DOP-C02 SDLC Automation Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  The CodeBuild project's VPC configuration does not include the subnet IDs where the database resides.

  Why it's wrong here

  Although CodeBuild does require both the VPC ID and the subnet IDs to launch an elastic network interface in your VPC, omitting the specific subnet IDs would prevent the build from associating with the subnets that route to the database. This misconfiguration would typically cause a different failure, such as an inability to assign a network interface or a timeout due to no route to the database. However, the scenario described points to a security group rule issue, not a subnet resolution failure, so this is not the root cause.

• ✗

  The security group for the CodeBuild project does not allow outbound traffic to the RDS database.

  Why it's wrong here

  Security groups are stateful, and by default the outbound rule for a CodeBuild project's security group is set to allow all traffic. Even if you had restricted outbound traffic, the traffic would still be blocked unless the RDS database's security group explicitly allows inbound traffic from the CodeBuild security group on the database port. Since the evidence indicates that the database is rejecting connections, the problem lies in the inbound rules of the RDS security group, not the outbound rules of the build project's group.

• ✓

  The security group for the RDS database does not allow inbound traffic from the security group assigned to the CodeBuild project.

  Why this is correct

  This is the correct root cause because when CodeBuild runs in your VPC, it attaches the security group you specified to its ENI. For the build container to successfully connect to RDS, the database's security group must have an inbound rule that permits traffic on the database port from the source being the CodeBuild security group ID. If that rule is missing, all connection attempts will time out or be refused, regardless of other network configurations, making this the definitive security group misconfiguration to resolve.

• ✗

  The CodeBuild project does not have a route to the internet via an internet gateway, so it cannot reach the RDS endpoint.

  Why it's wrong here

  An internet gateway is only needed for resources that require direct internet access, but RDS databases are typically placed in private subnets and are accessed internally through VPC routing. CodeBuild, when configured with VPC settings, can reach RDS using private IP addresses or the RDS endpoint as long as it is in the same VPC and proper route tables are in place. Therefore, the absence of an internet gateway is not a factor here; the communication failure is entirely due to the security group's inbound rules not authorizing the CodeBuild security group.

Go deeper

Related to this question