ExamPark
Course menuDVA-C03

Exams / DVA-C03 / CI/CD with CodePipeline and CodeBuild / Question 2

DVA-C03 practice question: CI/CD with CodePipeline and CodeBuild (2 of 3)

Testing and Deployment A free question from our original DVA-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.

Last verified against current AWS documentation ·How we write our questions

A CodeBuild project runs database migrations.

Its password is stored in AWS Secrets Manager as a JSON secret named prod/db with the keys username and password. A rotation is in progress, and the previous password is still valid.

If the migration fails with the new password, the team wants the build to use the previous password, which is held by the secret's AWSPREVIOUS version stage. The password must come from Secrets Manager, not from the project or the source code.

Which env entry meets these needs?

Choose one answer.

  1. A. Under the secrets-manager section of env, use DB_PASSWORD: prod/db:password:AWSPREVIOUS.
  2. B. Under the secrets-manager section of env, use DB_PASSWORD: prod/db:AWSPREVIOUS.
  3. C. Under the secrets-manager section of env, use DB_PASSWORD: prod/db:password:AWSCURRENT.
  4. D. Under the parameter-store section of env, use DB_PASSWORD: prod/db:password:AWSPREVIOUS.
Show the answer and explanation

Answer: A

  • A. Right: Correct. The entry follows secret-id:json-key:version-stage. The json-key picks the password from the JSON, and AWSPREVIOUS selects the version before the current one, so the build gets the old password from Secrets Manager. Learn more: Build specification reference for CodeBuild (opens in a new tab)
  • B. Wrong: Without a json-key, CodeBuild returns the whole secret text, a JSON document that also holds the username. The build would not receive the password on its own.
  • C. Wrong: AWSCURRENT returns the new password, which is the one that is failing. The fallback needs the previous version.
  • D. Wrong: The parameter-store section reads Systems Manager Parameter Store, not Secrets Manager, and it does not take a version stage. It cannot retrieve this secret.

Explanation

The secrets-manager section of a buildspec takes the form secret-id:json-key:version-stage:version-id, with the last two parts optional. The json-key extracts one value from a JSON secret, and a version stage such as AWSPREVIOUS selects an older version. This gives the build the previous password without storing it in the project or the source.

Study

Keep practicing

Answer questions with a score at the end, or practice just this topic with the explanation after each one. No sign-up needed.

Take the free DVA-C03 practice examPractice CI/CD with CodePipeline and CodeBuildAll CI/CD with CodePipeline and CodeBuild questions

Want more on CI/CD with CodePipeline and CodeBuild? The 5 full-length practice sets have 18 more CI/CD with CodePipeline and CodeBuild questions, 390 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets