DOP-C02 SDLC Automation Practice Question
Exhibit
Refer to the exhibit.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"codebuild:StartBuild",
"codebuild:BatchGetBuilds"
],
"Resource": "arn:aws:codebuild:us-east-1:123456789012:project/MyProject"
}
]
}Refer to the exhibit. The above IAM policy is attached to an IAM role used by a CI/CD pipeline. Which action is this policy allowing?
⚠ Common exam trap
The trap here is that candidates see `codebuild:StartBuild` and `codebuild:BatchGetBuilds` and assume they apply to all projects, overlooking the resource ARN restriction that limits the policy to a single project.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Start and view builds for the specified CodeBuild project.
The IAM policy grants `codebuild:StartBuild` and `codebuild:BatchGetBuilds` actions, which allow starting a build and viewing build details respectively. The `Resource` element restricts these permissions to the specific CodeBuild project `arn:aws:codebuild:us-east-1:123456789012:project/my-project`. Therefore, the policy allows starting and viewing builds for that single project, not any project in the account.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Start builds for any CodeBuild project in the account.
Why it's wrong here
Because the policy's Resource element is scoped to a single CodeBuild project ARN, the StartBuild action can only be invoked against that exact project. Granting the ability to start any project in the account would require a wildcard resource such as "arn:aws:codebuild:*:*:project/*" or an explicit list of project ARNs. The statement correctly grants StartBuild, but its resource constraint contradicts the "any project" claim.
- ✗
View details of any build in the account.
Why it's wrong here
The BatchGetBuilds action is similarly confined by the same single-project Resource ARN, so you can retrieve build details only for builds belonging to that specified project. Viewing details of any build in the account would demand either a Resource of "*" or a policy with all project ARNs (or a resource-based policy on each project). Because the current policy does not include any other project, the statement's claim is too broad.
- ✓
Start and view builds for the specified CodeBuild project.
Why this is correct
This is exactly what the policy authorizes: it includes the StartBuild action to begin a build and BatchGetBuilds to retrieve detailed information about those builds, with the Resource set to the specific CodeBuild project ARN shown in the exhibit. The policy therefore grants the minimum permissions needed to start and observe builds for only that one project.
- ✗
Create and manage CodeBuild projects.
Why it's wrong here
The policy only contains StartBuild and BatchGetBuilds actions; it does not include CreateProject, UpdateProject, DeleteProject, or any other CodeBuild control-plane actions required to create and manage projects. Therefore, the policy grants only operational build execution and read-only build history access, not project lifecycle management. This is correctly marked wrong.
Go deeper
Related to this question
About these practice questions
One of 1,013 original DOP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.