DOP-C02 SDLC Automation Practice Question
A DevOps engineer is designing a CI/CD pipeline that must enforce a policy: any change to the production branch in CodeCommit must be reviewed and approved by two senior developers before the change can be merged. The pipeline must also automatically build and deploy to a staging environment after approval. Which combination of AWS services and configurations should be used?
⚠ Common exam trap
A common mix-up: candidates confuse post-commit checks (like CodeBuild or EventBridge) with pre-merge enforcement, not realizing that only pull request approval rules can block a merge before it happens.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use CodeCommit pull request approval rules and a CodePipeline with a manual approval step triggered by a Lambda function that checks approval status
CodeCommit pull request approval rules enforce the requirement for two senior developers to approve changes before merging, and CodePipeline with a manual approval step can be configured to trigger a Lambda function that checks the approval status before proceeding to build and deploy to staging. This combination directly satisfies the policy of requiring two approvals and automating the build/deploy after approval.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure CodeBuild to run a script that checks the commit author and rejects if not approved
Why it's wrong here
A CodeBuild script that inspects the commit author can only identify who authored the commit, not whether that commit has received any peer-review approvals from the pull request workflow. Further, CodeBuild executes after the commit has already been pushed to the repository, so it cannot preemptively block the merge. Because the CI build runs after the fact, it only provides a post-commit guard that can fail the build but does not enforce the CodeCommit approval rule before the branch is updated.
- ✗
Use Amazon EventBridge to trigger a Lambda function that validates the number of approvers before merging
Why it's wrong here
Amazon EventBridge can emit events such as a pull request update or a merge attempt, and a Lambda function could call the CodeCommit API to count approvals. However, EventBridge is only an event-delivery service; it has no permissions or hooks to stop the merge operation itself. At most, the Lambda could programmatically attempt to close or revert a PR, but that is an asynchronous reaction rather than a true pre-merge enforcement gate, so it cannot guarantee the two-approval requirement.
- ✗
Use IAM policies to restrict write access to the production branch to only senior developers
Why it's wrong here
IAM policies define who can perform the `codecommit:CreatePullRequest` or `codecommit:MergePullRequest` actions, but they cannot express a workflow rule like 'require two distinct approvers before merging.' You could limit write access to the production branch to a set of senior developers, but any one of those developers would still have the ability to approve and merge their own pull request or push directly. IAM is an identity and access control mechanism, not an approval workflow engine, so it fundamentally cannot enforce multi-person review.
- ✓
Use CodeCommit pull request approval rules and a CodePipeline with a manual approval step triggered by a Lambda function that checks approval status
Why this is correct
CodeCommit's native pull request approval rules are the correct mechanism to block merging until a specified number of approvals (here, two) are received from authorized IAM principals. After the PR is approved and merged, CodePipeline can be triggered by the branch change, and a Lambda function can query the CodeCommit API (for example, `GetPullRequest` or `DescribePullRequestEvents`) to verify the approval state before the pipeline advances. Including a manual approval step in CodePipeline adds an additional human checkpoint between staging and production, which together with the approval rule satisfies both the two-approver requirement and the automated staging deployment.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
One of 1,298 original DOP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.