EnglishDeutschFrançaisEspañolPortuguês

AWS · DOP-C02 · Advanced

AWS DevOps Engineer - Professional (DOP-C02) — Practice Questions and Mock Exam

The AWS Certified DevOps Engineer – Professional validates advanced technical proficiency in provisioning, operating, and managing distributed application systems on AWS.

Practice for freeTry a practice question first
Try a practice question firstPractice for free
Start practicing DOP-C02 freeBuy DOP-C02 access for $29.99
75Questions per Pass-IT mock exam
180minPass-IT mock exam time limit

Official DOP-C02 exam: 750 out of 1000 points to pass.

Checked against AWS · September 2026 · Current exam version

Try Pass-IT

See what learning with Pass-IT is like.

Answer a DOP-C02 sample question and read the explanation with its source. Right here, with no sign-up.

Configuration Management and IaC1 / 5

A DevOps engineer needs to look up the latest AMI ID for Amazon Linux 2023 during a CloudFormation stack deployment. The AMI ID must be resolved dynamically at deployment time so the template does not need to be updated when new AMIs are released. The solution must work without any custom code or external dependencies. Which approach meets these requirements?

AlexFull explanation from Alex

CloudFormation dynamic references with {{resolve:ssm:/aws/service/ami-amazon-linux-latest/<variant>}} resolve the latest AMI ID at deployment time from AWS-maintained SSM public parameters. No custom code, Lambda, or external dependencies required — CloudFormation natively resolves the reference during stack operations. AWS publishes current AMI IDs under /aws/service/ami-amazon-linux-latest/ for all Amazon Linux variants across all Regions. Hard-coding AMI IDs requires manual template updates when new AMIs release. A Lambda custom resource works but violates the no-custom-code requirement. Region-to-AMI condition mappings become stale and need manual maintenance. Exam tip: SSM public parameters + dynamic references = zero-maintenance AMI lookup. Ref: docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/dynamic-references-ssm.html

Sourcedocs.aws.amazon.com

Monitoring and Logging2 / 5

A company needs to centralize logs from 50 accounts in an AWS Organization into a single security account. The logs include CloudTrail, VPC Flow Logs, and application logs in CloudWatch Logs. The solution must be automated, apply to all current and future accounts, and copy new CloudWatch log data into the security account for analysis. Which approach should the DevOps engineer implement?

AlexFull explanation from Alex

Use Organizations-native log controls. CloudTrail organization trails automatically create trail copies and start logging when accounts join the organization. CloudWatch Logs centralization rules replicate new log events from selected accounts, organizational units, Regions, log groups, or data sources into a destination account. Recent CloudWatch support for data-source-based centralization lets security teams target sources such as VPC Flow Logs and CloudTrail Logs without maintaining individual log group lists. Exam tip: cross-account observability gives a central view; CloudWatch Logs centralization copies log data into a central account.

Sourceaws.amazon.com

Security and Compliance3 / 5

A security team is investigating a potential security incident where an IAM access key may have been compromised. They need to visualize the blast radius by understanding which resources the compromised credentials accessed, what API calls were made, and which other entities interacted with the same resources during the investigation period. Which AWS service provides the most comprehensive investigation capabilities for this scenario?

AlexFull explanation from Alex

Amazon Detective builds behavior graphs from CloudTrail logs, VPC Flow Logs, and GuardDuty findings to enable deep security incident investigation. For compromised credentials, Detective visualizes the IAM principal's API call history, accessed resources, geographic patterns, and related entity behaviors — providing the blast radius analysis required. Finding groups correlate related activities across entities. GuardDuty detects threats but lacks investigation depth and entity relationship visualization. CloudTrail Insights detects unusual API volume patterns but doesn't provide entity behavior graphs. Security Hub aggregates findings but lacks interactive visualization and behavior analysis. Exam tip: Detective = investigate and visualize. GuardDuty = detect. Insights = anomaly detection. Security Hub = aggregate. Ref: docs.aws.amazon.com/detective/latest/userguide/analyzing-findings.html

Sourcedocs.aws.amazon.com

Resilient Cloud Solutions4 / 5

A DevOps engineer needs to configure auto scaling for an Amazon ECS service running on Fargate behind an Application Load Balancer. The service receives variable HTTP traffic throughout the day and must maintain response times under 200 ms. The engineer wants scaling to respond proportionally to request demand changes. Which ECS service auto scaling policy type and metric are most appropriate?

AlexFull explanation from Alex

Amazon ECS Service Auto Scaling supports target tracking, step scaling, and scheduled scaling. Target tracking creates and manages the CloudWatch alarms and scaling adjustments needed to keep a metric close to a target value, scaling out proportionally when load rises and scaling in more gradually. For HTTP services behind an Application Load Balancer, ALBRequestCountPerTarget is a predefined metric for target tracking and is often a better demand signal than CPU when the requirement is proportional response to request traffic.

Sourcedocs.aws.amazon.com

Incident and Event Response5 / 5

A company uses AWS Systems Manager to manage its EC2 fleet. The operations team needs a centralized view of all operational issues including CloudWatch alarm breaches, AWS Health events, and Security Hub findings. Each issue must be automatically linked to the affected resources with contextual information such as related CloudWatch graphs and recent API activity. The team needs to execute remediation runbooks directly from the issue view. Which solution provides these capabilities?

AlexFull explanation from Alex

AWS Systems Manager OpsCenter aggregates operational issues as OpsItems, automatically created from CloudWatch alarms, EventBridge events, Security Hub findings, and AWS Health events. Each OpsItem links to related resources with contextual information and provides associated Systems Manager Automation runbooks for direct remediation — delivering the centralized view with automated issue creation, resource linking, and runbook execution required. OpenSearch dashboards require custom setup and lack native runbook integration. Trusted Advisor monitors best practices but doesn't aggregate operational issues. Custom CloudWatch dashboards display metrics but lack issue management and runbook integration. Exam tip: OpsCenter = centralized OpsItems + auto-creation + runbook remediation. Ref: docs.aws.amazon.com/systems-manager/latest/userguide/OpsCenter.html

Sourcedocs.aws.amazon.com

How to prepare for DOP-C02 with Pass-IT.

Currently 445 practice questions for DOP-C02, with new ones added regularly. Focus on what you still need to learn.

Get past difficult questions.

Understand why an answer is correct. Alex explains the concepts and answers your follow-up questions so you can apply what you learn to the next task.

Meet Alex →

Conversation preview · DOP-C02

AMI lookup in CloudFormation

  1. You

    Can the template fetch an AMI ID without Lambda code?

  2. Alex · AI tutor

    Yes. An SSM dynamic reference can read the AWS public parameter during a stack operation.

    Read the documentation ↗
  3. You

    Will a new AMI automatically update a running stack?

  4. Alex · AI tutor

    No. Resolution happens during stack operations; the reference is not a continuous update mechanism.

    Read the documentation ↗

Make your study time count.

Practice at your level.
For new practice sessions, Pass-IT adjusts the difficulty based on your previous answers.

Learn from mistakes.
Incorrect answers automatically become flashcards. When you review them, you rate how confidently you remember; Pass-IT schedules the next review.

See how focused practice works →

Animated feature preview

Turn your mistakes into knowledge you can rely on.

How Pass-IT works

Your review

Answered a question incorrectly?

Pass-IT saves it for your review.

DOP-C02 · Question excerpt

AMI lookup in CloudFormation

View the full question

A DevOps engineer needs to look up the latest AMI ID for Amazon Linux 2023 during a CloudFormation stack deployment. The AMI ID must be resolved dynamically at deployment time so the template does not need to be updated when new AMIs are released. The solution must work without any custom code or external dependencies. Which approach meets these requirements?

Understand the correct answer.

Use a CloudFormation dynamic reference to AWS Systems Manager Parameter Store public parameters to resolve the latest Amazon Linux 2023 AMI ID at deployment time.

Use an SSM dynamic reference to resolve the AMI during deployment.

Read the documentation ↗

How confidently do you remember?

During review, you assess how well you still know the answer.

Correct after hesitating

Pass-IT schedules your next review.

The date depends on your self-assessment and previous reviews.

Simplified demonstration. No learning progress is saved.

Practice for the moment that counts.

Take a full mock exam with a time limit and find out whether you can finish in time.

Your DOP-C02 mock exam

Questions
75
Minutes
180

Illustration of an exam session

  1. Start
  2. Answer questions
  3. Finish

Length and time limit of the Pass-IT mock exam.

Go into your exam with more confidence.

Your Readiness Score helps you assess whether you are ready for the exam. Results by exam domain show you where you should keep practicing.

Your money back if you fail despite 80% Readiness.
If your Readiness Score is at least 80% when you take the exam and you still fail, we refund the Pass-IT purchase price for this certification.

For active, paid access. Submit proof of failing within 14 days.

Further guarantee conditions

You need at least 80% Readiness and active, paid access to the certification when you take the exam. Take the exam within your access period and submit official proof of failing within 14 days after the exam.

For purchases through Apple or Google, refunds are handled by the respective store. See the full terms for further details.

Read the guarantee terms →

The Readiness Score describes your practice progress, not a probability of passing.

Guarantee requirement

80%

At least 80% Readiness
when you take the exam

Money back if you fail

Question counts and mock exam settings from the current Pass-IT catalog.

Exam domains

What you practice for DOP-C02.

Exam topics, relevant practice and sources you can check.

Automating software deliverySee the guide for weighting93 QuestionsPass-IT questions

Build delivery pipelines that test changes, manage release artifacts and deploy applications predictably.

  • Implement continuous integration and delivery (CI/CD) pipelines with repositories, builds, version control and secure deployment credentials across accounts.
  • Place unit, integration, acceptance, security and performance tests at appropriate pipeline stages, using their results to assess application health.
  • Generate and securely store versioned release artifacts, including automated machine and container image builds and lifecycle management.
  • Choose mutable or immutable deployment patterns for instance, container and serverless environments, apply strategies such as blue/green or canary, and diagnose deployment failures.
Official certification objectives
Infrastructure and configuration automationSee the guide for weighting75 QuestionsPass-IT questions

Use reusable infrastructure definitions and automation to keep large AWS environments consistent.

  • Create reusable infrastructure-as-code templates with lifecycle, configuration, security and change controls across accounts and Regions.
  • Automate account creation and onboarding with centralized identity, governance and security controls using services such as Organizations and Control Tower.
  • Automate inventory, patching and desired-state configuration, using Systems Manager and event-driven workflows for complex operational tasks.
Official certification objectives
Resilient cloud operationsSee the guide for weighting71 QuestionsPass-IT questions

Implement workloads that remain available, scale with demand and recover within business limits.

  • Remove single points of failure through Multi-AZ or multi-Region deployments, replication, load balancing and failover.
  • Implement scaling, caching and loosely coupled container or serverless workloads, choosing useful scaling metrics and resolving capacity problems.
  • Automate and test backup, failover and recovery procedures to meet recovery time and acceptable data-loss objectives.
Official certification objectives
Monitoring and loggingSee the guide for weighting71 QuestionsPass-IT questions

Collect trustworthy operational evidence and turn it into useful detection and automated action.

  • Collect, aggregate and securely retain logs and metrics, including custom metrics, streaming ingestion and appropriate access or encryption controls.
  • Use logs, metrics, traces and dashboards to identify anomalies and investigate application or infrastructure issues.
  • Automate health checks, alarms, event routing and remediation across complex environments, including the agents and rules needed to support them.
Official certification objectives
Incident and event responseSee the guide for weighting64 QuestionsPass-IT questions

Connect operational events to notifications, configuration changes and investigations that restore service.

  • Integrate event sources such as AWS Health and EventBridge with processing workflows, queues and notifications.
  • Change infrastructure and fleet configurations in response to events, restoring systems to their intended state.
  • Find root causes of system, application and deployment failures using service-health information, metrics, logs and traces.
Official certification objectives
Security and compliance automationSee the guide for weighting71 QuestionsPass-IT questions

Apply identity, data protection and security auditing consistently across large AWS environments.

  • Manage human and machine access with federation, least-privilege policies, permissions boundaries and account controls, including credential rotation.
  • Automate layered network and data protections across accounts, including sensitive-data discovery, encryption and certificate management.
  • Implement security logging, vulnerability detection and audit checks, then analyze unexpected events and configuration drift.
Official certification objectives
Question formats you can practice
Multiple Choice
Select one answer.
Multiple Response
Select multiple applicable answers.

These are practice formats in Pass-IT. See the Official certification objectives for the official exam requirements.

Frequently asked questions

Your preparation

How much study time should I plan for DOP-C02?

For planning, Pass-IT estimates roughly 55–135 hours. Relevant experience may put you toward the lower end; starting from scratch may put you toward the higher end. Your needs may fall outside this range. This is not a time requirement from AWS or a promise that you will be exam-ready within that time.

Do you need an associate certification before DOP-C02?

No. AWS states no formal prerequisite, so the professional exam can be booked directly. The catalog budget is around 90 hours, and the questions assume you already operate pipelines rather than having only read about them.

Using Pass-IT

What language are Pass-IT questions in?

Questions in the app are currently in English. Translations of the sample questions on this page apply only to this preview. Check with AWS for the languages available for the official exam.

How long does my DOP-C02 access last?

Access covers this certification for 12 months. You pay once, with no automatic renewal.

When does the money-back guarantee apply?

The guarantee refunds the Pass-IT purchase price for this certification. You need eligible paid access and a Readiness Score of at least 80% from your practice results when you take the exam. This score can only reach 80% after at least 50 answered questions and is not a validated probability of passing. Take the exam during your access period and submit official proof of failing within 14 days. Guarantee terms

About the DOP-C02 exam

Where can I take the DOP-C02 exam?

Pearson VUE testing center or online proctored exam.

How long is the AWS Certified DevOps Engineer - Professional exam?

The DOP-C02 exam has 75 questions and a 180-minute time limit.

How often do you have to renew DOP-C02?

The certification is valid for three years. Before it expires, pass the latest version of this exam to renew it for three years. Alternatively, while your certification is active, maintain it on AWS Skill Builder to add one year. Passing this exam also renews your AWS Certified Developer - Associate, AWS Certified CloudOps Engineer - Associate, AWS Certified SysOps Administrator - Associate and AWS Certified Cloud Practitioner certifications, provided each certification is active.

How soon can you retake DOP-C02?

After 14 days. AWS applies the same waiting period to every attempt and sets no maximum, so a failed sitting costs two weeks rather than a year.

DOP-C02 or AWS Certified Solutions Architect - Professional: which should you take first?

Both are Professional-level options that address different work. For AWS Certified Solutions Architect - Professional, SAP-C02’s domains are Design Solutions for Organizational Complexity, Design for New Solutions, Continuous Improvement for Existing Solutions, and Accelerate Workload Migration and Modernization. Its last exam day is 17 November 2026; registration for the updated version, SAP-C03, opens on 27 October 2026. DOP-C02 focuses on provisioning, operating, and managing distributed application systems on AWS. Choose the one that matches your job rather than the one that sounds harder.

Your preparation for DOP-C02

$29.99one-time

12 months of access for DOP-C02 · No automatic renewal

Buy DOP-C02 access

Questions in the app are currently in English.

Try 20 questions for freeFree account required. No credit card.

Already have an account? Log in

Prefer a subscription? View subscriptions →

Money back if you fail with at least 80% Readiness, for eligible purchases under the guarantee terms.

Guarantee terms

The guarantee refunds the Pass-IT purchase price for this certification. You need eligible paid access and a Readiness Score of at least 80% from your practice results when you take the exam. This score can only reach 80% after at least 50 answered questions and is not a validated probability of passing. Take the exam during your access period and submit official proof of failing within 14 days.

Full guarantee terms →

Related certifications

AWS Certified Advanced Networking - SpecialtyAWS Certified AI Business StrategistAWS Certified AI PractitionerAWS Certified CloudOps Engineer - AssociateAll AWS certifications →