DOP-C02 SDLC Automation Practice Question
Exhibit
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"codepipeline:StartPipelineExecution",
"codepipeline:GetPipeline"
],
"Resource": "arn:aws:codepipeline:us-east-1:123456789012:MyPipeline"
}
]
}Refer to the exhibit. An IAM policy is attached to a user who needs to start a CodePipeline pipeline and view its details. The user reports that they cannot see the pipeline in the AWS Management Console. What is the MOST likely reason?
⚠ Common exam trap
The trap here is that candidates focus on the explicit actions granted (StartPipelineExecution, GetPipeline) and assume they are sufficient, overlooking that the console requires the `ListPipelines` action as a prerequisite for displaying pipelines in the UI.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The policy does not include the codepipeline:ListPipelines action, which is needed to view pipelines in the console.
The AWS Management Console requires the `codepipeline:ListPipelines` action to populate the pipeline list view. Without this permission, the console cannot display any pipelines, even if the user has permissions for specific pipeline actions like `StartPipelineExecution` or `GetPipeline`. The attached policy grants `codepipeline:StartPipelineExecution` and `codepipeline:GetPipeline`, but omits `ListPipelines`, which is why the user sees an empty pipeline list.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
There is an explicit deny statement elsewhere that is overriding the allow.
Why it's wrong here
An explicit deny statement in IAM would override any allow and result in a denied action. However, the scenario provides no evidence of an explicit deny being attached via a user, group, role, or resource-based policy. In the absence of an explicit deny, the default evaluation result is an implicit deny, but the specific allow for StartPipelineExecution would still apply. The console issue is caused by a missing ListPipelines permission, not by a deny overriding the allow.
- ✗
The user does not have permission to start the pipeline execution.
Why it's wrong here
The user does have permission to start the pipeline execution because the policy explicitly includes the codepipeline:StartPipelineExecution action on the pipeline ARN. The reported problem is that the pipeline is not visible in the console, which is a listing and read-display problem, not an execution problem. Even with StartPipelineExecution allowed, the console cannot enumerate pipelines unless the ListPipelines action is also present. Therefore, this option incorrectly conflates execution permissions with console list/view permissions.
- ✗
The pipeline ARN is incorrect.
Why it's wrong here
The pipeline ARN in the policy appears correct: it matches the pattern arn:aws:codepipeline:<region>:<account-id>:<pipeline-name>, and no mismatch is indicated in the exhibit. If the ARN were incorrect, StartPipelineExecution would fail when called, but the console listing failure occurs before any specific resource is targeted because the ListPipelines API is required to show the list. Also, ListPipelines is a list operation that does not require a resource ARN, so an ARN issue would not explain the absence of the pipeline in the console.
- ✓
The policy does not include the codepipeline:ListPipelines action, which is needed to view pipelines in the console.
Why this is correct
The AWS CodePipeline console calls the ListPipelines API to populate the pipeline list. The attached policy, as shown, grants only StartPipelineExecution on a specific pipeline and lacks codepipeline:ListPipelines, which is a required permission for the console to display any pipelines. Without ListPipelines, the user sees an empty console even though they can trigger executions via the API or CLI. To fix this, an additional allow statement for codepipeline:ListPipelines on the `*` resource is necessary (the ListPipelines action does not support resource-level permissions).
Go deeper
Related to this question
About these practice questions
Courseiva writes every DOP-C02 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DOP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An IAM policy is attached to a user who needs to manually start a CodePipeline execution. The pipeline uses an S3 bucket named 'my-artifact-bucket' for artifacts. The user reports that they cannot start the pipeline. Which action is missing from the policy?
medium- A.iam:PassRole
- ✓ B.codepipeline:ListPipelines
- C.codepipeline:GetPipelineExecution
- D.s3:PutObject
Why B: The user needs to manually start a CodePipeline execution, which requires the `codepipeline:StartPipelineExecution` action. However, the question asks which action is missing from the policy, and the correct answer is `codepipeline:ListPipelines` because the user cannot even see the pipeline to start it. Without `codepipeline:ListPipelines`, the AWS Management Console or CLI will not return the pipeline in the list, preventing the user from selecting it to start execution. The other actions are either not directly required for starting a pipeline or are unrelated to the permission needed to list pipelines.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.