CEH Practice Question: Advanced Topics: Wireless, Cloud, IoT, Cryptography
During a cloud security audit, a tool reports that an AWS IAM role has a policy allowing 'ec2:RunInstances' with a condition 'aws:SourceIp': '0.0.0.0/0'. What is the most immediate risk?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An attacker can launch expensive EC2 instances from any IP
The condition allows all IP addresses (0.0.0.0/0) to launch EC2 instances, meaning any user who can assume this role can create instances from anywhere, potentially for cryptocurrency mining or other malicious purposes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
An attacker can delete all EC2 instances
Why it's wrong here
The `ec2:RunInstances` action grants permission solely for initiating the launch of new Amazon EC2 instances. It does not confer any management privileges over existing instances, such as stopping, starting, or terminating them. To delete EC2 instances, an attacker would specifically require the `ec2:TerminateInstances` permission, which is a distinct and separate action not implied by the ability to create new instances.
- ✓
An attacker can launch expensive EC2 instances from any IP
Why this is correct
The `ec2:RunInstances` action, when not constrained by specific `ec2:SourceIp` conditions or other limiting factors, allows an authenticated principal to launch new EC2 instances from any IP address. This capability includes selecting various instance types, potentially very expensive ones, leading to unauthorized resource consumption, significant cost overruns, and resource abuse for the AWS account owner.
- ✗
An attacker can modify VPC security groups
Why it's wrong here
Modifying VPC security groups, such as adding or removing ingress or egress rules, requires specific and distinct IAM permissions like `ec2:AuthorizeSecurityGroupIngress` or `ec2:RevokeSecurityGroupIngress`. The `ec2:RunInstances` action is exclusively for creating new EC2 instances and does not grant any privileges to alter network access controls or security group configurations within a Virtual Private Cloud.
- ✗
An attacker can read data from any S3 bucket
Why it's wrong here
The `ec2:RunInstances` permission is strictly scoped to the Amazon EC2 service and its instance creation capabilities. Accessing data stored within Amazon S3 buckets requires entirely separate and distinct permissions, such as `s3:GetObject` or `s3:ListBucket`, which are managed under the S3 service namespace. There is no inherent cross-service privilege escalation from EC2 instance launch permissions to S3 data access.
Go deeper
Related to this question
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.