AWS DOP-C02: DevOps Engineer Professional Practice Exam

What the AWS DOP-C02 exam covers

• SDLC Automation113 questions
• Configuration Management and IaC101 questions
• Resilient Cloud Solutions95 questions
• Monitoring and Logging106 questions
• Incident and Event Response93 questions
• Security and Compliance141 questions

Free AWS DOP-C02 practice test questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 649.

1. Question 1SDLC Automation

   Which AWS service orchestrates the stages (source, build, test, deploy) of a CI/CD pipeline?

   • AAWS KMS
   • BAWS CodePipelineCorrect
   • CAmazon Route 53
   • DAmazon S3
   ✓ Correct answer: B

   AWS CodePipeline is the orchestration service that coordinates the stages of a CI/CD pipeline, including source, build, test, and deploy stages. It automates the flow of code changes through multiple stages, triggering each stage when the previous one completes. CodePipeline acts as the central hub that ties together various AWS developer tools and services to create a complete deployment automation workflow. By orchestrating these stages, it enables teams to implement continuous integration and continuous deployment practices efficiently.

   Why the other options are wrong

   • AAWS KMS is incorrect because AWS KMS is a key management service for encryption, not a CI/CD orchestration service.
   • CAmazon Route 53 is incorrect because Amazon Route 53 is a DNS service, not related to the functionality described in the question.
   • DAmazon S3 is incorrect because this option does not address the core requirement or uses an incorrect service/approach for the scenario.
2. Question 2Configuration Management and IaC

   You want a CloudFormation stack to publish a custom CloudWatch alarm and a log group as part of the infrastructure it provisions. Which is the correct approach?

   • ADeclare AWS::CloudWatch::Alarm and AWS::Logs::LogGroup resources in the templateCorrect
   • BUse AWS Config to create the alarm
   • CUse a Route 53 record set to define the alarm
   • DManually create the alarm in the console after the stack deploys, every time
   ✓ Correct answer: A

   Alarms and log groups are ordinary CloudFormation resource types, so declaring AWS::CloudWatch::Alarm and AWS::Logs::LogGroup puts the observability for a stack in the same template as the thing being observed. They are then created, updated and deleted with it - which is what stops orphaned alarms accumulating after the resource they watched is gone.

   Why the other options are wrong

   • BUse AWS Config to create the alarm is incorrect because it does not provide the correct functionality.
   • CUse a Route 53 record set to define the alarm is incorrect because it does not provide the correct functionality.
   • DManually create the alarm in the console after the stack deploys, every time is incorrect because it does not provide the correct functionality.
3. Question 3Monitoring and Logging

   X-Ray traces for a busy service appear incomplete and some requests are missing. The team expected every request to be traced. What is the most likely reason?

   • AX-Ray retains traces for only 60 seconds before they expire and disappear
   • BX-Ray requires its daemon on every host and silently drops all traces when the daemon is absent
   • CX-Ray caps traces at a fixed 1,000 per minute per account and discards the rest
   • DX-Ray samples by default (a reservoir plus a percentage), so not all requests are traced; adjust the ruleCorrect
   ✓ Correct answer: D

   AWS X-Ray uses sampling to manage trace volume and cost in high-traffic environments. By default, X-Ray samples traces using a reservoir (a fixed number of traces per second, e.g., 1) plus a percentage of remaining requests (e.g., 5%). This means that in busy services, many requests will not be traced. The default sampling rule aims for a balance between cost and visibility. To capture more requests, you increase the reservoir (minimum traces guaranteed per second) and raise the percentage. Some requests may still not be traced in very high-volume scenarios, but adjusting the sampling rule directly controls the capture rate.

   Why the other options are wrong

   • AX-Ray retains traces for weeks, not 60 seconds, so retention is not why requests are missing.
   • BA missing daemon would drop most or all traces uniformly, not produce the partial sampling seen here.
   • CX-Ray does not enforce a flat 1,000-per-minute cap; incompleteness comes from configurable sampling rules.
4. Question 4Security and Compliance

   To let an external GitHub Actions workflow assume an AWS role via OIDC, which CLI command registers GitHub as an identity provider?

   • Aaws iam create-saml-provider --name github --saml-metadata-document file://meta.xml --tags Key=Purpose,Value=github-oidc
   • Baws iam update-assume-role-policy --role-name github --policy-document file://github-oidc-trust.json --url https://token.actions.githubusercontent.com
   • Caws sts assume-role-with-web-identity --provider-url https://token.actions.githubusercontent.com --role-arn <role-arn> --role-session-name gha
   • Daws iam create-open-id-connect-provider --url https://token.actions.githubusercontent.com --client-id-list sts.amazonaws.com --thumbprint-list <thumbprint>Correct
   ✓ Correct answer: D

   [Vendor-style explanation: This is a single question from the aws-dop exam. A comprehensive explanation has been prepared emphasizing the technical reasoning behind the correct choice(s) and why incorrect options do not meet the stated requirements.]

   Why the other options are wrong

   • Acreate-saml-provider registers a SAML 2.0 identity provider, not the OIDC provider GitHub Actions uses.
   • Bupdate-assume-role-policy edits a role's trust policy and does not register an identity provider.
   • Cassume-role-with-web-identity exchanges a token for credentials but does not register the OIDC provider first.
5. Question 5Resilient Cloud Solutions

   During a blue/green CodeDeploy deployment to EC2, the new (green) fleet passes the deployment but users still hit the old version. Traffic was never rerouted because the deployment used a manual reroute setting. How do you complete the cutover safely?

   • ARecreate the load balancer listener so it forwards traffic to the green target group
   • BDeregister the blue instances from the target group so only green remains
   • CManually reroute traffic to the replacement instances, then terminate the original after validationCorrect
   • DRoll back the CodeDeploy deployment so the pipeline redeploys the green fleet
   ✓ Correct answer: C

   [Vendor-style explanation: This is a single question from the aws-dop exam. A comprehensive explanation has been prepared emphasizing the technical reasoning behind the correct choice(s) and why incorrect options do not meet the stated requirements.]

   Why the other options are wrong

   • ARecreating the listener bypasses the CodeDeploy reroute step and can disrupt traffic instead of completing the cutover.
   • BDeregistering blue directly circumvents CodeDeploy's controlled traffic shift and skips validation of green.
   • DRolling back the deployment discards the healthy green fleet instead of finishing the intended cutover to it.
6. Question 6SDLC Automation

   A CodeBuild project intermittently fails to pull its base image from Docker Hub with 'toomanyrequests: rate limit'. The build image is a public Docker Hub image. What is the most durable fix?

   • AIncrease the CodeBuild compute type so pulls are throttled less by Docker Hub
   • BPull the image through an ECR repository (e.g.Correct
   • CAdd a retry loop in the buildspec that re-pulls the image until it succeeds
   • DMove the CodeBuild project to a Region with a different Docker Hub edge
   ✓ Correct answer: B

   Docker Hub enforces pull rate limits on anonymous/free pulls, which CodeBuild can hit. Using an ECR pull-through cache rule mirrors the upstream image into your ECR registry, so builds pull from ECR within AWS, eliminating the rate-limit failures durably and improving pull performance.

   Why the other options are wrong

   • AA larger compute type gives more CPU and RAM but does not change the shared Docker Hub anonymous pull rate limit.
   • CRetrying the pull still competes for the same rate-limited quota and does not durably eliminate the throttling.
   • DDocker Hub rate limits are keyed to source IP reputation, so a different Region does not reliably avoid the limit.
7. Question 7Configuration Management and IaC

   A CloudFormation stack contains an RDS instance and an EC2 Auto Scaling group with no direct reference between them. During an update that modifies the RDS engine version, the team wants the EC2 layer to wait until the database update completes before its own update proceeds. Which CloudFormation construct enforces this ordering?

   • AA DependsOn attribute on the Auto Scaling group referencing the RDS resourceCorrect
   • BAn Fn::GetAtt call from the RDS resource to the Auto Scaling group
   • CA Condition that disables the Auto Scaling group during updates
   • DSetting UpdateReplacePolicy to Snapshot on the Auto Scaling group
   ✓ Correct answer: A

   CloudFormation normally infers ordering from references, but when no direct reference exists you add an explicit DependsOn so the Auto Scaling group is processed only after the RDS resource finishes its operation. This guarantees the database update completes before the EC2 layer is touched.

   Why the other options are wrong

   • BFn::GetAtt retrieves an attribute value; it does not impose update ordering, and you would reference RDS attributes from the ASG, not the reverse.
   • CA Condition controls whether a resource is created at all, not the sequencing of updates between resources.
   • DUpdateReplacePolicy Snapshot only affects what happens when a resource is replaced; it does not control cross-resource update ordering.
8. Question 8Resilient Cloud Solutions

   A DevOps team wants new Auto Scaling instances to be added to an Elastic Load Balancing target group only after a custom bootstrap script has completed, and to delay termination so in-flight work can drain. Which Auto Scaling capability provides these pause points?

   • ALifecycle hooksCorrect
   • BInstance warm-up on a target-tracking policy
   • CScheduled scaling actions
   • DTermination policies
   ✓ Correct answer: A

   Lifecycle hooks put a launching instance into a wait state until you signal CONTINUE (or the timeout elapses), giving bootstrap scripts time to finish, and likewise pause termination so connections can drain or data can be saved.

   Why the other options are wrong

   • BWarm-up only delays metric contribution to scaling; it does not gate registration on a custom script or pause termination.
   • CScheduled actions change capacity at fixed times and have no per-instance pause behavior.
   • DTermination policies choose which instance to remove, not whether to pause for draining or bootstrap completion.
9. Question 9Incident and Event Response

   After an incident, a DevOps engineer wants to quickly query months of CloudTrail logs stored in S3 to find all actions taken by a specific IAM role, without provisioning servers. Which service is best suited?

   • AAmazon AthenaCorrect
   • BAmazon EMR with a persistent cluster
   • CAmazon Redshift provisioned cluster
   • DAWS Glue crawler only
   ✓ Correct answer: A

   Athena is serverless and queries data in place in S3 using standard SQL, making it ideal for ad hoc forensic searches of CloudTrail logs across long time ranges without managing infrastructure. You pay only for data scanned per query.

   Why the other options are wrong

   • BA persistent EMR cluster requires provisioning and ongoing cost, the opposite of serverless ad hoc querying.
   • CA Redshift provisioned cluster requires loading data and managing nodes, more overhead than needed.
   • DA Glue crawler only catalogs schema; it does not run the analytical queries by itself.
10. Question 10Security and Compliance

    An auditor needs continuous, automated evidence that the organization's controls map to PCI DSS, including which AWS resources are in scope and their compliance status over time. Which service is purpose-built for this?

    • AAWS Audit Manager with the PCI DSS prebuilt frameworkCorrect
    • BAWS Config conformance pack for PCI DSS
    • CAWS Security Hub PCI DSS standard
    • DAWS Trusted Advisor with the security category checks
    ✓ Correct answer: A

    Audit Manager provides prebuilt frameworks (including PCI DSS), automatically gathers evidence from sources such as CloudTrail, Config, and Security Hub, and produces assessment reports that map controls to requirements over time, reducing manual audit effort.

    Why the other options are wrong

    • BA conformance pack reports rule compliance but does not assemble the control mappings and audit-ready evidence collection Audit Manager provides.
    • CThe Security Hub PCI DSS standard scores control checks but is not purpose-built to collect and organize evidence for an audit framework.
    • DTrusted Advisor gives best-practice checks and does not map resources to a PCI DSS framework or produce audit evidence over time.

Who this AWS DOP-C02 practice exam is for

This practice set is for anyone preparing for the AWS DOP-C02: DevOps Engineer Professional exam at the advanced level - from first-time candidates building a foundation to experienced AWS practitioners doing a final review before test day. If you learn best by working through realistic questions and reading why each answer is right or wrong, it is built for you.

How to use this AWS DOP-C02 practice exam

1. Start with the free sample questions above to gauge your current baseline.
2. Read the full explanation on every question, including why each wrong option is wrong.
3. Track your weak domains and focus your study where you are losing the most marks.
4. Once you are scoring consistently well, take a timed, full-length mock exam.
5. Use your readiness score to decide when you are ready to book the real AWS DOP-C02 exam.

Related AWS resources

• AWS DOP-C02 study guideKey concepts
• AWS practice examsAll AWS
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• How these questions are written and reviewedMethodology
• Report a problem with a questionCorrections
• AWS DVA-C02 practice examRelated
• AWS MLA-C02 practice examRelated
• AWS SAA-C03 practice examRelated

AWS DOP-C02 practice exam FAQ