AWS DOP-C02 Certification Exam

AWS Certified DevOps Engineer Professional DOP-C02

The AWS Certified DevOps Engineer - Professional certification validates the ability to automate the testing and deployment of AWS infrastructure and applications. The exam covers six domains: SDLC Automation, Configuration Management and Infrastructure as Code, Resilient Cloud Solutions, Monitoring and Logging, Incident and Event Response, and Security and Compliance. It draws on services such as CodePipeline, CodeBuild, CodeDeploy, CloudFormation, Systems Manager, CloudWatch, EventBridge, Auto Scaling, ECS, EKS, Lambda and AWS Organizations. Candidates are tested on designing and troubleshooting automated delivery pipelines and operational controls at scale. This certification suits DevOps engineers with two or more years of AWS experience.

Certification Overview

  • Exam name: AWS DOP-C02
  • Vendor: AWS
  • Exam code: DOP-C02
  • Duration: 180 minutes
  • Total questions: 75
  • Passing score: 75%

Who Should Take This Exam?

DevOps Engineer, Site Reliability Engineer, Platform Engineer, Cloud Engineer, Release Engineer, Infrastructure Automation Engineer, Systems Architect

Prerequisites

No prior certification is required. AWS recommends two or more years of experience provisioning, operating and managing AWS environments.

Topics Covered

  • SDLC Automation
  • Configuration Management and IaC
  • Resilient Cloud Solutions
  • Monitoring and Logging
  • Incident and Event Response
  • Security and Compliance

Question Types

  • Multiple Choice (Single Answer)
  • Multiple Choice (Multiple Answers)

AWS DOP-C02 Practice Questions

Our question bank contains 844+ practice questions for this certification. Sample questions from each exam chapter. Expand a question to see the answer choices. With a subscription, you get unlimited practice exams with randomized questions from our full question bank.

SDLC Automation

Which TWO practices reduce the risk that a shared CodeBuild cache degrades build reliability across multiple concurrently running branches?
  • Include the branch or commit identifier in the S3 cache path
  • Scope the cache to specific dependency directories rather than the whole workspace
  • Disable VPC connectivity for the build environment
  • Grant the CodeBuild service role administrator access to the artifact bucket
  • Increase the number of retries on the source stage
A logistics company wants its CodePipeline to promote a build to production only after two separate reviewers approve, and wants the approval requirement enforced by the pipeline itself rather than by team process. Which TWO pipeline features enforce this? (Choose two.)
  • An S3 bucket policy that denies writes from unapproved accounts
  • A CloudWatch alarm that pages approvers by SNS
  • IAM policies that restrict who can call the ApproveOrRejectAction API for that action
  • A manual approval action configured before the production deploy stage
  • A CodeBuild buildspec environment variable listing approver usernames
Which TWO actions should a company take so that a CodePipeline execution triggered by a merge to main always deploys the newest commit to production, even when several merges happen close together? (Choose two.)
  • Set the execution mode to PARALLEL for the deploy stage
  • Add a fixed 30-minute delay between the build and deploy stages
  • Disable stage transitions after the first successful deployment
  • Ensure the deploy stage only ever acts on the latest source revision passed through it
  • Keep the pipeline's execution mode set to SUPERSEDED

Configuration Management and IaC

Which TWO of the following are valid ways to define infrastructure as code for provisioning AWS resources? (Choose two.)
  • A spreadsheet listing resource names
  • A screenshot of the architecture diagram
  • A manually clicked-through console session
  • An AWS CDK application written in TypeScript
  • A CloudFormation YAML template
Which TWO AWS services help onboard and secure new accounts in a multi-account organization? (Choose two.)
  • AWS Organizations
  • AWS Control Tower
  • Amazon Rekognition
  • AWS Amplify
  • Amazon Personalize
A team wants a CloudFormation stack update to preview its impact before applying it, and to prevent accidental deletion of a production database resource regardless of future template edits. Which TWO features should they use together?
  • A DeletionPolicy of Retain on the database resource
  • Change sets to preview the update
  • A CloudWatch billing alarm
  • A larger instance class for the database
  • A public read replica of the database

Resilient Cloud Solutions

A database administrator configures an Amazon RDS for PostgreSQL instance for high availability. Which feature automatically provisions a standby instance in a different Availability Zone and performs an automatic failover if the primary instance becomes unavailable?
  • Create a read replica in another Availability Zone
  • Switch the engine to Aurora Serverless v2
  • Copy automated snapshots to another Region
  • Enable a Multi-AZ deployment
A development team runs a web tier behind an Application Load Balancer with an Auto Scaling group. Which Auto Scaling policy type adjusts capacity to keep a chosen CloudWatch metric, such as average CPU utilization, at a specified target value?
  • Target tracking scaling policy
  • Step scaling policy
  • Scheduled scaling policy
  • Simple scaling policy
A retail platform runs its checkout service in two AWS Regions. Traffic must go to the primary region under normal conditions and shift entirely to the secondary region once the primary fails a health check. Which Route 53 configuration meets this requirement?
  • Failover routing with a primary and secondary record, each tied to a health check
  • Weighted routing with equal weights
  • Multivalue answer routing returning several healthy records
  • Geolocation routing split by continent

Monitoring and Logging

A security team wants a fully automated pipeline that revokes an IAM access key the moment GuardDuty reports it as compromised, with no analyst action required. Which THREE components should the team build?
  • An EventBridge rule matching the specific GuardDuty compromised-credential finding type
  • A Trusted Advisor check for unused IAM credentials
  • An IAM execution role for that function with permission to manage access keys
  • A Lambda function that calls UpdateAccessKey to deactivate the reported key
  • A CloudTrail data event selector covering every S3 object
  • A daily scheduled report listing all access keys older than 90 days
A team runs a blue/green deployment through CodeDeploy and wants the rollout to roll back automatically if error rates spike on the new environment during traffic shifting. Which TWO configurations make this happen?
  • A CloudWatch alarm scoped to the new environment's error-rate metric
  • A manual approval action inserted before each traffic-shift increment
  • A Step Functions waitForTaskToken step between shift increments
  • An EventBridge rule that pauses the pipeline for manual review
  • Automatic rollback enabled on the deployment group for that alarm
A DevOps engineer is designing centralized, real-time log analytics that pulls application logs from many source accounts into one analytics account, using only AWS-native building blocks and no third-party agents. Which THREE components belong in this design?
  • A CloudWatch Logs subscription filter in each source account
  • An S3 Transfer Acceleration endpoint on the analytics bucket
  • A CloudWatch Logs destination with a resource policy trusting the source accounts
  • An AWS Direct Connect gateway shared across the accounts
  • A VPC peering connection between every source account and the analytics account
  • A Kinesis Data Firehose delivery stream owned by the analytics account

Incident and Event Response

A company uses Amazon EventBridge to route events from AWS services to downstream targets. Which component determines whether an incoming event is delivered to a specific target?
  • An IAM permissions boundary on the target role
  • A CloudWatch composite alarm state change
  • An EventBridge rule with a matching event pattern
  • An SNS topic policy attached to the target
A solutions architect wants a failed AWS Config rule evaluation to automatically remediate a misconfigured S3 bucket without writing custom application code. What should the solutions architect configure?
  • An AWS Config remediation action calling an SSM document
  • A Systems Manager maintenance window task
  • A CloudWatch Events rule invoking a Lambda rollback function
  • An AWS Config conformance pack retention policy
An operations team needs to search structured log data across multiple Lambda functions to find the root cause of a spike in errors. Which tool should the team use?
  • Amazon Athena federated query
  • AWS X-Ray service map
  • CloudTrail Insights
  • CloudWatch Logs Insights

Security and Compliance

A media company grants a contractor temporary read access to objects in an Amazon S3 bucket for a two-day project and wants to avoid creating a long-term IAM user or distributing access keys. Which AWS capability should the company use to issue short-lived, scoped credentials to the contractor?
  • AWS Organizations service control policies
  • An IAM user with an access key rotated weekly
  • AWS Security Token Service AssumeRole
  • Amazon Cognito identity pools for federated end users
A DevOps team stores a database password in AWS Secrets Manager and wants Secrets Manager to generate a new password and update the database on a schedule using only the built-in rotation template, without writing custom orchestration. Which AWS service actually executes the rotation logic?
  • Amazon EventBridge Scheduler rules
  • AWS Lambda
  • AWS Step Functions state machines
  • AWS Systems Manager Automation documents
A compliance auditor asks how far back an account can view a record of management API calls when the account has never had an AWS CloudTrail trail explicitly created. What is the default retention period for this activity in the CloudTrail Event history view?
  • 7 days
  • 90 days
  • 180 days
  • 365 days

Frequently Asked Questions

How many questions are on the exam?

The AWS DOP-C02 exam contains 75 questions.

What is the passing score?

You need 75% to pass.

How long is the exam?

You have 180 minutes to complete the exam.

More AWS Practice Exams

Practice with realistic mock exams to prepare for your AWS certification.