DOP-C02 SDLC Automation Practice Question
Exhibit
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"codecommit:GitPull",
"codecommit:GitPush"
],
"Resource": "arn:aws:codecommit:us-east-1:123456789012:MyRepo"
},
{
"Effect": "Deny",
"Action": "codecommit:GitPush",
"Resource": "arn:aws:codecommit:us-east-1:123456789012:MyRepo",
"Condition": {
"StringNotEquals": {
"codecommit:References": [
"refs/heads/main"
]
}
}
}
]
}Refer to the exhibit. An IAM policy is attached to a user. The user tries to push a commit to the 'develop' branch of 'MyRepo' using Git. What is the outcome?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The push is denied because the user is not pushing to the 'main' branch.
The policy allows GitPull and GitPush on the repo, but denies GitPush when the reference is not 'refs/heads/main'. Since the user is pushing to 'develop', the condition is met, and the Deny applies. An explicit Deny overrides any Allow, so the push is denied.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The push is denied only if the user is pushing to the 'main' branch.
Why it's wrong here
This option inverts the branch logic. In the IAM policy, the Deny statement uses a condition key such as `codecommit:References` with a `StringNotEquals` operator, meaning it denies GitPush whenever the target branch reference is *not* `refs/heads/main`. Therefore, a push to the `main` branch would *not* match the Deny condition and would be permitted, not denied. This answer is wrong because it claims the Deny applies only to pushes to `main`, which is exactly the opposite of the policy's condition.
- ✗
The push succeeds because the Allow statement grants GitPush.
Why it's wrong here
This option overlooks IAM's evaluation precedence. While the Allow statement explicitly grants `GitPush`, IAM policy evaluation treats an explicit Deny as an absolute override — if any applicable Deny matches the request, the request is denied regardless of matching Allow statements. The Deny here is conditional: it matches when the push is to a branch other than `main`, so a push to `develop` is denied even though the Allow exists. Thus, the push does not succeed.
- ✓
The push is denied because the user is not pushing to the 'main' branch.
Why this is correct
This is correct because the Deny statement is scoped to any branch reference that is not `main`. When the user pushes to a branch like `develop`, the condition `StringNotEquals` on `codecommit:References` evaluates to true, causing an explicit Deny that blocks the `GitPush` action. Under IAM's evaluation logic, an explicit Deny overrides the earlier Allow, so the push is denied. A push to `main` would not trigger the Deny and would be allowed, confirming the condition is the decisive factor.
- ✗
The push is denied because the Deny statement blocks all GitPush actions.
Why it's wrong here
This option mischaracterizes the Deny's scope. The Deny statement is not unconditional; it includes a condition that restricts the denial to cases where the branch reference is not `main`. For example, if the condition uses `StringNotEquals` on `codecommit:References`, then pushing to `main` would not match and the Deny would not apply. Therefore, the Deny does *not* block all GitPush actions — it only blocks pushes to non-main branches, so saying it blocks all is inaccurate.
Go deeper
Related to this question
About these practice questions
One of 1,013 original DOP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DOP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Refer to the exhibit. An IAM policy is attached to a user. The user reports that they cannot push to the 'MyRepo' repository. What is the likely reason?
medium- ✓ A.The policy does not allow GitPush on the repository's branches.
- B.The user is not in the correct IAM group.
- C.The user does not have GitPull permission on the repository.
- D.The policy must include codecommit:CreateRepository action.
Why A: The IAM policy shown in the exhibit likely includes a condition or resource restriction that limits the `codecommit:GitPush` action to specific branches, or the policy is missing the `codecommit:GitPush` action entirely. Without explicit permission to push to the repository's branches, the user will receive an access denied error when attempting to push changes. AWS CodeCommit uses IAM policies to control Git operations, and `GitPush` must be allowed on the repository ARN (e.g., `arn:aws:codecommit:region:account:MyRepo`) and optionally on specific branch references using conditions.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.