ExamPark
Course menuSOA-C03

Exams / SOA-C03 / Auditing and troubleshooting access / Question 1

SOA-C03 practice question: Auditing and troubleshooting access (1 of 2)

Security and Compliance A free question from our original SOA-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.

At a ski resort, developers use an IAM role named dev-ops whose identity-based policy allows ec2:* on all resources. The role also has a permissions boundary that allows s3:*, logs:* and cloudwatch:*. The account is in an organizational unit whose SCPs allow all actions. When a developer calls ec2:RunInstances, the request fails with an AccessDenied error. What is the cause, and how should it be fixed?

Choose one answer.

  1. A. The SCP denies EC2 implicitly because it allows all actions, so the SCP must list ec2:RunInstances explicitly.
  2. B. The identity-based policy needs a resource-level ARN for each subnet and AMI, because ec2:* on all resources is not supported.
  3. C. The role's trust policy does not allow the developers to call EC2, so the trust policy must add ec2.amazonaws.com as a principal.
  4. D. The permissions boundary does not allow EC2 actions, so the effective permissions exclude them; the boundary must be updated to allow the needed EC2 actions.
Show the answer and explanation

Answer: D

Explanation

When a request is denied despite an Allow, check every policy type in the evaluation chain: SCPs, permissions boundaries, identity policies and session policies. A permissions boundary caps the role's permissions, so an action must be allowed by both the boundary and the identity policy. The IAM policy simulator can show which policy blocks the call.

Study

Keep practicing

Answer questions with a score at the end, or practice just this topic with the explanation after each one. No sign-up needed.

Take the free SOA-C03 practice examPractice Auditing and troubleshooting accessAll Auditing and troubleshooting access questions