DOP-C02 Security and Compliance Practice Question
A company uses AWS CodePipeline to deploy applications to AWS Lambda. The pipeline's source stage is connected to an AWS CodeCommit repository. The security team requires that all code changes are reviewed and approved by at least one team member before deployment. The team wants to automate the approval process as much as possible. Which solution should a DevOps engineer implement?
⚠ Common exam trap
Watch out — candidates often confuse branch protection with approval requirements; branch protection alone prevents direct pushes but does not mandate peer review, so it fails to enforce the approval requirement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use AWS CodeCommit approval rule templates to require at least one approval before code can be merged to the main branch.
AWS CodeCommit approval rule templates allow you to define approval requirements for pull requests, such as a minimum number of approvals. By applying a template to the main branch, merges are blocked until the required approvals are met. This automates enforcement of code review before deployment, while the pipeline can still deploy automatically after merge.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use AWS CodeCommit approval rule templates to require at least one approval before code can be merged to the main branch.
Why this is correct
CodeCommit approval rule templates can enforce a minimum number of approvals on pull requests for specified branches. This ensures code review before merge. Once merged, the pipeline can deploy automatically, meeting the automation goal. It integrates with CodeCommit and is the correct solution.
- ✗
Enable strict branch protection in CodeCommit to prevent direct pushes to the main branch.
Why it's wrong here
Strict branch protection prevents direct pushes but does not require approvals. It only forces changes through pull requests. Without an approval rule, a pull request can be merged without review. This does not meet the requirement for at least one approval.
- ✗
Configure an approval action in CodePipeline after the source stage that requires manual approval.
Why it's wrong here
A manual approval action pauses the pipeline until a user approves, but it does not enforce code review in CodeCommit. It also adds manual effort, which contradicts the goal of automating as much as possible. The requirement is for code review, not just a deployment gate.
- ✗
Add a Lambda function in the pipeline that checks for code review status via the CodeCommit API and fails the pipeline if not approved.
Why it's wrong here
While custom Lambda checks can enforce approvals, they require development and maintenance. CodeCommit approval rule templates provide a native, automated way to enforce approvals without custom code. This option is more complex and less efficient than using built-in features.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
One of 1,298 original DOP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.