A video streaming service runs an AWS CodePipeline pipeline for its playback API. The pipeline runs unit tests, scans the container image for vulnerabilities, runs a dynamic application security test against a staging endpoint and runs a load test.
The security team wants image vulnerabilities found before any image reaches production, so that a critical finding stops the release. The dynamic security test needs the staging endpoint to be running, so it must run after the staging deployment.
The load test is slow, so it should run only for pushes to the release branch and never hold up pull request feedback. The engineers want managed AWS services wherever they can do the job.
Which THREE actions meet these requirements? (Choose three.)
Choose three answers.
AA. Push the image to a staging repository with ECR scanning on push, add a pipeline step that waits for the scan to complete and fails on any critical finding, and promote the image only after that step passes.
BB. Run the load test on every pull request in a CodeBuild project with a 30-minute timeout, so that performance regressions are caught in review before the code is merged.
CC. Add a CodeBuild action after the staging deployment that runs the dynamic security scanner against the staging endpoint, and fails the stage when the scanner reports a high-severity issue.
DD. Run the security test before the build stage, against a development endpoint that is not yet deployed, so that findings appear on pull requests before the code is merged.
EE. Create a separate CodeBuild project for the load test with a webhook filter group that matches only pushes to the release branch, so that pull requests never start the test.
FF. Run the load test as the last stage of the pipeline on every commit, and skip the production deployment whenever the load test runs longer than the release window.
Show the answer and explanation
Answers: A, C, E
A. Right: Correct. ECR starts a scan when the image is pushed, but the scan runs after the push returns, so the gate step waits for the scan to complete before reading the findings. Failing the step on a critical finding stops the image from reaching production. Learn more: Image scanning in Amazon ECR (opens in a new tab)
D. Wrong: The endpoint does not exist until staging is deployed, so the test cannot run against it. The team would also need to stand up a second environment just to host a scan.
E. Right: Correct. A webhook filter on the head reference limits the load test to release-branch pushes, which keeps pull request feedback fast. CodeBuild runs the test with no extra service to manage. Learn more: GitHub webhook events (opens in a new tab)
F. Wrong: Running the test on every commit still holds up each change, and skipping deployments on a slow test would block releases for reasons unrelated to the code. The release team asked for a test limited to release branches.
Explanation
Image scanning belongs after the image is pushed to a staging repository and before promotion, with a gate that waits for the scan to finish so a critical finding blocks the release. A dynamic security test needs a running endpoint, so it runs after the staging deployment and fails its stage on high-severity findings. The slow load test runs only for release-branch pushes through a CodeBuild webhook filter, which keeps pull request feedback fast.
Want more on Automated tests and test reports in pipelines? The 5 full-length practice sets have 8 more Automated tests and test reports in pipelines questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →