DOP-C02 SDLC Automation Practice Question
Which THREE practices help ensure the security of a CI/CD pipeline that deploys to production? (Choose three.)
⚠ Common exam trap
Candidates often confuse operational controls (like manual approval) with security controls, or mistakenly believe that storing credentials in the repository aids traceability, when in fact it creates a severe security risk.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Integrate static code analysis and vulnerability scanning into the pipeline.
Static code analysis and vulnerability scanning (option A) are essential for identifying security flaws early in the development lifecycle, preventing vulnerable code from reaching production. Integrating these tools into the CI/CD pipeline ensures that every commit is automatically checked against known vulnerabilities and coding standards, reducing the risk of deploying exploitable code.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Integrate static code analysis and vulnerability scanning into the pipeline.
Why this is correct
Automated static code analysis and vulnerability scanning detect security defects early in the development cycle, when they are cheapest to remediate. Tools like SAST identify insecure code patterns, while dependency scanners flag known CVEs in third-party libraries, preventing vulnerable code from ever being packaged into deployment artifacts. This 'shift-left' approach reduces the risk of production incidents.
- ✗
Require manual approval for all deployments to production.
Why it's wrong here
Requiring manual approval for every production deployment acts as a change management gate, not a technical security control. A human reviewer cannot catch vulnerabilities or misconfigurations consistently, and the process is prone to error, delay, or rubber-stamping over time. It does not prevent insecure code from entering the pipeline, so it should not be considered a core CI/CD security practice.
- ✓
Use IAM roles with least privilege for pipeline actions.
Why this is correct
Applying IAM roles with least-privilege permissions to each pipeline stage minimizes the potential blast radius if the pipeline is compromised. Instead of sharing broad static credentials, CodeBuild and CodeDeploy assume narrowly scoped roles with temporary credentials, often federated from OIDC providers, ensuring actions only allow the minimum required API calls and resources.
- ✗
Store deployment credentials in the source repository for traceability.
Why it's wrong here
Storing deployment credentials directly in the source repository makes them accessible to every developer and anyone with repository access, and they persist in version history even after deletion. Leaked credentials enable unauthorized access to production resources and are a leading cause of cloud account compromise. Secure approaches rely on AWS Secrets Manager or SSM Parameter Store with automatic rotation and access auditing, never on repository traceability.
- ✓
Encrypt artifacts in transit and at rest using AWS KMS.
Why this is correct
Encrypting pipeline artifacts with AWS KMS protects both data confidentiality and integrity while artifacts are stored in Amazon S3 and when transferred between pipeline stages. KMS-managed CMKs provide envelope encryption, allowing granular key rotation, access control, and auditability via CloudTrail, and ensure even if an artifact bucket is accidentally exposed, the contents remain unreadable without the proper key.
Go deeper
Related to this question
About these practice questions
Courseiva writes every DOP-C02 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.