ExamPark
Course menuDOP-C02

Exams / DOP-C02 / Study guide

AWS Certified DevOps Engineer – Professional (DOP-C02) study guide

What the DOP-C02 exam tests, domain by domain, and how to tell the right answer from the nearly right one. Each topic links to fuller study notes and free practice questions.

Last checked against the official exam guide and AWS documentation · How we write our content

About the DOP-C02 exam

The AWS Certified DevOps Engineer – Professional exam checks whether you can automate how software and infrastructure are built, deployed, operated and secured on AWS, usually across many accounts and Regions. AWS aims it at people with 2 or more years of provisioning, operating and managing AWS environments, plus experience with the software development lifecycle, scripting, automation and securing infrastructure.
Questions 75: 65 scored and 10 unscored, which aren’t marked
Time 180 minutes
Question types Multiple choice (one answer from four) and multiple response (two or more from five or more)
Score Scaled from 100 to 1,000; 750 to pass
Scoring model Compensatory: you need to pass overall, not in each domain
Guessing An unanswered question counts as wrong, and there is no penalty for a wrong answer, so answer everything

Check the official certification page for the current price, languages and booking options before you book.

What the exam really tests

Professional questions are long. They describe an organization with several accounts, an existing toolchain and a list of constraints, then offer four answers that all sound plausible. The winning answer meets every constraint with the most automation and the least custom code. A few themes run through the whole exam:

  • Automate, don’t operate. EventBridge rules, Config remediation, Systems Manager Automation and pipelines beat scripts on servers and manual steps.
  • Deploy safely. Blue/green, canary and linear traffic shifting with CloudWatch alarms and automatic rollback.
  • Think multi-account. Organizations, Control Tower, StackSets, delegated administrators, cross-account roles and customer managed KMS keys for shared artifacts.
  • See everything. Centralized logs, metrics, traces and findings, with alarms that page only when it matters.
  • Least privilege at scale. Permissions boundaries, SCPs, ABAC, Identity Center and short-lived credentials.

How to read a question

  1. Read the last sentence first to see what’s being asked and the qualifier: least operational overhead, fastest recovery, most secure, fewest changes.
  2. List the hard constraints: accounts, Regions, RTO and RPO, existing tools, compliance rules.
  3. Eliminate answers that use retired or closed services, add custom servers, or break a constraint.
  4. Between the last two, choose the managed, native integration over the glue code.

Pace yourself: 180 minutes for 75 questions is about 2 minutes 20 seconds each, and long scenarios take longer. Flag and move on.

How the domains add up

SDLC Automation is the largest domain at 22%. Configuration Management and IaC and Security and Compliance follow at 17% each, then Resilient Cloud Solutions and Monitoring and Logging at 15% and Incident and Event Response at 14%. The domains overlap heavily: a deployment question often turns on monitoring, and an incident question on IAM.

Domain 1: SDLC Automation 22%

The largest domain covers building CI/CD: CodePipeline stages and triggers, source connections to GitHub, GitLab and Bitbucket, CodeBuild and buildspecs, secrets in builds, automated tests and reports, artifact repositories, AMI and container image pipelines, CodeDeploy to EC2 and on-premises, ECS, EKS and Lambda deployments, and pipelines that deploy across accounts.

The stages of a release pipeline A push to GitHub starts the pipeline through CodeConnections. CodeBuild compiles and runs unit tests, CodeDeploy deploys to staging, CodeBuild runs integration tests, a manual approval sends an email, and CodeDeploy deploys to production with blue/green and automatic rollback. Source CodeConnections a push to GitHub starts the pipeline Build CodeBuild buildspec: compile, unit tests, reports Deploy to staging CodeDeploy same artifact that goes to prod Integration tests CodeBuild a failure stops the pipeline Manual approval SNS email to the approver Deploy to prod blue/green an alarm triggers automatic rollback
A typical release pipeline: build once, then promote the same artifact through each stage. Failing tests in CodeBuild stop the pipeline, a manual approval gates production, and CodeDeploy rolls back automatically when a CloudWatch alarm fires during the blue/green deployment.

Domain 2: Configuration Management and IaC 17%

This domain covers defining and governing infrastructure as code: CloudFormation templates, change sets, custom resources and stack policies, the CDK and SAM, StackSets across accounts and Regions, Service Catalog, AppConfig feature flags, account provisioning with Organizations and Control Tower, cross-account roles and SCPs, Systems Manager Automation and patching, and automation with Lambda and Step Functions.

A CloudFormation StackSet deploying to accounts in two OUs One StackSet template targets a production OU and a development OU. Each OU has two accounts, and each account gets stacks in two Regions. A new account added to an OU gets its stacks automatically. StackSet one template Prod OU Dev OU Account A stacks in 2 Regions Account B stacks in 2 Regions Account C stacks in 2 Regions Account D stacks in 2 Regions New account joins gets stacks automatically
A StackSet deploys one CloudFormation template as stack instances in many accounts and Regions. With service-managed permissions you target OUs instead of account IDs, and automatic deployment creates the stacks in any account that later joins the OU, and can remove them when an account leaves.

Domain 3: Resilient Cloud Solutions 15%

This domain covers keeping workloads available and recoverable: Multi-AZ and multi-Region designs for compute and data, Route 53 health checks and failover, load balancer health and cross-zone settings, EC2 Auto Scaling policies, lifecycle hooks and warm pools, scaling containers and serverless workloads, and disaster recovery strategies with AWS Backup, RTO and RPO.

An Auto Scaling instance moving through a warm pool and lifecycle hooks An instance waits pre-initialized in a warm pool, enters Pending:Wait where a launch lifecycle hook runs setup, goes InService and receives traffic, then on scale-in enters Terminating:Wait where a hook saves logs, and is terminated. Warm pool stopped, set up starts in seconds when scaling out Pending:Wait launch hook runs setup, then calls CompleteLifecycleAction InService passes health checks, receives traffic Terminating:Wait terminate hook copies logs, drains work Terminated gone, with its local disk
Lifecycle hooks pause an instance in a wait state so you can run setup before it takes traffic, or save logs before it disappears. The instance moves on when your script calls CompleteLifecycleAction or the timeout passes. A warm pool keeps pre-initialized instances ready, usually stopped, so scale-out skips the slow first boot.

Domain 4: Monitoring and Logging 15%

This domain covers seeing what workloads are doing: collecting, retaining, encrypting and centralizing logs with subscriptions, custom metrics, metric filters and alarms, analyzing logs with Logs Insights and Athena, distributed tracing with X-Ray and OpenTelemetry, and the CloudWatch agent and metric streams.

Centralized logging from several accounts into one logging account Two application accounts send CloudWatch Logs through subscription filters to a logs destination in a logging account. Data Firehose batches and compresses the records into an S3 log bucket, and Athena queries the logs there. Account A CloudWatch Logs Account B CloudWatch Logs subscription filters Logging account Logs destination receives from all accounts Data Firehose batches and compresses S3 log bucket cheap, long retention Athena SQL over the logs
Centralized logging across accounts. Subscription filters send each account’s CloudWatch Logs to a destination in the logging account. Data Firehose batches and compresses the records into S3, and Athena queries them in place. The logs are stored where the app accounts can’t delete them, which matters if one is compromised.

Domain 5: Incident and Event Response 14%

This domain covers reacting to events automatically and fixing what breaks: EventBridge rules and schedules, AWS Health events, AWS Config rules with automatic remediation, troubleshooting failed deployments and CloudFormation stacks, and managing operational issues with OpsCenter and root cause analysis.

Domain 6: Security and Compliance 17%

This domain covers security at scale: least privilege with permissions boundaries, session policies and ABAC, federation with IAM Identity Center and OIDC, rotating machine credentials, Security Hub CSPM, GuardDuty and defense in depth, encryption with KMS and ACM, Macie, and auditing with CloudTrail, Access Analyzer and Inspector.

An 8-week study plan

This plan assumes about an hour on weekdays and a longer, hands-on session at the weekend. It’s a professional exam, so give it more time than an associate; if you run CI/CD and multi-account AWS at work, six weeks may be enough.

Week Focus Do this
1 Baseline and pipelines Take the free practice exam in timed mode. Then CodePipeline (V2 triggers, stages, actions), CodeConnections, CodeBuild and buildspecs, secrets and test reports.
2 Deployments CodeDeploy on EC2 (AppSpec, hooks, blue/green), ECS blue/green, EKS rollouts, Lambda aliases and SAM traffic shifting, artifact repositories, EC2 Image Builder, cross-account pipelines.
3 Infrastructure as code CloudFormation (change sets, drift, stack policies, custom resources, helper scripts, rollback states), CDK bootstrapping, SAM, StackSets, Service Catalog, AppConfig.
4 Multi-account and automation Organizations, Control Tower and its customizations, SCPs, cross-account roles, Systems Manager Automation, State Manager, Patch Manager, Step Functions.
5 Resilience Multi-AZ and multi-Region data stores, Route 53 failover, load balancer health checks, Auto Scaling policies, lifecycle hooks and warm pools, container scaling, DR strategies and AWS Backup.
6 Monitoring and incidents CloudWatch Logs subscriptions and encryption, metric filters, metric math and composite alarms, Logs Insights, OpenTelemetry tracing, CloudWatch agent, metric streams, EventBridge, AWS Health, Config remediation, OpsCenter.
7 Security Permissions boundaries, session policies, ABAC, Identity Center, OIDC for CI, Secrets Manager rotation, Security Hub CSPM, GuardDuty, KMS, ACM, Macie, CloudTrail, Access Analyzer, Inspector.
8 Exam practice Full timed practice exams. Review every wrong answer and rebuild the weakest pieces by hand.

How to use practice questions well

  • Practice the length. Do full 75-question sets in 180 minutes so the real exam’s stamina demand isn’t a surprise.
  • Read the wrong options. They are usually real features that solve a neighboring problem, or the right service with the wrong setting.
  • Don’t memorize questions. The real exam won’t reuse them.
  • Aim for 80% or more across a few full timed practice exams before you book.

Get hands-on

In a personal account with a budget alert set: build a CodePipeline from a GitHub repository through CodeBuild to a Lambda function deployed by SAM with a canary and an alarm, then break the function and watch it roll back; deploy a StackSet to two Regions; write a Config rule with an automatic remediation runbook. Delete everything afterward.

Frequently asked questions

Do I need an associate certification first?

No, AWS has no prerequisites. Most candidates find SysOps/CloudOps (SOA) or Developer (DVA) knowledge a big help, because this exam assumes it and goes further.

Which services are no longer right answers?

OpsWorks has reached end of life, Incident Manager is closed to new customers, and the X-Ray SDKs and daemon are in maintenance mode in favor of OpenTelemetry. Prefer current services such as Systems Manager, CloudWatch and OpenTelemetry-based collectors.

How deep is the coding?

You need to read buildspecs, AppSpec files, CloudFormation and IAM policies, and understand what a short script does. You won’t write programs.

Are the practice questions the real exam questions?

No. Every question on this site is original, written from the public exam guide and checked against AWS documentation. Using real exam questions breaks the AWS Certification Program Agreement.

Test yourself

The free DOP-C02 practice exam has 75 questions with an explanation for every option. No sign-up needed.

Take the free practice examReview questions untimed

Want to be sure you're ready? The 5 full-length practice sets add 375 new questions, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets