DOP-C02 SDLC Automation Practice Question
Network Topology
Refer to the exhibit. A DevOps engineer runs the above commands. The build project 'my-project' uses an S3 bucket as source and another S3 bucket for artifacts. The build fails with an 'Access Denied' error when trying to download the source code. What is the most likely cause?
⚠ Common exam trap
Many candidates confuse 'Access Denied' with other S3 errors like 'NoSuchKey' or 'BucketNotFound', or incorrectly attribute the error to KMS encryption when the error message does not reference it.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The service role does not have s3:GetObject permission on the source bucket
The build project 'my-project' uses an S3 bucket as the source. When CodeBuild downloads source code from S3, the service role must have the s3:GetObject permission on the source bucket. The 'Access Denied' error indicates that the role lacks this permission, making option B the most likely cause.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The encryption key is a KMS key that the role cannot access
Why it's wrong here
The encryption key being a KMS key that the role cannot access is not the cause because the exhibit shows the default S3 encryption key (SSE-S3), not a customer-managed KMS key. SSE-S3 uses an AWS-managed key, so no kms:Decrypt permission is required in the service role. Even if a KMS key were used, CodePipeline would need kms:Decrypt permission, but the error message about missing s3:GetObject is a different, more fundamental issue.
- ✓
The service role does not have s3:GetObject permission on the source bucket
Why this is correct
The service role is the IAM role that CodePipeline assumes to perform actions on your behalf. To pull source artifacts from S3, the role must have an IAM policy allowing s3:GetObject (and typically s3:ListBucket) on the specified bucket and prefix. The error indicates the pipeline cannot download the object, which is a direct consequence of the role lacking this permission. Adding a policy statement with s3:GetObject on the source bucket ARN will resolve the stage failure.
- ✗
The source type is S3, but the project expects CodeCommit
Why it's wrong here
Source type is not the problem; the pipeline is explicitly configured with S3 as the source provider, and Amazon S3 is a supported source type in CodePipeline. The term 'project' likely refers to the CodeBuild project or pipeline, which does not have an inherent expectation of CodeCommit. Since the source configuration matches the S3 bucket specified, this option misidentifies the cause and does not align with the actual error.
- ✗
The source location is incorrect
Why it's wrong here
The source location is not incorrect because the error message and exhibit indicate the bucket and object key are properly formatted and the location exists. CodePipeline would not proceed to an IAM-related error if the bucket or key were invalid; it would fail with a 'bucket does not exist' or 'object not found' message. Thus, the problem is not a typo or wrong path, but a permissions gap on the service role.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 251 original DOP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.