DOP-C02 SDLC Automation Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Create an IAM policy that denies git push actions unless the commit is signed.

  Why this is correct

  AWS CodeCommit integrates with IAM to evaluate policies at the time of a `git push`. By creating an IAM policy that uses the `codecommit:GitPush` action with a condition key `codecommit:IsSigned` set to `true`, you can deny pushes that are not signed. This enforces GPG signature verification at the IAM authorization layer, blocking unsigned commits before they reach the repository.

• ✗

  Use the AWS CLI to verify commit signatures and reject pushes.

  Why it's wrong here

  The AWS CLI is a client-side tool; it can inspect local commits and even verify GPG signatures, but it has no mechanism to intercept or block an incoming `git push` to CodeCommit. A push is authorized by CodeCommit's own service, not the CLI, so any CLI-based signature check would be manual and would not prevent unsigned commits from being accepted. CodeCommit lacks server-side hooks that could call the CLI for validation, making this option unenforceable.

• ✗

  Enable CloudWatch Logs to monitor commits and trigger a Lambda to rollback.

  Why it's wrong here

  CloudWatch Logs and Lambda operate after the fact; they can react to an already-accepted push by rolling back or alerting, but they cannot enforce the repository's signature policy at the moment of push. A Lambda rollback requires a `git revert` or force-push to rewrite history, which can cause conflicts and is disruptive, and it still leaves a window where unsigned commits exist. The requirement is to deny unsigned pushes before they land, which only IAM authorization can do.

• ✗

  Configure a pre-receive hook in CodeCommit to reject unsigned commits.

  Why it's wrong here

  CodeCommit does not support pre-receive hooks, unlike self-managed Git servers (e.g., GitLab) or GitHub Enterprise. A pre-receive hook script could reject unsigned commits on those platforms, but CodeCommit offers no hook endpoint where a custom validation script can run. The native and only supported way to gate pushes based on commit signatures is an IAM condition key such as `codecommit:IsSigned`.

Go deeper

Related to this question