DOP-C02 SDLC Automation Practice Question
Which THREE actions should a DevOps team take to ensure a CI/CD pipeline using AWS CodePipeline is secure? (Choose three.)
⚠ Common exam trap
Many exam-takers confuse logging (CloudTrail) with security controls, or assume MFA can be directly enforced on pipeline executions, when in fact the correct security measures involve encryption, access control on artifacts, and IAM permissions on the pipeline resource itself.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use AWS KMS to encrypt artifacts in the pipeline.
AWS CodePipeline can use AWS KMS customer-managed keys (CMKs) to encrypt artifacts stored in S3 or other supported stores. This ensures that pipeline artifacts are encrypted at rest and in transit, protecting sensitive data from unauthorized access. By default, CodePipeline uses an AWS-managed key, but using a customer-managed KMS key gives the team full control over encryption, key rotation, and access policies.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Require multi-factor authentication (MFA) for pipeline executions.
Why it's wrong here
MFA is an authentication control for human users (IAM users or federated identities) accessing the AWS Management Console, CLI, or APIs. A CodePipeline execution is an automated, event-driven service process that uses a service role’s temporary credentials, not an interactive user session, so MFA cannot be applied to the pipeline run itself. Although you can require MFA for an IAM policy that allows StartPipelineExecution, that only governs who can trigger or manage the pipeline, not the execution's internal security. Therefore, this option does not directly secure the code, build, or deployment artifacts flowing through the pipeline.
- ✓
Use AWS KMS to encrypt artifacts in the pipeline.
Why this is correct
AWS KMS encryption for artifacts ensures that every source zip, build output, and deployment package stored in CodePipeline’s artifact bucket is encrypted with a customer-managed key using SSE-KMS (envelope encryption). This gives you granular control over who can decrypt artifacts via kms:Decrypt permissions on the key, and it provides a tamper-evident audit trail of key usage through AWS CloudTrail. Unlike default AWS-managed S3 encryption, a customer-managed KMS key lets you enforce key rotation, define cross-account access rules, and revoke access immediately in response to a threat, which directly protects sensitive artifacts at rest and during transit.
- ✓
Use AWS CodePipeline with a customer-managed S3 bucket for artifacts and restrict bucket access.
Why this is correct
When you let CodePipeline use its default S3 bucket, AWS controls the bucket policy and lifecycle, but with a customer-managed S3 bucket you set explicit bucket policies (e.g., deny all principals except the CodePipeline service role), enable Block Public Access, and configure VPC endpoints to prevent exposing artifacts over the internet. This restricts access to artifacts at the object-storage layer by controlling who can call s3:GetObject or s3:PutObject, so even if an attacker gains pipeline visibility, they cannot read or tamper with build outputs. A customer-managed bucket also lets you enforce versioning, lifecycle rules, and server-side encryption settings, ensuring that artifact storage complies with your organization’s security policies.
- ✓
Enable pipeline-level IAM permissions to restrict who can modify the pipeline.
Why this is correct
Pipeline-level IAM permissions are a preventive control that uses IAM policies (identity-based) or a resource-based policy on the pipeline to restrict which users, roles, or services can call admin actions like UpdatePipeline, DeletePipeline, or CreatePipeline. By applying least privilege, you ensure that only authorized DevOps personnel can alter the pipeline definition, add or change stages, or swap source actions, preventing an attacker from injecting malicious commands or redirecting artifacts to an exfiltration bucket. Unlike encryption (which protects data) or bucket policies (which protect storage), this control protects the pipeline configuration itself from unauthorized modification, ensuring the CI/CD process remains trustworthy.
- ✗
Enable AWS CloudTrail to log pipeline executions.
Why it's wrong here
AWS CloudTrail records API activity such as StartPipelineExecution, UpdatePipeline, and PutObject on the artifact bucket, giving you a detailed log of who did what and when. However, logging is a detective control—it tells you about a security incident after it happens, not does anything to prevent one. Enabling CloudTrail does not block unauthorized access, stop a malicious deployment, or constrain who can modify the pipeline; it merely provides an audit trail for post-event investigation. While important for compliance and incident response, CloudTrail alone cannot 'ensure' a secure pipeline, so it does not qualify as one of the correct actions for proactively securing CI/CD.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This DOP-C02 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DOP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which TWO actions can be used to improve the security of a CI/CD pipeline that uses AWS CodePipeline? (Choose two.)
medium- ✓ A.Enable encryption for artifacts stored in the pipeline's S3 bucket.
- ✓ B.Use cross-account actions with appropriate IAM roles to limit access.
- C.Configure the source action to poll for changes instead of using webhooks.
- D.Store secrets in the pipeline environment variables in plain text.
- E.Use a single IAM role for all pipeline actions to simplify permissions.
Why A: AWS CodePipeline stores artifacts in an S3 bucket, and enabling default encryption (SSE-S3 or SSE-KMS) ensures that all objects at rest are encrypted, protecting sensitive build outputs and source code from unauthorized access if the bucket is compromised. This is a fundamental security best practice for data at rest in any CI/CD pipeline.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.