AWS Certified Devops Engineer Professional · Free Practice Question Hard
Question 12
The DevOps team at an e-commerce company introduced multiple stages of security to the code release process. As an additional measure, they want to add additional SAST & DAST tools into an automated pipeline. These tools should be invoked for every code push in an AWS CodeCommit repository. The code must be sent via an external API.
Which actions should a DevOps engineer take to achieve these requirements MOST efficiently?
-
A
Create an Amazon CloudWatch Event rule on the CodeCommit repository that reacts to pushes. Choose an S3 bucket as a target so the code will be automatically zipped into S3. Create an S3 event notification rule to trigger an AWS Lambda function that will retrieve the zipped code from S3 and send it to the 3rd party API.
-
B
Create a CloudWatch Event rule on the CodeCommit repository that reacts to code pushes. Choose an AWS Lambda function as a target that will request the code from CodeCommit, zip it, and send it to the 3rd party API.
-
C
Create a CodeCommit hook on an EC2 instance that streams changes from CodeCommit into the local filesystem. A cron job on the EC2 instance will zip the code and send it to the 3rd party API upon changes being detected.
-
D
Create an Amazon CloudWatch Event rule on a schedule of 5 minutes that triggers an AWS Lambda function that checks for new commits in the CodeCommit repository. If new commits are detected, the function will download and zip the code and then send it to the 3rd party API.
Reveal correct answer
Correct answer: B
Explanation
Amazon CloudWatch Events delivers a near real-time stream of system events that describe changes in Amazon Web Services (AWS) resources. Using simple rules that can be set up, you can match events and route them to one or more target functions or streams. Custom application-level events can be generated and published to CloudWatch Events. Scheduled events can be set up that are generated on a periodic basis. A rule matches incoming events and routes them to targets for processing.
CORRECT: "Create a CloudWatch Event rule on the CodeCommit repository that reacts to code pushes. Choose an AWS Lambda function as a target that will request the code from CodeCommit, zip it, and send it to the 3rd party API" is the correct answer (as explained above.)
INCORRECT: "Create an Amazon CloudWatch Event rule on the CodeCommit repository that reacts to pushes. Choose an S3 bucket as a target so the code will be automatically zipped into S3. Create an S3 event notification rule to trigger an AWS Lambda function that will retrieve the zipped code from S3 and send it to the 3rd party API" is incorrect.
CloudWatch Event Rules cannot have S3 buckets as a target. It is more efficient to directly invoke the Lambda function from the CloudWatch Event rule than use S3 as a temporary store and then trigger a function execution.
INCORRECT: "Create a CodeCommit hook on an EC2 instance that streams changes from CodeCommit into the local filesystem. A cron job on the EC2 instance will zip the code and send it to the 3rd party API upon changes being detected" is incorrect.
You cannot create a CodeCommit hook on an EC2 instance, so this is not possible
INCORRECT: "Create an Amazon CloudWatch Event rule on a schedule of 5 minutes that triggers an AWS Lambda function that checks for new commits in the CodeCommit repository. If new commits are detected, the function will download and zip the code and then send it to the 3rd party API" is incorrect.
CloudWatch Event rules on a schedule would introduce lag and would be inefficient. So, this option is ruled out.
References:
Save time with our AWS cheat sheets:
Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
