Is there a method in the IAM system to allow or deny access to a specific instance?

A.
Only for VPC based instances

B.
Yes

C.
No

Explanation:
Amazon EC2 uses SSH keys, Windows passwords, and security groups to control who has access to the
operating system of specific Amazon EC2 instances. There’s no method in the IAM system to allow or deny
access to the operating system of a specific instance.
http://docs.aws.amazon.com/IAM/latest/UserGuide/IAM_UseCases.html