DOP-C02 SDLC Automation Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  The IAM role for CodeBuild does not have permission to read from the repository.

  Why it's wrong here

  A CodeBuild project's IAM service role controls access to AWS resources such as S3, ECR, and CodeCommit, but for GitHub and GitHub Enterprise sources, authentication is handled by an OAuth token or GitHub App credentials, not the IAM role. Even if the role lacked permissions for the source, the failure would occur in the DOWNLOAD_SOURCE phase with an access-denied error before any git refs are fetched. A git-fetch failure specifically points to the repository/ref resolution logic, not to IAM authorization.

• ✗

  The buildspec file is not present in the source code.

  Why it's wrong here

  A missing buildspec file prevents the build from entering the command-execution phases; CodeBuild reports a BUILD_SPEC_NOT_FOUND or invalid buildspec error during the DOWNLOAD_SOURCE phase, after source is retrieved but before parsing the refs. Because the failure in this scenario occurs during git fetch, the source has already been discovered and CodeBuild is attempting to resolve the pull request's head or merge ref. Thus the absence of a buildspec is not the cause of this fetch-stage error.

• ✓

  The CodeBuild project is not configured to allow pull requests from forked repositories.

  Why this is correct

  CodeBuild intentionally does not build pull requests from forked repositories unless you explicitly enable the 'Allow pull requests from forked repositories' setting in the project's webhook configuration. Fork PRs are considered untrusted because the entire buildspec, including install commands and environment variable injection, is controlled by the fork author—so CodeBuild requires an opt-in before it will fetch refs such as refs/pull/123/head or refs/pull/123/merge from a fork. When this setting is off, the source client cannot complete the git fetch for the fork PR, producing exactly the kind of git error being troubleshooted.

• ✗

  The buildspec contains invalid syntax.

  Why it's wrong here

  If the buildspec contained invalid YAML or JSON syntax, the error would surface after CodeBuild downloads the source and attempts to parse the buildspec—typically as a CLIENT_ERROR with a message like 'Invalid buildspec file' and a line/column reference. Those parsing errors occur in the DOWNLOAD_SOURCE or BUILD phase, not while running git fetch. Because the failure described is during git fetch, CodeBuild has not yet reached the buildspec evaluation stage, so invalid syntax cannot be the cause.

Go deeper

Related to this question