AWS Certified DevOps Engineer - Professional DOP-C02

By Amazon · Browse Mode
About the Exam

This professional-level AWS certification validates technical expertise in provisioning, operating, and managing distributed application systems and services on AWS. It is intended for DevOps engineers with 2 or more years of experience, along with experience in the software development lifecycle and programming or scripting. Passing demonstrates ability to implement continuous delivery, automate security and compliance controls, deploy monitoring and logging, and build highly available, scalable, self-healing systems.

Exam Topics

  • SDLC Automation22%
  • Configuration Management and IaC17%
  • Resilient Cloud Solutions15%
  • Monitoring and Logging15%
  • Incident and Event Response14%
  • Security and Compliance17%

How to Use This Practice Exam

  1. Browse — Read each question, select your answer, and reveal the explanation.
  2. Exam Mode — Simulate real exam conditions with a timed session and score report.
  3. Learn Mode — Spaced repetition schedules questions you struggle with for long-term retention.

Download the Full Exam PDF

Get every question and answer in a clean, printable PDF built for offline study. Purchase once, keep permanent access, and re-download the latest version anytime.

Get PDF
Learn More

Last updated July 12, 2026 at 11:07 AM

Topic filter
Retired questions
Question sort
Questions per page

QuestionQ1

Security and Compliance

A company uses an AWS Organizations organization to manage its 500 AWS accounts. All features are enabled in the organization, and the AWS accounts reside in a single OU. Developers must use the CostCenter tag key for every resource in the organization's member accounts. Some teams do not use the CostCenter tag key when tagging their Amazon EC2 instances.

The cloud team created a script that scans all EC2 instances in the organization's member accounts. When an EC2 instance lacks a CostCenter tag key, the script notifies the AWS account administrators. To prevent receiving this notification, some developers apply the CostCenter tag key with an arbitrary string as its tag value.

The cloud team must ensure that every EC2 instance in the organization uses a CostCenter tag key with the correct cost center value.

Which solution meets these requirements?

Explanation

An SCP can deny EC2 launch requests that omit the required CostCenter tag, while an AWS Organizations tag policy defines the approved values for that tag on EC2 resources. Scanning tag keys and values and remediating noncompliant existing instances addresses resources that predate the controls or have invalid values. AWS Organizations tag policies support allowed tag values and enforcement for supported EC2 resource types.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!

QuestionQ2

SDLC Automation

A company uses a series of separate Amazon CloudFormation templates to deploy its multi-Region applications. The templates must be deployed in a particular order. The company is making more template changes than it previously anticipated and wants to deploy new templates more efficiently. In addition, the data engineering team must receive notification of every template change.

What should the company do to meet these goals?

Explanation

CloudFormation nested stacks place related templates under a parent stack, so CloudFormation manages dependent stack updates as part of the parent deployment. CloudFormation StackSets provide centralized deployment of stacks across AWS Regions. Amazon SNS can receive CloudFormation stack-event notifications for the data engineering team. Drift detection identifies differences between deployed resources and their expected configuration; it is not a template-change notification mechanism.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!

QuestionQ3

Security and Compliance

A company’s security team mandates that every external Application Load Balancer (ALB) and Amazon API Gateway API be associated with an AWS WAF web ACL. The company has hundreds of AWS accounts, all contained in one AWS Organizations organization. The company has enabled AWS Config for the organization. During an audit, the company discovers that some internet-facing ALBs have no associated AWS WAF web ACLs.

Which combination of actions should a DevOps engineer take to prevent future violations?

Choose two
Explanation

AWS Firewall Manager centrally applies AWS WAF policies across AWS Organizations accounts. A delegated Firewall Manager administrator can manage the organization-wide policy, and an AWS WAF Firewall Manager policy with automatic remediation creates and associates managed web ACLs for in-scope ALBs and API Gateway APIs that lack them. AWS Config supplies compliance monitoring but its managed rules do not themselves attach web ACLs; GuardDuty is unrelated to web ACL enforcement.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!

QuestionQ4

Monitoring and Logging

A company uses a continuous integration pipeline in which it builds container images with AWS CodeBuild. The generated images are stored in Amazon Elastic Container Registry (Amazon ECR).

Reviewing and remediating image vulnerabilities is taking the company too long. The company needs to rapidly identify image vulnerabilities and notify the security team about them.

Which combination of steps meets these requirements with the LEAST operational overhead?

Choose two
Explanation

Amazon ECR enhanced scanning integrates with Amazon Inspector to provide automated continuous scanning of container images. Amazon Inspector emits EventBridge events when image scan findings are created, updated, or closed. An EventBridge rule targeting an Amazon SNS topic can therefore notify the security team without maintaining custom Lambda code. Basic scanning supports only manual or scan-on-push frequencies, not continuous scanning.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!

QuestionQ5

Resilient Cloud Solutions

A DevOps engineer manages a Java-based application running in an Amazon Elastic Container Service (Amazon ECS) cluster on AWS Fargate. Auto scaling is not configured for the application.

The DevOps engineer has identified the Java Virtual Machine (JVM) thread count as a good indicator for when the application should scale. The application serves customer traffic on port 8080 and exposes JVM metrics on port 9404.

Application usage has recently increased. The DevOps engineer must configure auto scaling for the application.

Which solution meets these requirements with the LEAST operational overhead?

Choose two
Explanation

Amazon ECS Service Auto Scaling uses CloudWatch metrics. JVM thread count can be collected by the CloudWatch agent and used either with CloudWatch alarms and a step scaling policy or as a custom CloudWatch metric for a target tracking policy. Target tracking automatically creates and manages the associated CloudWatch alarms. Amazon Managed Service for Prometheus is a Prometheus-compatible metrics store and query service; its metrics and rules are not direct ECS Application Auto Scaling metric targets. ECS service auto scaling, Application Auto Scaling target tracking, CloudWatch JVM metrics

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!
Know a question that should be here? Contribute to this exam
Back home