DOP-C02 SDLC Automation Practice Question
A company uses AWS CodePipeline to deploy a serverless application using AWS SAM. The pipeline has a source stage from CodeCommit, a build stage that runs 'sam build', and a deploy stage that runs 'sam deploy --no-confirm-changeset'. The deploy stage fails with the error 'The security token included in the request is invalid.' What is the MOST likely cause?
⚠ Common exam trap
A common mix-up: candidates confuse credential expiration with permission errors or misattribute the error to the source repository (CodeCommit) or template syntax, rather than recognizing that the 'sam deploy' command makes CloudFormation API calls using the CodeBuild service role's temporary credentials.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The IAM role used by CodeBuild has expired credentials or insufficient permissions to call AWS CloudFormation.
The error 'The security token included in the request is invalid' indicates that the AWS credentials used by CodeBuild to call the CloudFormation API are either expired or lack the necessary permissions. In a CodePipeline with a CodeBuild action, the build project assumes an IAM role to perform actions such as 'sam deploy', which internally calls CloudFormation. If that IAM role's temporary credentials have expired (e.g., due to a long-running build) or the role does not have the required CloudFormation permissions (e.g., cloudformation:CreateChangeSet, cloudformation:ExecuteChangeSet), the API call will fail with this exact error.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The CloudFormation stack is in a 'ROLLBACK_COMPLETE' state and cannot be updated.
Why it's wrong here
A CloudFormation stack in ROLLBACK_COMPLETE state has failed during creation and was rolled back; attempting to update it triggers a stack status error such as 'Stack is in ROLLBACK_COMPLETE state and cannot be updated,' which is an entirely different error class from the reported 'security token invalid' ExpiredTokenException. The deploy action would fail before calling CloudFormation APIs with credentials, or would receive a ValidationError about stack state, not an authentication error. Therefore this option does not explain the observed symptom.
- ✗
The CodeBuild project does not have access to the CodeCommit repository.
Why it's wrong here
CodeBuild's access to the CodeCommit repository is established during the source phase through the source provider and build project configuration; if the build role lacked repository permissions, the failure would occur as a 'Source' stage error or a 'Host key not verified' / 'Unable to access repository' error during the Build stage. The deploy stage no longer fetches code from CodeCommit—it runs the SAM package and calls CloudFormation using the build project's service role. Since the error occurs specifically in the deploy stage as an AWS API token error, this option is incorrect.
- ✓
The IAM role used by CodeBuild has expired credentials or insufficient permissions to call AWS CloudFormation.
Why this is correct
In a serverless CodePipeline, the CodeBuild project executes `sam deploy` and uses its IAM service role to make CloudFormation API calls; if that role's temporary STS credentials have expired or its policies lack `cloudformation:CreateChangeSet`, `cloudformation:ExecuteChangeSet`, or `cloudformation:DescribeStacks`, CloudFormation returns an ExpiredTokenException or AccessDenied error with 'security token invalid' in the message. CodeBuild projects receive short-lived credentials for the build session, and if the build exceeds the role session duration or the role was modified mid-deploy, these credential failures surface in the deploy stage. This precisely matches the reported symptom.
- ✗
The SAM template is invalid and contains syntax errors.
Why it's wrong here
A syntactically invalid SAM template would cause a template validation failure from CloudFormation or an error during the `sam build`/`sam package` step, such as 'Template format error: YAML not well-formed' or 'Transform AWS::Serverless-2016-10-31 failed.' Such validation errors occur at the point the template is parsed—long before any CloudFormation API call is made—and they would not produce a 'security token invalid' ExpiredTokenException. Therefore this option cannot explain the deploy-stage token error.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DOP-C02 question from scratch — 1,487 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.