Split the deployment group into an Environment tag group and a Name tag group to require both tags

DOP-C02 By islever Editorial Last updated

Implement deployment strategies for instance, container, and serverless environments.

Short answer

A Reduce the current tag group to Environment=Production and add a separate Name=ApplicationA tag group so both tags are required.

Question

A company has an AWS CodeDeploy application. The application has a deployment group that uses a single tag group to identify instances for the deployment of Application. The single tag group configuration identifies instances that have Environment=Production and Name=ApplicationA tags for the deployment of ApplicationA. The company launches an additional Amazon EC2 instance with Department=Marketing, Environment=Production, and Name=ApplicationB tags. On the next CodeDeploy deployment of Application, the additional instance has ApplicationA installed on it. A DevOps engineer needs to configure the existing deployment group to prevent ApplicationA from being installed on the additional instance. Which solution will meet these requirements?
  1. Change the current single tag group to include only the Environment=Production tag. Add another single tag group that includes only the Name=ApplicationA tag. Correct Answer
  2. Change the current single tag group to include the Department=Marketing, Environment=production, and Name=ApplicationA tags.
  3. Add another single tag group that includes only the Department=Marketing tag. Keep the Environment=Production and Name=ApplicationA tags with the current single tag group.
  4. Change the current single tag group to include only the Environment=Production tag. Add another single tag group that includes only the Department=Marketing tag.

Key Takeaways

The semantics are the crux: tags inside one tag group are OR-ed, while an instance must match every tag group to be selected. Keeping both tags in a single group (B) therefore still matches on either tag and does not fix the problem, and adding a Marketing-only group (C) would exclude the intended targets rather than constrain them. Reducing the existing group to Environment=Production and adding a Name=ApplicationA group (A) produces an AND across the two groups, excluding the new Marketing instance.

Within a single tag group, CodeDeploy treats the listed tags as alternatives, so the existing group matching Environment=Production or Name=ApplicationA also picks up any instance that merely carries Environment=Production. The fix is to change the current tag group to contain only Environment=Production and add a second, separate tag group containing only Name=ApplicationA. Tags spread across separate tag groups must all match, so only instances with both tags receive ApplicationA.

Common mistake: Changing the single tag group to include Department=Marketing, Environment=Production, and Name=ApplicationA (B)—tags within one group are alternatives, so this broadens rather than narrows selection and would not exclude the new instance. Adding a separate group with only Department=Marketing (C)—that combination is neither required nor restrictive in the right way, since a single tag group can hold only one tag and the extra group does not exclude the untagged Department instance. Option A follows the documented behavior that a single tag group holds one tag and multiple groups are combined with AND.

Expert Analysis

Why the Answer Is Correct

CodeDeploy combines the tags inside a single tag group with OR and requires an instance to satisfy every configured tag group. The original group held Environment=Production and Name=ApplicationA in one group, so the newly launched instance matching only Environment=Production was still selected. Changing that group to contain only Environment=Production and adding a second tag group containing only Name=ApplicationA makes selection require both conditions, so the Department=Marketing, Environment=Production, Name=ApplicationB instance no longer matches and ApplicationA is no longer installed on it.

Why the Other Options Are Wrong

B places Department=Marketing, Environment=Production, and Name=ApplicationA into one tag group; because tags inside a single group are OR-ed, this still selects instances matching any one of them, so the change does not achieve the requirement. C adds a Department=Marketing tag group while keeping the current one, which excludes the intended targets from ApplicationA rather than protecting the new instance, since the new instance lacks Department=Marketing but still matches Environment=Production in the existing group. A is the correct fix.

Community Comment Notes

Community voted A (93). Commenters established the rule that tags in one tag group are OR-ed while tags across separate tag groups are AND-ed, and noted a single tag group can contain only one tag, so multiple single-tag groups are required. One commenter chose B on the mistaken reading that three tags in one group means all three must match; the AND semantics apply only across separate tag groups.

Official Reference

https://docs.aws.amazon.com/codedeploy/latest/userguide/instances-tagging.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

To enforce that an instance must have specific combinations of tags, place each required tag in its own separate single tag group. Remember that tags inside one group are OR-ed, but matching across multiple groups is AND-ed. Use this structure to precisely target instances without unintended overlaps.

Frequently Asked Questions

How does CodeDeploy evaluate multiple tag groups?

Tags within a single group use OR logic, while separate groups use AND logic. An instance must match at least one tag in every defined group.

Why does option B fail to exclude the new instance?

Option B puts all tags in one group, applying OR logic. The new instance matches Environment=Production, so it still gets selected despite other mismatches.

What is the key rule for CodeDeploy tag selection?

Use separate single-tag groups to enforce AND conditions. Keep related tags in one group only if you want OR behavior between them.

More DOP-C02 FAQ →

Community Votes

A
100%

100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 8 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 8

  1. thanhnv142 👍 9 Answered A
    A is correct: All tags in one tag group are OR operator. Tags are in multiple tag groups are AND operator
  2. Gomer 👍 6 Answered A
    I Found this question largely incomprehensible untill I understood the following concepts and mapped out everything - Single tag group: Any instance identified by at least one tag in the group is included in the deployment group. (OR Operator within individual tag groups) - Multiple tag groups: Instances that are identified by at least one tag in each of the tag groups are included. (AND Operator between multiple tag groups) https://docs.aws.amazon.com/codedeploy/latest/userguide/instances-tagging.html
  3. Ramdi1 👍 5 Answered A
    A - Original configuration: The single tag group with Environment=Production and Name=ApplicationA tags targets any instance with both tags, resulting in ApplicationA being deployed on the new Marketing instance despite its different Name tag. Solution A: Changing the current tag group to "Environment=Production" ensures only instances in the Production environment are considered. Adding a separate tag group with "Name=ApplicationA" specifically targets instances meant for that application. The Marketing instance with Department=Marketing tag doesn't match the new criteria and avoids unintended ApplicationA installation.
  4. DanShone 👍 5 Answered A
    A: A single tag group can only contain 1 tag, so multiple Single tag groups will be needed. https://docs.aws.amazon.com/codedeploy/latest/userguide/instances-tagging.html
  5. youonebe 👍 2 Answered A
    This is a very tricky question, even ChatGPT can't get it right, a good one! Make sure to go through this AWS doc first and fully understand it. https://docs.aws.amazon.com/codedeploy/latest/userguide/instances-tagging.html First thing first, why ApplicationA was installed on the new EC2 instance? Reason is <single tag group, multiple tags> was used. The <Environment> and <Name> tags are both defined within this tag group. So as long as the EC2 instance has one tag matched, ApplicationA would be deployed. In this case, the new EC2 instance has <Environment=Production> tag, so ApplicationA got deployed.
Show 3 more comments
  1. Srikantha 👍 1 Answered B
    Option B is the most effective solution, as it specifies that the deployment group should only target instances that have all three tags (Department=Marketing, Environment=Production, and Name=ApplicationA). This ensures that only instances specifically meant for ApplicationA are selected for the deployment, preventing unwanted instances (like those with Name=ApplicationB) from receiving the application.
  2. fdoxxx 👍 1 Answered B
    Option B is the most appropriate solution for meeting the requirements: Changing the current single tag group to include the specific tags (Department=Marketing, Environment=Production, and Name=ApplicationA) ensures that only instances with these specific tags are identified for the deployment of ApplicationA. The other options are not suitable for achieving the desired outcome
  3. Chelseajcole 👍 1
    A. need to applicationA tag

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Optimizing Amazon Timestream Query Performance

S-grade

Deploy the CloudWatch agent as a StatefulSet with IRSA and CloudWatchAgentServerPolicy, and configure the OIDC provider

S-grade

Disable cross-zone load balancing on the target group and start an Application Recovery Controller zonal shift

S-grade

Stream all CloudWatch metrics to Firehose, transform with Lambda, and deliver to S3

S-grade

Practice All DOP-C02 Questions

Access 85 questions with complete answers and detailed explanations.

View Full DOP-C02 Practice Test →

← Back to DOP-C02 Study Guide