ec2:StopInstances"
      ],
      "Resource": "arn:aws:ec2:us-east-1:123456789012:instance/*",
      "Condition": {
        "StringEquals": {
          "ec2:ResourceTag/Environment": "production"
        }
      }
    },
    {
      "Effect": "Deny",
      "Action": "ec2:TerminateInstances",
      "Resource": "*"
    }
  ]
}
```

Refer to the exhibit. An IAM policy is attached to a group that includes engineers. An engineer attempts to start a stopped EC2 instance that has tags {Environment: development, Project: alpha}. What will happen?

⚠ Common exam trap

The key trap is that candidates may focus on the Deny for TerminateInstances and incorrectly think it blocks StartInstances, or they may misread the condition in the Allow. The correct reasoning is that the Allow condition is satisfied, so the action is permitted.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The engineer can start the instance because the policy allows ec2:StartInstances.

The IAM policy includes an Allow statement for ec2:StartInstances with a condition requiring the instance to have tags {Environment: development, Project: alpha}. The instance in question has exactly those tags, so the condition is met. The Allow applies, granting permission to start the instance. The Deny statement only affects ec2:TerminateInstances and does not block StartInstances. Since there is no other Deny applicable to StartInstances, the engineer is allowed to start the instance. Therefore, option A is correct.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
The engineer can start the instance because the policy allows ec2:StartInstances.
Why this is correct
Correct. The Allow condition is met (instance has required tags), so the engineer can start the instance.
✗
The engineer cannot start the instance because the Deny on ec2:TerminateInstances also blocks StartInstances.
Why it's wrong here
Incorrect. The Deny on ec2:TerminateInstances does not affect ec2:StartInstances. They are separate actions.
✗
The engineer can start the instance because the Deny does not apply to start actions.
Why it's wrong here
Incorrect. It is true that the Deny does not apply, but that alone does not explain why the engineer can start. The real reason is the Allow condition is satisfied.
✗
The engineer cannot start the instance because the Allow condition is not met.
Why it's wrong here
Incorrect. The Allow condition is met because the instance has the required tags. Therefore, the engineer can start the instance, not prevented by unmet condition.

Go deeper

CV0-004 IAM Policy Evaluation Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question