DOP-C02 SDLC Automation Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Configure an Amazon EventBridge rule to detect ECR image pushes and invoke an AWS Lambda function that calls 'UpdateStack' with the new image URI.

  Why this is correct

  This is correct because Amazon EventBridge natively captures ECR image push events (e.g., the 'ECR Image Action' event type) and can directly target an AWS Lambda function. Lambda can then call CloudFormation's UpdateStack API, passing the new image URI as a parameter to the stack, thereby updating the infrastructure in an event-driven, serverless manner. This pattern is simple, requires no persistent compute, and integrates seamlessly with CloudFormation's parameter-based updates.

• ✗

  Create a CodeBuild project that triggers on ECR push, and have the build execute an 'aws cloudformation update-stack' command.

  Why it's wrong here

  This is wrong because although a CodeBuild project could be triggered via EventBridge on an ECR push and run the 'aws cloudformation update-stack' CLI command, it introduces unnecessary complexity. You would be provisioning a build environment (and paying for compute) simply to invoke a single API call, when a lightweight Lambda function can do the same thing more cheaply and directly. Additionally, the trigger must still be configured through EventBridge, making Lambda the more straightforward and efficient integration point.

• ✗

  Use AWS CodeDeploy with a trigger on ECR push to deploy the new image to a target group, and have the target group update the stack.

  Why it's wrong here

  This is wrong because AWS CodeDeploy is designed for application deployment to compute services like EC2, Lambda, or ECS, and it has no native ability to update CloudFormation stacks. ECR push events do not directly trigger CodeDeploy, and a 'target group' is an Application Load Balancer construct used for routing traffic, not for stack updates. Deploying a new image via CodeDeploy does not modify the CloudFormation template or parameters, so this option fundamentally misunderstands the service boundaries.

• ✗

  Set up an Amazon SNS topic subscribed to ECR image push events, and have the SNS topic send a notification to an AWS CloudFormation stack update endpoint.

  Why it's wrong here

  This is incorrect because Amazon SNS is a pub/sub notification service, and while it can receive ECR events (typically via EventBridge) and fan them out, there is no CloudFormation stack update endpoint that accepts SNS messages. CloudFormation updates must be initiated via an authenticated API call (like UpdateStack), which SNS cannot generate on its own. You would need a downstream subscriber such as an AWS Lambda function to parse the notification and invoke the CloudFormation API, so this approach is indirect and not the intended solution.

Go deeper

Related to this question