If a user has two policies attached: one explicitly allows ec2:StartInstances and another explicitly denies ec2:StartInstances, what is the final effect when the user tries to start an instance?

medium📝 Predict Output Q5 of 15

AWS - Identity and Access Management

If a user has two policies attached: one explicitly allows ec2:StartInstances and another explicitly denies ec2:StartInstances, what is the final effect when the user tries to start an instance?

AThe action is allowed

BThe action is allowed if the user is an administrator

CThe action is allowed only if the deny policy is disabled

DThe action is denied

Step-by-Step Solution

Solution:

Step 1: Identify conflicting policies
One policy allows, another denies the same action.
Step 2: Apply IAM evaluation logic
Explicit Deny overrides any Allow, so the action is denied.
Final Answer:
Action is denied due to explicit deny -> Option D
Quick Check:
Explicit Deny beats Allow [OK]

Quick Trick: Explicit Deny always overrides Allow in IAM evaluation [OK]

Common Mistakes:

MISTAKES

Assuming Allow overrides Deny
Thinking admin status changes deny effect
Ignoring deny policy presence

Master "Identity and Access Management" in AWS

9 interactive learning modes - each teaches the same concept differently

Learn Why Deep Visual Try Challenge Project Recall Time

Want More Practice?

15+ quiz questions · All difficulty levels · Free

Free Signup - Practice All Questions

More AWS Quizzes

If a user has two policies attached: one explicitly allows ec2:StartInstances and another explicitly denies ec2:StartInstances, what is the final effect when the user tries to start an instance?

Step 1: Identify conflicting policies

Step 2: Apply IAM evaluation logic

Final Answer:

Quick Check:

Want More Practice?