Question 535 of 256
DOP-C02 SDLC Automation Practice Question
A development team uses AWS CodeCommit as a source control repository. A developer accidentally pushed a commit that contains sensitive information (e.g., AWS access keys) to the main branch. The team wants to remove the sensitive data from the repository history completely. Which action should the engineer take?
⚠ Common exam trap
It's easy for candidates to confuse 'git revert' (which adds a new commit but leaves the sensitive data in history) with 'git filter-branch' (which actually rewrites history to remove the data), leading them to choose a non-destructive but ineffective option.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use 'git filter-branch' to rewrite the repository history and remove the sensitive file
'git filter-branch' (or the modern 'git filter-repo') rewrites the repository history by removing or replacing the sensitive file in every commit, effectively purging it from the entire Git history. This is the only native Git method that completely eliminates the sensitive data from all past commits, preventing anyone from retrieving it via 'git log' or by cloning the repository. After rewriting history, a force push to the remote CodeCommit repository is required to overwrite the remote branches.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use 'git filter-branch' to rewrite the repository history and remove the sensitive file
Why this is correct
git filter-branch rewrites every commit in the repository's DAG, eliminating the sensitive blob from historical snapshots and changing commit SHAs. Once the rewritten history is force-pushed to CodeCommit, the file is unreachable via any prior commit, but all branch tips must be updated and team members must re-clone or rebase to avoid propagating the old history. This is the standard, targeted purging technique for leaked credentials.
- ✗
Delete the repository and create a new one, then force push the remaining branches
Why it's wrong here
Deleting the repository and creating a fresh one destroys all commit history, branches, tags, pull requests, and CodeCommit's CI/CD references, forcing a total rebuild of project context. It also requires every developer to re-clone and reconfigure remotes, while a simple filter-branch preserves all non-sensitive history. This is overkill and incurs massive operational disruption compared to a history rewrite.
- ✗
Use 'git revert' to create a new commit that undoes the changes
Why it's wrong here
git revert creates a new commit that reverses the file's content in the working tree, but it does not alter or remove the original commit where the sensitive data was introduced. The secret remains fully accessible via `git log`, `git show <commit>`, and by checking out any ancestor commit. For credentials, only rewriting history to delete the blob is sufficient.
- ✗
Create a new branch from the commit before the sensitive data was added and merge it to main
Why it's wrong here
Creating a new branch from an earlier commit and merging it into main produces a merge commit, but the original commit containing the sensitive file stays in main's ancestry and remains reachable through the merge base. Git's immutable commit graph means the file blob is still in the repository object store and can be extracted with `git cat-file` or by browsing historical commits. This approach does nothing to purge the compromised data.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 24, 2026
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.