EnglishDeutschFrançaisEspañolPortuguês

AWS · DOP-C02 · Advanced

AWS DevOps Engineer - Professional (DOP-C02) — Practice Questions and Mock Exam

Prepare for DOP-C02 with original practice questions and clear answer explanations. Ask Alex, your AI tutor, when you need more detail, use your results to identify topics to review, and practice your pacing with timed mock exams.

75Mock exam questions
180minTime limit
750/ 1000Passing score

Checked against AWS · August 2026 · Current exam version

About the exam

The AWS Certified DevOps Engineer – Professional validates advanced technical proficiency in provisioning, operating, and managing distributed application systems on AWS. It covers CI/CD pipeline automation, infrastructure as code, monitoring and logging, incident response, and security controls across the full software development lifecycle.

This certification targets DevOps engineers, platform engineers, and SREs with two or more years of hands-on experience managing AWS environments. It demonstrates the ability to implement and manage continuous delivery systems, automate security controls, and design highly available and self-healing infrastructure on AWS.

Try five DOP-C02 questions

Try five practice questions from the app’s current AWS Certified DevOps Engineer - Professional question bank, with answers and explanations.

Configuration Management and IaC1 / 5

A DevOps engineer needs to look up the latest AMI ID for Amazon Linux 2023 during a CloudFormation stack deployment. The AMI ID must be resolved dynamically at deployment time so the template does not need to be updated when new AMIs are released. The solution must work without any custom code or external dependencies. Which approach meets these requirements?

AlexFull explanation from Alex

CloudFormation dynamic references with {{resolve:ssm:/aws/service/ami-amazon-linux-latest/<variant>}} resolve the latest AMI ID at deployment time from AWS-maintained SSM public parameters. No custom code, Lambda, or external dependencies required — CloudFormation natively resolves the reference during stack operations. AWS publishes current AMI IDs under /aws/service/ami-amazon-linux-latest/ for all Amazon Linux variants across all Regions. Hard-coding AMI IDs requires manual template updates when new AMIs release. A Lambda custom resource works but violates the no-custom-code requirement. Region-to-AMI condition mappings become stale and need manual maintenance. Exam tip: SSM public parameters + dynamic references = zero-maintenance AMI lookup. Ref: docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/dynamic-references-ssm.html

Sourcedocs.aws.amazon.com

Monitoring and Logging2 / 5

A company needs to centralize logs from 50 accounts in an AWS Organization into a single security account. The logs include CloudTrail, VPC Flow Logs, and application logs in CloudWatch Logs. The solution must be automated, apply to all current and future accounts, and copy new CloudWatch log data into the security account for analysis. Which approach should the DevOps engineer implement?

AlexFull explanation from Alex

Use Organizations-native log controls. CloudTrail organization trails automatically create trail copies and start logging when accounts join the organization. CloudWatch Logs centralization rules replicate new log events from selected accounts, organizational units, Regions, log groups, or data sources into a destination account. Recent CloudWatch support for data-source-based centralization lets security teams target sources such as VPC Flow Logs and CloudTrail Logs without maintaining individual log group lists. Exam tip: cross-account observability gives a central view; CloudWatch Logs centralization copies log data into a central account.

Sourceaws.amazon.com

Security and Compliance3 / 5

A security team is investigating a potential security incident where an IAM access key may have been compromised. They need to visualize the blast radius by understanding which resources the compromised credentials accessed, what API calls were made, and which other entities interacted with the same resources during the investigation period. Which AWS service provides the most comprehensive investigation capabilities for this scenario?

AlexFull explanation from Alex

Amazon Detective builds behavior graphs from CloudTrail logs, VPC Flow Logs, and GuardDuty findings to enable deep security incident investigation. For compromised credentials, Detective visualizes the IAM principal's API call history, accessed resources, geographic patterns, and related entity behaviors — providing the blast radius analysis required. Finding groups correlate related activities across entities. GuardDuty detects threats but lacks investigation depth and entity relationship visualization. CloudTrail Insights detects unusual API volume patterns but doesn't provide entity behavior graphs. Security Hub aggregates findings but lacks interactive visualization and behavior analysis. Exam tip: Detective = investigate and visualize. GuardDuty = detect. Insights = anomaly detection. Security Hub = aggregate. Ref: docs.aws.amazon.com/detective/latest/userguide/analyzing-findings.html

Sourcedocs.aws.amazon.com

Incident and Event Response4 / 5

A company uses AWS Systems Manager to manage its EC2 fleet. The operations team needs a centralized view of all operational issues including CloudWatch alarm breaches, AWS Health events, and Security Hub findings. Each issue must be automatically linked to the affected resources with contextual information such as related CloudWatch graphs and recent API activity. The team needs to execute remediation runbooks directly from the issue view. Which solution provides these capabilities?

AlexFull explanation from Alex

AWS Systems Manager OpsCenter aggregates operational issues as OpsItems, automatically created from CloudWatch alarms, EventBridge events, Security Hub findings, and AWS Health events. Each OpsItem links to related resources with contextual information and provides associated Systems Manager Automation runbooks for direct remediation — delivering the centralized view with automated issue creation, resource linking, and runbook execution required. OpenSearch dashboards require custom setup and lack native runbook integration. Trusted Advisor monitors best practices but doesn't aggregate operational issues. Custom CloudWatch dashboards display metrics but lack issue management and runbook integration. Exam tip: OpsCenter = centralized OpsItems + auto-creation + runbook remediation. Ref: docs.aws.amazon.com/systems-manager/latest/userguide/OpsCenter.html

Sourcedocs.aws.amazon.com

Resilient Cloud Solutions5 / 5

A DevOps engineer needs to configure auto scaling for an Amazon ECS service running on Fargate behind an Application Load Balancer. The service receives variable HTTP traffic throughout the day and must maintain response times under 200 ms. The engineer wants scaling to respond proportionally to request demand changes. Which ECS service auto scaling policy type and metric are most appropriate?

AlexFull explanation from Alex

Amazon ECS Service Auto Scaling supports target tracking, step scaling, and scheduled scaling. Target tracking creates and manages the CloudWatch alarms and scaling adjustments needed to keep a metric close to a target value, scaling out proportionally when load rises and scaling in more gradually. For HTTP services behind an Application Load Balancer, ALBRequestCountPerTarget is a predefined metric for target tracking and is often a better demand signal than CPU when the requirement is proportional response to request traffic.

Sourcedocs.aws.amazon.com

446 practice questions

The Pass-IT question pool gives you material to practice for DOP-C02. A Pass-IT mock exam uses 75 questions and a 180-minute time limit; these are practice settings.

Pool details: DOP-C02

Passing score750 / 1,000

as published by AWS

Objectives in the guide19 objectives listed in the official guide

across 6 domains in the official exam guide

Pool size446 questions

= The pool size is equivalent to 5 sets of 75 questions; this does not mean that each mock exam uses a separate set.

Blueprint domains6 domains in the exam blueprint

SDLC Automation 93 · Configuration Management and IaC 75 · Resilient Cloud Solutions 71 · Monitoring and Logging 71 · Incident and Event Response 64 · Security and Compliance 72

Recorded as checked against sources446 of 446

questions recorded as having their answer, options, and explanation checked against official AWS documentation

What's on the exam

SDLC Automation carries the most weight at 22%, covering CI/CD pipeline design, automated testing integration, artifact management, and deployment strategies like blue/green and canary spanning EC2 instances, containers, and serverless compute. Security and Compliance ties with Configuration Management and IaC for second place at 17% each: one scales identity management and automated security controls across accounts, the other packages infrastructure as reusable code and automates account provisioning and governance at scale.

Resilient Cloud Solutions and Monitoring and Logging split 15% apiece, covering architecture spread across multiple Availability Zones and Regions alongside the observability pipelines that catch problems before they escalate. Incident and Event Response closes the blueprint at 14% — the smallest domain, but where event-driven remediation and root-cause analysis live, and a candidate who's automated deployments without automating the response to what breaks is only prepared for half the job.

Exam blueprint: DOP-C02

SDLC Automation22%

Wire together CI/CD pipelines and fold automated testing into them, manage the artifacts those pipelines produce across repositories, and choose deployment patterns like blue/green or canary for instances, containers, and serverless targets alike.

≈ 20 h
Configuration Management and IaC17%

Package infrastructure as reusable code templates, extend that automation to onboard and govern new accounts at scale, and script the complex operational tasks that would otherwise need manual intervention.

≈ 15 h
Resilient Cloud Solutions15%

Spread workloads across zones and regions for resilience, scale them with elastic and serverless patterns, and automate failover so recovery time and data-loss targets are actually met.

≈ 14 h
Monitoring and Logging15%

Pipe logs and metrics into durable storage, mine that data to catch problems early, and wire up automated responses so complex environments self-correct without manual triage.

≈ 14 h
Incident and Event Response14%

Route AWS events into notification and processing workflows, push configuration changes triggered by those events, and trace application or system failures back to their root cause.

≈ 13 h
Security and Compliance17%

Scale identity management across federated accounts under least-privilege rules, automate the controls that keep data and network boundaries protected, and stand up auditing that surfaces anomalies before they become incidents.

≈ 15 h

Exam format and question types

The exam draws 75 questions (65 scored, 10 unscored) from multiple-choice and multiple-response formats inside a 180-minute window. Questions are scenario-heavy, often describing a multi-stage deployment pipeline, an infrastructure-automation constraint, or an incident already in progress and asking for the next correct action. At 2.4 minutes per question, efficient reading and quick elimination of distractors matter more than exhaustive analysis.

Question types: DOP-C02

Multiple Choice65%

Select the single answer that best meets the question’s requirements.

Multiple Response35%

Select multiple answers. Follow the question’s instructions on how many to choose.

See AWS for official question-format information. The shares shown describe the Pass-IT practice pool; they do not establish the proportions on the official exam.

Preparing for DOP-C02

The exam runs through Pearson VUE, either at a testing center or online with a remote proctor, and is offered in English, Japanese, Korean, and Simplified Chinese. Certification holds for 3 years; passing a recertification exam renews it, and because this is a professional-level credential, earning it also renews any associate-level AWS certification you hold.

Preparation and logistics: DOP-C02

Preparation

Illustrative study time55–135 h

illustrative planning range: 55 h with relevant experience to 135 h when starting out; your needs may fall outside this range

LevelAdvanced

Taking and maintaining the certification

DeliveryPearson VUE testing center or online proctored exam
Retake policy14-day waiting period between exam attempts, no limit on total number of attempts
Certification validity3 years

Pass a recertification exam before the 3-year expiration date. Professional-level certifications also renew all associate-level certifications

Common pitfalls

Topics to review: DOP-C02

  1. 01IaC Tool Selection

    Confusing when to use CloudFormation, CDK, Terraform, or Systems Manager for different infrastructure automation scenarios and requirements.

  2. 02Deployment Strategies

    Mixing up blue/green, canary, rolling, and in-place deployment patterns and not knowing which AWS services support each strategy.

  3. 03Pipeline Security

    Not understanding how to integrate security scanning, secrets management, and compliance checks into automated CI/CD pipelines.

  4. 04Monitoring Gaps

    Confusing CloudWatch metrics, X-Ray traces, CloudTrail logs, and EventBridge events for different operational monitoring use cases.

  5. 05Auto-Healing Design

    Not knowing how to combine Auto Scaling, health checks, and Systems Manager automation to create self-healing infrastructure patterns.

Frequently asked questions

How long is the AWS Certified DevOps Engineer - Professional exam?

The DOP-C02 exam has 75 questions and a 180-minute time limit.

What is the passing score for AWS Certified DevOps Engineer - Professional?

The passing score for the DOP-C02 exam is 750 / 1000.

Which pitfalls should I review when preparing for AWS Certified DevOps Engineer - Professional?

Topics to review include IaC Tool Selection, Deployment Strategies, Pipeline Security, Monitoring Gaps, Auto-Healing Design. Work through examples to check that you understand the distinctions and can explain your answer.

How is DOP-C02 weighted across its domains?

SDLC automation is the largest domain at 22%, then configuration management and infrastructure as code and security and compliance at 17% each. Resilient cloud solutions and monitoring and logging follow at 15%, with incident and event response at 14%. It is the flattest weighting of the AWS professional exams we cover, so there is no domain you can safely skip.

Do you need an associate certification before DOP-C02?

No. AWS states no formal prerequisite, so the professional exam can be booked directly. The catalog budget is around 90 hours, and the questions assume you already operate pipelines rather than having only read about them.

How often do you have to renew DOP-C02?

Every three years, by passing the recertification exam before the expiry date. A professional-level pass also renews any associate-level AWS certifications you hold, so DOP-C02 keeps DVA-C02 or SOA-C03 alive at the same time.

How soon can you retake DOP-C02?

After 14 days. AWS applies the same waiting period to every attempt and sets no maximum, so a failed sitting costs two weeks rather than a year.

DOP-C02 or SAP-C02 — which professional exam first?

They sit at the same level and answer different questions. SAP-C02 asks how you would design across accounts, organizations and migrations; DOP-C02 asks how you would build, ship and recover the pipeline that runs it. Take the one that matches your job, not the one that sounds harder.

One certification, 12 months

Practice for DOP-C02

Focus your practice on one certification, or choose Pro to practice across all certifications.

Start a free practice sessionTry the first 20 questions without a card to see whether the practice suits you.

For eligible purchases: money-back guarantee if you fail your exam.

View guarantee terms →