DVA-C02 Deployment Practice Question
A developer is using AWS CodeDeploy to deploy a new version of a web application to an Auto Scaling group of Amazon EC2 instances. The deployment must install dependencies and run a script to start the application after the new revision is copied to the instance. The developer has created an appspec.yml file with the necessary hooks. Which of the following must the developer ensure to allow CodeDeploy to execute the scripts on the instances?
⚠ Common exam trap
The trap here is assuming that CodeDeploy uses SSH or Systems Manager to execute scripts, when it actually relies on an agent installed on the instances.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The CodeDeploy agent must be installed and running on the instances, and the instances must have an IAM instance profile that allows them to access the CodeDeploy service.
For CodeDeploy to deploy to EC2 instances, the CodeDeploy agent must be installed and running on each instance. The instances also need an IAM instance profile that grants permissions to communicate with CodeDeploy and retrieve deployment artifacts. This setup allows CodeDeploy to orchestrate the deployment and run lifecycle hooks defined in appspec.yml.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The developer must store the application revision in an Amazon S3 bucket and grant the EC2 instances direct read access to that bucket so they can download and execute the scripts.
Why it's wrong here
While CodeDeploy stores revisions in S3 or GitHub, EC2 instances do not need direct access to the S3 bucket. The CodeDeploy agent retrieves the revision through the CodeDeploy service using the instance profile permissions, simplifying access management and avoiding direct S3 permissions on instances.
- ✗
The instances must be associated with a security group that allows inbound traffic on port 22 from the CodeDeploy service IP range so that CodeDeploy can SSH into the instances and run the scripts.
Why it's wrong here
CodeDeploy does not use SSH to connect to instances. It communicates with the CodeDeploy agent through outbound HTTPS connections initiated by the agent. Opening inbound SSH access is unnecessary and would introduce a security risk without enabling CodeDeploy functionality.
- ✓
The CodeDeploy agent must be installed and running on the instances, and the instances must have an IAM instance profile that allows them to access the CodeDeploy service.
Why this is correct
The CodeDeploy agent is required on each EC2 instance to receive deployment commands, copy the revision, and run lifecycle event hooks. The instance profile grants permissions to communicate with CodeDeploy and retrieve deployment artifacts, which is essential for successful deployments in an Auto Scaling group.
- ✗
The developer must attach an IAM role to the CodeDeploy service role that allows it to execute scripts on the instances via AWS Systems Manager Run Command.
Why it's wrong here
CodeDeploy does not use Systems Manager Run Command to execute scripts on instances; it relies on the CodeDeploy agent installed on each instance. The service role is used by CodeDeploy to interact with other AWS services, not to directly run scripts on instances.
Go deeper
Related to this question
About these practice questions
Courseiva writes every DVA-C02 question from scratch — 1,135 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.