DVA-C02 Development with AWS Services Practice Question
A company is using AWS CodePipeline to automate their CI/CD pipeline. The pipeline includes a stage that runs a set of integration tests using AWS CodeBuild. The tests require access to a database running on a private subnet in a VPC. The CodeBuild project is configured to use a managed compute image. How can the CodeBuild project access the database?
⚠ Common exam trap
Many candidates assume a NAT gateway or VPC peering is required to bridge network boundaries, but they overlook that CodeBuild's default environment is isolated from the customer VPC, and the correct solution is to launch the build directly into the customer VPC using a custom VPC configuration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure the CodeBuild project to use a custom VPC with the appropriate subnet and security group.
CodeBuild projects using managed compute images run in an AWS-managed VPC by default, which cannot access resources in a customer VPC. By configuring the CodeBuild project to use a custom VPC with the appropriate subnet and security group, the build environment is launched directly into that VPC, enabling it to reach the database on the private subnet without needing a NAT gateway or internet access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Place the CodeBuild project in a public subnet and use a NAT gateway to route traffic to the private subnet.
Why it's wrong here
Placing the CodeBuild project in a public subnet and attempting to use a NAT Gateway to route traffic to a private subnet is incorrect. A NAT Gateway primarily enables instances in a *private* subnet to initiate *outbound* connections to the internet, not to facilitate *inbound* access from a public subnet to a private resource. For CodeBuild to access a database in a private subnet, it needs to be within the same private network space or have a direct private route, which a NAT Gateway does not provide for this specific communication direction.
- ✓
Configure the CodeBuild project to use a custom VPC with the appropriate subnet and security group.
Why this is correct
Configuring the CodeBuild project to use a custom VPC with the appropriate subnet and security group is the correct solution. This allows CodeBuild to launch its build environments directly within your specified Amazon VPC, enabling it to access private resources like an Amazon RDS database using their private IP addresses. By placing the CodeBuild environment in a private subnet and associating it with a security group that permits outbound traffic to the database's security group, secure and private network communication is established.
- ✗
Set up a VPC peering connection between the CodeBuild VPC and the database VPC.
Why it's wrong here
Setting up a VPC peering connection between a "CodeBuild VPC" and a database VPC is fundamentally flawed because CodeBuild does not inherently operate within its own dedicated VPC that can be peered. When CodeBuild is configured for VPC access, it integrates into *your existing* customer-managed VPC, rather than having a separate, distinct VPC of its own. Therefore, the premise of peering a non-existent "CodeBuild VPC" with another VPC is invalid for establishing connectivity to a private database.
- ✗
Create a VPC endpoint for the database service and attach it to the CodeBuild project.
Why it's wrong here
Creating a VPC endpoint for a database service and attaching it to the CodeBuild project is an incorrect approach. VPC endpoints are designed to provide private connectivity to *AWS services* (like S3, DynamoDB, or EC2 APIs) or to *VPC endpoint services* created by other AWS accounts, not directly to an Amazon RDS database instance running within your own VPC. RDS instances are customer-managed resources within your VPC, and access is controlled via subnets, routing tables, and security groups, not through VPC endpoints.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 724 original DVA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.