AWS DOP-C02: DevOps Engineer Professional Practice Exam

What the AWS DOP-C02 exam covers

• SDLC Automation108 questions
• Configuration Management and IaC97 questions
• Resilient Cloud Solutions92 questions
• Monitoring and Logging102 questions
• Incident and Event Response89 questions
• Security and Compliance136 questions

Free AWS DOP-C02 sample questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 624.

1. Question 1SDLC Automation

   Which AWS service orchestrates the stages (source, build, test, deploy) of a CI/CD pipeline?

   • AAWS KMS
   • BAWS CodePipelineCorrect
   • CAmazon Route 53
   • DAmazon S3
   ✓ Correct answer: B

   AWS CodePipeline is the orchestration service that coordinates the stages of a CI/CD pipeline, including source, build, test, and deploy stages. It automates the flow of code changes through multiple stages, triggering each stage when the previous one completes. CodePipeline acts as the central hub that ties together various AWS developer tools and services to create a complete deployment automation workflow. By orchestrating these stages, it enables teams to implement continuous integration and continuous deployment practices efficiently.

   Why the other options are wrong

   • AAWS KMS is incorrect because AWS KMS is a key management service for encryption, not a CI/CD orchestration service.
   • CAmazon Route 53 is incorrect because Amazon Route 53 is a DNS service, not related to the functionality described in the question.
   • DAmazon S3 is incorrect because this option does not address the core requirement or uses an incorrect service/approach for the scenario.
2. Question 2Configuration Management and IaC

   An SSM Run Command targeting 1,000 instances must avoid overwhelming a downstream API and stop if too many fail. Which Run Command settings accomplish this?

   • ASet concurrency (max concurrency) to throttle simultaneous executions and an error threshold (max errors) to abort on excessive failuresCorrect
   • BConfigure a rate control association in State Manager and rely on its default unlimited concurrency
   • CRaise the command's Timeout value so slow instances finish before the downstream API is hit
   • DSplit the fleet into ten separate send-command calls issued back to back with no thresholds
   ✓ Correct answer: A

   This is the correct answer based on AWS best practices.

   Why the other options are wrong

   • BA State Manager association schedules recurring runs and default unlimited concurrency would still overwhelm the downstream API.
   • CTimeout controls how long a single execution may run, not how many run at once or when to abort on failures.
   • DManually splitting into batches with no error thresholds does not stop the run when too many instances fail.
3. Question 3Monitoring and Logging

   An alarm currently fires constantly because a metric is briefly noisy, causing alert fatigue. The team still wants to catch sustained problems quickly. Which alarm design tradeoff is best?

   • AShorten the alarm period to a single datapoint so it reacts to every blip
   • BWiden the metric period to one hour so brief spikes are averaged away entirely
   • CAlarm on the metric's Maximum statistic over a one-minute period
   • DRequire M out of N datapoints to breach over an evaluation window to filter transient spikesCorrect
   ✓ Correct answer: D

   This is the correct answer based on AWS best practices.

   Why the other options are wrong

   • AReacting to every datapoint increases false alarms and worsens the alert fatigue the team wants to reduce.
   • BAveraging over a full hour hides sustained problems and delays detection, missing the requirement to catch them quickly.
   • CAlarming on one-minute Maximum makes the alarm more sensitive to brief spikes, aggravating the noise problem.
4. Question 4Security and Compliance

   Which AWS CLI command retrieves the plaintext value of a secret stored in AWS Secrets Manager?

   • Aaws secretsmanager read-secret --name prod/db/master
   • Baws secretsmanager get-secret-value --secret-id prod/db/masterCorrect
   • Caws secrets get --id prod/db/master
   • Daws ssm get-secret-value --secret-id prod/db/master
   ✓ Correct answer: B

   [Vendor-style explanation: This is a single question from the aws-dop exam. A comprehensive explanation has been prepared emphasizing the technical reasoning behind the correct choice(s) and why incorrect options do not meet the stated requirements.]

   Why the other options are wrong

   • Aaws secretsmanager read-secret --name prod/db/master is incorrect because it does not properly address the scenario requirements.
   • Caws secrets get --id prod/db/master is incorrect because it does not properly address the scenario requirements.
   • Daws ssm get-secret-value --secret-id prod/db/master is incorrect because it does not properly address the scenario requirements.
5. Question 5SDLC AutomationSelect all that apply

   A CodePipeline deploy stage to CloudFormation fails with 'User is not authorized to perform iam:CreateRole'. The template creates an IAM role for the app. Which TWO changes correctly resolve this while following least privilege? (Choose TWO)

   • APass a CloudFormation service role to the deploy action that has the needed iam:* and CAPABILITY permissionsCorrect
   • BRemove the IAM role from the template and create it by hand in the console
   • CGive the pipeline the AWS managed AdministratorAccess policy and remove all conditions
   • DAcknowledge the required capability (CAPABILITY_NAMED_IAM/CAPABILITY_IAM) on the CloudFormation actionCorrect
   ✓ Correct answer: A, D

   When a CloudFormation template creates IAM resources, two conditions must be met for the deployment to succeed. First, the CloudFormation service role must have the iam:CreateRole (and related iam:*) permissions to actually create the IAM resources defined in the template. This service role is separate from the pipeline role and follows the principle of least privilege by granting IAM permissions only to CloudFormation. Second, the CAPABILITY_NAMED_IAM or CAPABILITY_IAM capability must be explicitly acknowledged on the CloudFormation action, which is AWS's safeguard requiring explicit consent before creating IAM resources that could escalate privileges. Without both the service role permissions and the capability acknowledgement, the deployment will fail.

   Why the other options are wrong

   • BRemove the IAM role from the template and create it by hand in the console is incorrect because manually creating resources outside of Infrastructure as Code defeats the purpose of automated, repeatable deployments and introduces configuration drift between environments.
   • CGive the pipeline the AWS managed AdministratorAccess policy and remove all conditions is incorrect because granting AdministratorAccess violates the principle of least privilege, creates an excessive blast radius if the pipeline credentials are compromised, and is not the proper way to resolve IAM capability issues.
6. Question 6SDLC Automation

   A CodePipeline must wait for an external approval recorded in a separate ticketing system before continuing, and the pipeline should resume automatically once approval is granted (no human clicking Approve in the console). Which approach implements this?

   • AA Manual Approval action in CodePipeline
   • BA Lambda invoke action that polls the ticketing system and calls PutJobSuccessResult/PutJobFailureResultCorrect
   • CA CodeBuild action running a buildspec that loops until the ticket status closes
   • DAn SNS notification rule that publishes to the ticketing system on stage entry
   ✓ Correct answer: B

   CodePipeline supports custom Lambda actions that call PutJobSuccessResult or PutJobFailureResult (and can use continuation tokens to poll). The Lambda queries the ticketing system; once the ticket shows approval, it signals success and the pipeline continues without any console interaction.

   Why the other options are wrong

   • AA Manual Approval action requires a human to click Approve in the console, which the requirement explicitly forbids.
   • CA CodeBuild action that loops wastes build minutes, risks timing out, and is not the native polling pattern for pipeline resumption.
   • DAn SNS notification only sends a message outbound and cannot poll the ticket or signal the pipeline to resume.
7. Question 7Configuration Management and IaC

   A team manages thousands of EC2 instances and wants to define a desired state (a specific SSM Agent version and a set of installed packages) that Systems Manager re-applies automatically on a schedule and reports compliance for. Which feature provides this declarative, recurring enforcement?

   • AState Manager associationsCorrect
   • BAutomation runbooks triggered manually
   • CDistributor one-time package installs
   • DMaintenance Windows running Run Command once
   ✓ Correct answer: A

   State Manager binds an SSM document to targets on a schedule, continuously bringing instances to the defined desired state and recording association compliance. This is the SSM feature for ongoing, declarative configuration enforcement across a fleet.

   Why the other options are wrong

   • BManually triggered Automation runbooks are one-off operational workflows, not scheduled desired-state enforcement.
   • CDistributor packages and distributes software but does not provide recurring desired-state enforcement and compliance on its own.
   • DA Maintenance Window running Run Command once executes ad hoc; it lacks the continuous desired-state convergence of associations.
8. Question 8Resilient Cloud Solutions

   A regional API must achieve an aggressive RTO by failing over to a passive copy in another Region automatically based on health, and clients should be transparently directed to whichever Region is healthy. Which Route 53 configuration best supports this?

   • AFailover routing policy with health checks on primary and secondary record setsCorrect
   • BWeighted routing policy split 50/50 between Regions
   • CMultivalue answer routing without health checks
   • DSimple routing policy pointing at the primary Region only
   ✓ Correct answer: A

   Route 53 failover routing designates a primary and a secondary record set, each tied to a health check. When the primary's health check fails, Route 53 automatically returns the secondary's value, transparently redirecting clients to the healthy Region. This is the purpose-built DNS pattern for active/passive cross-Region failover.

   Why the other options are wrong

   • BWeighted 50/50 routing actively sends traffic to both Regions rather than failing over only when one is unhealthy.
   • CMultivalue answer routing returns multiple healthy records for load distribution, not deterministic primary/secondary failover, and without health checks it cannot detect failure.
   • DSimple routing has no health awareness and cannot redirect away from a failed primary.
9. Question 9Monitoring and Logging

   An Auto Scaling group scales out frequently, but the team suspects a memory leak rather than CPU pressure. Default EC2 metrics do not include memory. What is the most operationally efficient way to alarm on memory usage across the fleet?

   • AInstall the CloudWatch agent to publish mem_used_percent and alarm on that metricCorrect
   • BParse the EC2 console memory graph manually each hour
   • CEnable detailed monitoring to expose the memory metric
   • DUse VPC Flow Logs to infer memory pressure from network behavior
   ✓ Correct answer: A

   Memory and disk are guest-OS metrics the hypervisor cannot see, so they are not in default EC2 metrics. The CloudWatch agent collects mem_used_percent (and disk metrics) and publishes them as custom CloudWatch metrics, enabling fleet-wide alarms on memory utilization.

   Why the other options are wrong

   • BThe EC2 console does not provide guest memory graphs, and manual review does not scale or alert.
   • CDetailed monitoring only increases the frequency of existing hypervisor-level metrics; it never adds memory.
   • DVPC Flow Logs report network flows and cannot measure host memory.
10. Question 10Security and Compliance

    A DevOps engineer must give a CodeBuild project least-privilege access to pull a single secret at build time. Which IAM policy statement on the build service role is most appropriate?

    • AAllow secretsmanager:GetSecretValue on every secret in the account so the build can read what it needs
    • BAllow secretsmanager:GetSecretValue on the specific secret ARN, and kms:Decrypt on the key that encrypts itCorrect
    • CAllow secretsmanager:GetSecretValue and secretsmanager:PutSecretValue on the specific secret ARN
    • DAllow secretsmanager:GetSecretValue on the secret ARN and kms:* on the encrypting key
    ✓ Correct answer: B

    Least privilege means allowing only the exact action (GetSecretValue) on the specific secret ARN. Because Secrets Manager values are encrypted with KMS, the role also needs kms:Decrypt on that key for the retrieval to succeed.

    Why the other options are wrong

    • AGranting read on every secret is far broader than least privilege, which requires scoping to the single secret.
    • CAdding PutSecretValue grants write access the build does not need, violating least privilege for a read-only pull.
    • DGranting kms:* on the key is overly permissive; only kms:Decrypt is needed to read the secret.

Related AWS resources

• AWS DOP-C02 study guideKey concepts
• AWS practice examsAll AWS
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• AWS SCS-C03 practice examRelated
• AWS Certified AI Practitioner (AIF-C01) practice examRelated
• AWS CLF-C02 practice examRelated

AWS DOP-C02 practice exam FAQ