A company has attached the following policy to an IAM user:{ " Version " :...

The explicit Deny statement uses NotAction, which means it denies all actions except ec2:* and s3:GetObject. Explicit deny overrides any allow. Therefore, even though rds:Describe* is allowed in the first statement, it is denied by the Deny statement because RDS actions are not excluded from the deny. s3:PutObject is also denied because only s3:GetObject is excluded. EC2 actions are excluded from the deny, but they still need an applicable Allow. The second statement allows ec2:* only when the EC2 Region condition equals us-east-1. Therefore, ec2:DescribeInstances in us-east-1 is allowed, while ec2:AttachNetworkInterface in eu-west-1 is not allowed. Option C is the only permitted action.

===============