DOP-C02 Monitoring and Logging Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Create ECR repository, then Write buildspec.yml, then Create CodeBuild project with privileged mode, then Start build

  Why this is correct

  The ECR repository must exist first because the CodeBuild project's post_build phase will run `docker push` to a specific repository URI; creating it late would cause the push step to fail with a repository-not-found error. The buildspec.yml file must be authored before the project is created so that the project's source configuration can point to an existing build instructions file, and the CodeBuild project itself must be created with the `privileged` flag set so the Docker daemon is available inside the build container. Finally, the build is started only after all prerequisites are in place, making this the only valid ordering.

• ✗

  Create CodeBuild project, then Create ECR repository, then Write buildspec.yml, then Start build

  Why it's wrong here

  This sequence is invalid because a CodeBuild build run cannot push to an ECR repository that has not yet been created, and if the repository does not exist at build time, the push fails. Additionally, creating the CodeBuild project before writing buildspec.yml risks the source repository at build start not containing that build instructions file, causing a 'buildspec file not found' error. The binding of a buildspec to a project can be declared upfront, but the file must exist in the source before the build is triggered; therefore the project-first ordering breaks the dependency chain.

• ✗

  Write buildspec.yml, then Create ECR repository, then Create CodeBuild project without privileged mode, then Start build

  Why it's wrong here

  The fatal flaw here is omitting privileged mode: when a buildspec runs `docker build`, `docker tag`, or `docker push`, the build container must have access to the Docker daemon, which CodeBuild only exposes when the environment's `privileged` flag is set to true. Without that flag, the build fails with 'Cannot connect to the Docker daemon' even though the ECR repository already exists. While writing buildspec.yml before project creation is acceptable, creating the project without privileged mode makes Docker-based image builds impossible, and privileged mode cannot be toggled at build time—it must be configured on the project.

• ✗

  Create ECR repository, then Start build, then Create CodeBuild project, then Write buildspec.yml

  Why it's wrong here

  This ordering is nonsensical because `start build` requires an existing CodeBuild project as a prerequisite; the AWS API call `StartBuild` takes a project name that must reference a previously created project, so a build cannot be initiated before the project exists. Moreover, even after the project is created later, the buildspec.yml file must already be present in the source repository or S3 input at the time the build runs, so writing it after starting the build would yield a missing-file error. The ECR repository also needs to be provisioned before the build pushes to it, making this entire tail-end ordering unworkable.

Go deeper

Related to this question