DOP-C02 SDLC Automation Practice Question
Exhibit
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "codepipeline:StartPipelineExecution",
"Resource": "arn:aws:codepipeline:us-east-1:123456789012:MyPipeline"
},
{
"Effect": "Deny",
"Action": "codepipeline:*",
"Resource": "*",
"Condition": {
"StringNotEquals": {
"aws:SourceAccount": "123456789012"
}
}
}
]
}Refer to the exhibit. An IAM policy is attached to a role used by a CI/CD system. The policy is intended to allow starting the pipeline 'MyPipeline' from the same account. However, the CI/CD system receives an 'AccessDenied' error when trying to start the pipeline. What is the problem?
⚠ Common exam trap
The trap here is that candidates overlook the explicit Deny statement with a condition key, assuming the Allow statement alone is sufficient, and instead focus on missing permissions or incorrect ARNs, not realizing that an explicit Deny with an unsatisfied condition will block access regardless of any Allow.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The Deny statement with the 'aws:SourceAccount' condition denies access if the condition key is not present in the request.
The Deny statement with the `aws:SourceAccount` condition key denies access unless the request includes that condition key. When the CI/CD system assumes the role and makes a `StartPipelineExecution` API call, the request context does not automatically include the `aws:SourceAccount` key unless explicitly added by the caller. Since the condition is not satisfied, the Deny statement applies, resulting in an 'AccessDenied' error even though the Allow statement grants the necessary action.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The Allow statement does not specify the correct pipeline ARN.
Why it's wrong here
The pipeline ARN is correctly specified, so an ARN mismatch is not the cause. Even if the ARN were wrong, the resulting error would indicate a resource not found or not authorized for that specific resource, not the blanket AccessDenied produced by an explicit Deny. Thus, this explanation incorrectly identifies the Allow statement's resource field as the problem.
- ✗
The policy needs an additional Allow for 'codepipeline:GetPipeline' to start the pipeline.
Why it's wrong here
Starting a pipeline execution requires only the codepipeline:StartPipelineExecution action on the pipeline resource; no additional read permission such as GetPipeline is necessary. The Allow statement already grants the required action, so adding GetPipeline would neither satisfy the missing permission nor override the explicit Deny statement. Therefore, this is not the reason for AccessDenied.
- ✗
The role does not have permission to pass the policy to the CI/CD system.
Why it's wrong here
The policy is directly attached to the role that the CI/CD system assumes, so there is no 'passing' of the policy to another service. The PassRole permission (iam:PassRole) is only relevant when one service needs to assign a role to another service, which is not happening here. The failure arises from the Deny statement in the same policy, not from any pass-role authorization.
- ✓
The Deny statement with the 'aws:SourceAccount' condition denies access if the condition key is not present in the request.
Why this is correct
This Deny statement uses a condition key such as aws:SourceAccount with an operator like StringNotEquals, which evaluates as true when the key is missing from the request context. Because an explicit Deny overrides all Allow statements, the request is denied whenever the expected source account is not present in the request. This is the precise cause of the AccessDenied error.
Go deeper
Related to this question
About these practice questions
One of 1,013 original DOP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.