Question 1,432 of 256
DOP-C02 SDLC Automation Practice Question
A DevOps engineer is setting up an AWS CodeBuild project that needs to access resources in a VPC, such as an Amazon RDS database. The engineer has configured the CodeBuild project to run in the VPC. Which additional configuration is required for CodeBuild to pull the build Docker image?
⚠ Common exam trap
Candidates often confuse gateway endpoints (which work only for S3 and DynamoDB) with interface endpoints (which are required for services like ECR, ECS, and API Gateway), leading them to incorrectly select option B.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a VPC interface endpoint for Amazon ECR and configure the CodeBuild project to use it.
When a CodeBuild project runs inside a VPC, it loses default internet access, so it cannot reach public endpoints like Amazon ECR (Docker Hub or ECR) to pull the build image. A VPC interface endpoint (powered by AWS PrivateLink) creates a private, highly available connection to Amazon ECR within the VPC, allowing CodeBuild to pull images without traversing the internet. This is the correct solution because it provides direct, secure access to ECR while keeping all traffic within the AWS network.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a VPC peering connection to another VPC that has internet access.
Why it's wrong here
A VPC peering connection merely routes traffic between two VPCs; it does not act as an internet gateway or provide transitive internet access. Even if the peered VPC has an internet gateway, resources in the connecting VPC cannot use it unless a NAT gateway or other routing is configured. CodeBuild would still lack a path to reach ECR without either internet connectivity or a PrivateLink endpoint.
- ✗
Configure a VPC gateway endpoint for Amazon ECR.
Why it's wrong here
Gateway endpoints are only available for Amazon S3 and DynamoDB. Amazon ECR is not a supported service for gateway endpoints; it requires interface endpoints (AWS PrivateLink) to be accessed privately from within a VPC. Attempting to configure a gateway endpoint for ECR will not create a working private connection and may result in a configuration error.
- ✗
Attach an internet gateway to the VPC and add a default route to it.
Why it's wrong here
While attaching an internet gateway and adding a default route will give the subnet internet access, CodeBuild does not automatically use this route for outbound traffic unless the project is configured with the correct subnet and the instance has a public IP. Moreover, making the build subnet public exposes the build environment to the internet, which is a security risk; the recommended approach is to keep the build in a private subnet and use a NAT gateway or VPC endpoints.
- ✓
Create a VPC interface endpoint for Amazon ECR and configure the CodeBuild project to use it.
Why this is correct
This is correct because interface endpoints (AWS PrivateLink) for Amazon ECR provide private connectivity from your VPC without requiring internet access. You need to create both the ECR API endpoint and the ECR Docker Registry (DKR) endpoint, and then configure the CodeBuild project to use the VPC, subnet, and security group associated with those endpoints. This allows the build to pull images and push to ECR securely over the AWS network.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jul 4, 2026
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.