Set the vulnerable CodeArtifact package version to archived and allow direct publishing while blocking upstream operations

DOP-C02 By islever Editorial Last updated

Apply automation for security controls and data protection. Build and manage artifacts.

Short answer

CD Set the vulnerable package version to archived and allow direct publishing while blocking upstream operations.

Question

A company has set up AWS CodeArtifact repositories with public upstream repositories. The company's development team consumes open source dependencies from the repositories in the company's internal network. The company's security team recently discovered a critical vulnerability in the most recent version of a package that the development team consumes. The security team has produced a patched version to fix the vulnerability. The company needs to prevent the vulnerable version from being downloaded. The company also needs to allow the security team to publish the patched version. Which combination of steps will meet these requirements? (Choose two.)
  1. Update the status of the affected CodeArtifact package version to unlisted.
  2. Update the status of the affected CodeArtifact package version to deleted.
  3. Update the status of the affected CodeArtifact package version to archived. Correct Answer
  4. Update the CodeArtifact package origin control settings to allow direct publishing and to block upstream operations. Correct Answer
  5. Update the CodeArtifact package origin control settings to block direct publishing and to allow upstream operations.

Key Takeaways

Archived is the only status that both removes the version from listings and makes its assets non-downloadable, which is exactly what preventing consumption requires; Unlisted still permits download if the version is already referenced in a lock file, and Disposed permanently deletes assets irreversibly (C). Publishing the patched version requires flipping origin control to allow direct publishing and block upstream operations (D). The status 'deleted' is not a package version status at all, and deletion is a separate API operation rather than a status, so B is invalid.

A critical vulnerability was found in the most recently consumed version of a package that the repository pulls from a public upstream, and the vulnerable version must stop being downloadable while the security team publishes a patched version. Setting the affected package version's status to Archived makes its assets impossible to download and removes it from version listings, which blocks client consumption. Because the repository reaches the package through an upstream external connection that would normally prevent publishing an existing public version, the origin control settings must allow direct publishing while blocking upstream operations so the security team can publish the patched version.

Common mistake: Setting the version status to deleted (B) — deleted is not a valid CodeArtifact package version status; the documented statuses are Published, Unfinished, Unlisted, Archived, and Disposed, so this option describes an operation rather than a status. Setting it to unlisted (A) — unlisted only removes the version from the listings returned to package managers while its assets remain downloadable, so a developer with the version pinned in a package-lock.json or requirements.txt can still install it, which fails the requirement to prevent the vulnerable version from being downloaded. luisfsm_111 and ApacheKafkaAWS argued for deletion on the grounds that archiving seems insufficient for a vulnerability, but archived already blocks the download itself and can be reversed, whereas deleting the version removes the ability to manage it through status updates.

Expert Analysis

Why the Answer Is Correct

The requirement is to prevent the vulnerable version from being downloaded while still allowing the security team to publish a patched version. AWS CodeArtifact documents Archived as a package version status whose assets can no longer be downloaded, which is removed from version listings, and whose consumption by clients is therefore blocked; unlike Unlisted, where the assets remain downloadable by anything that already references the version such as a lock file, Archived stops retrieval outright (C). Because the repository obtains this package through an upstream external connection, and CodeArtifact prevents publishing a version that is reachable through an upstream repository, the origin control settings must be changed to allow direct publishing and block upstream operations, which lets the security team publish the patched version into the repository that consumes it (D).

Why the Other Options Are Wrong

A proposes setting the status to unlisted. Per the CodeArtifact package version status documentation, unlisted assets are still available for download from the repository; only the version listing omits them, so a build whose lock file already references that version can still install it. That fails the requirement to prevent the vulnerable version from being downloaded. B proposes setting the status to deleted. Deleted is not a package version status; the documented statuses are Published, Unfinished, Unlisted, Archived, and Disposed. Removal is performed through the DeletePackageVersions API, which is an operation rather than a status, so the option as written is not valid. E proposes blocking direct publishing and allowing upstream operations, which is the inverse of what is needed and would leave the security team unable to publish the patched version into the consuming repository. C and D are the correct combination.

Community Comment Notes

Community voted C,D (72), with B,D a 28 percent minority. BvGVAXeAMP and Weninka quoted the CodeArtifact package version status documentation establishing that deleted is not a valid status and that archived is what prevents download, while unlisted still allows it. aws_god independently confirmed there is no delete version status. luisfsm_111 and ApacheKafkaAWS preferred deletion, arguing that archiving an insecure version is insufficient, but archived already blocks the download and remains reversible through UpdatePackageVersionsStatus, whereas deletion removes the version's assets entirely.

Official Reference

These links open the official vendor documentation in a new tab.

Community Votes

CD
72%
BD
28%

72% of anonymous learners picked answer CD. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 12 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 12

  1. Weninka 👍 5
    I had this question in my exam and checking what was the correct option for the package version led me here. C - archived seems to be the right one. A - unlisted will only remove the package version from the list of versions returned to package managers, but it WILL NOT prevent the download. B - deleted - it's not a valid package version status (https://docs.aws.amazon.com/codeartifact/latest/ug/packages-overview.html#package-version-status) C - archived - will block the package version download. D - Allow direct publishing will give the internal team permissions to upload the new version of the package E - block direct publishing means the package version are updated from external (public) repos More on the packages origin control settings here: https://docs.aws.amazon.com/codeartifact/latest/ug/package-origin-controls.html
  2. BvGVAXeAMP 👍 5
    A - unlisted does not prevent download B - deleted is not a valid code artifact package version status C- archived will prevent download https://docs.aws.amazon.com/codeartifact/latest/ug/packages-overview.html#package-version-status
  3. jamesf 👍 3
    C. Update the status of the affected CodeArtifact package version to archived. - Reason: Setting the package version status to Archived will prevent it from being downloaded while still retaining its metadata. This ensures that the vulnerable version cannot be accessed or used but allows you to track or potentially restore it later if needed. D. Update the CodeArtifact package origin control settings to allow direct publishing and to block upstream operations. - Reason: Allowing direct publishing and blocking upstream operations will enable the security team to publish the patched version directly to your repository without being blocked by upstream restrictions. This ensures that the patched version can be made available while preventing any interference from upstream repositories.
  4. aws_god 👍 3
    There is no delete version status - https://docs.aws.amazon.com/codeartifact/latest/ug/packages-overview.html#package-version-status
  5. limelight04 👍 1
    Option B: Update the status of the affected CodeArtifact package version to deleted. This action will prevent the vulnerable version from being accessible. Option D: Update the CodeArtifact package origin control settings to allow direct publishing and block upstream operations. This ensures that only the security team can publish the patched version directly.
Show 7 more comments
  1. trungtd 👍 1
    By allowing direct publishing, the security team can publish the patched version directly to the CodeArtifact repository. Blocking upstream operations ensures that only the patched version is available and prevents the vulnerable version from being pulled from the upstream repository.
  2. luisfsm_111 👍 1
    If there's a critical vulnerability, there's no reason to archive instead of deleting https://docs.aws.amazon.com/codeartifact/latest/ug/delete-package.html
  3. getadroit 👍 1
    BE https://aws.amazon.com/blogs/devops/tighten-your-package-security-with-codeartifact-package-origin-control-toolkit/
  4. ApacheKafkaAWS 👍 1
    you have to delete it not archive it
  5. inturist 👍 1
    -----> B,D
  6. siheom 👍 1
    VOTE B,D
  7. tgv 👍 1
    ---> BD

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Optimizing Amazon Timestream Query Performance

S-grade

Deploy the CloudWatch agent as a StatefulSet with IRSA and CloudWatchAgentServerPolicy, and configure the OIDC provider

S-grade

Disable cross-zone load balancing on the target group and start an Application Recovery Controller zonal shift

S-grade

Stream all CloudWatch metrics to Firehose, transform with Lambda, and deliver to S3

S-grade

Practice All DOP-C02 Questions

Access 85 questions with complete answers and detailed explanations.

View Full DOP-C02 Practice Test →

← Back to DOP-C02 Study Guide