DOP-C02 Configuration Management and IaC Practice Question
A company uses AWS CodeCommit to store its infrastructure as code templates. The DevOps team wants to automatically validate CloudFormation templates before merging changes to the main branch. Which service should be used to implement this validation?
⚠ Common exam trap
Test-takers frequently confuse CodePipeline's orchestration capabilities with the need for a simple pre-merge validation, overlooking that CodeBuild can be directly triggered by CodeCommit pull request events without a full pipeline.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS CodeBuild
AWS CodeBuild is the correct service because it can be configured as a pre-merge check in a pull request workflow. By integrating CodeBuild with CodeCommit, the DevOps team can automatically run a build project that validates CloudFormation templates (e.g., using `aws cloudformation validate-template` or `cfn-lint`) before the merge is allowed. This provides a serverless, automated validation step without requiring a full pipeline or deployment.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
AWS CodeBuild
Why this is correct
AWS CodeBuild is a fully managed continuous integration service that can execute arbitrary build and validation commands. In the context of CodeCommit, you can attach an approval rule to a pull request that invokes a CodeBuild project, so that the pull request is not mergable until the validation (e.g., running cfn-lint, terraform validate, or a shell script that checks CloudFormation templates) completes successfully and the build status is reported back to the pull request. This makes CodeBuild the correct service for automatically validating infrastructure-as-code changes as part of the pull request workflow.
- ✗
AWS CodeDeploy
Why it's wrong here
AWS CodeDeploy is designed to automate application deployments to Amazon EC2, AWS Lambda, or on-premises instances, using an AppSpec file to describe the deployment actions. It does not perform static analysis, syntax checking, or policy validation on infrastructure-as-code templates; its job is to push working software to targets, not to gate a pull request. Attempting to use CodeDeploy for template validation would be a misuse because it lacks the build environment and script execution capabilities needed for such checks.
- ✗
AWS CodePipeline
Why it's wrong here
AWS CodePipeline is a continuous delivery orchestration service that models release pipelines with stages for build, test, and deploy, but it does not natively integrate with CodeCommit pull request approval rules. While you could configure CodePipeline to react to CodeCommit branches or tags, it does not offer built-in pull request validation hooks; only CodeBuild (or a Lambda function) can be directly invoked by a CodeCommit approval rule. Adding a CodePipeline action to validate a template would require building and testing after a merge, not before, so it doesn't satisfy the requirement of gatekeeping the pull request.
- ✗
AWS CodeStar
Why it's wrong here
AWS CodeStar is a project management and collaboration layer for AWS development projects, providing a unified dashboard for tracking issues, team members, and the underlying DevOps toolchain (CodeCommit, CodeBuild, CodePipeline). It does not contain any logic to execute validation scripts or inspect infrastructure-as-code templates; it is simply a front-end portal and project metadata service. Therefore, CodeStar cannot be used as a technical validation tool for pull requests.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
This DOP-C02 question is part of Courseiva's 1,298-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.