Automate Delivery and Operations at Scale. Pass DOP-C02.
500 scenario-based practice questions covering SDLC automation, configuration management and IaC, resilience, monitoring and logging, incident response, and security automation. Mapped to the six domains of the official DOP-C02 exam guide.
No credit card required · Upgrade to 500 questions for $11.99
500 Exam-Style Questions
7-Day Money-Back Guarantee
Is this for you?
Your DOP-C02 exam is in the next 2–4 weeks
You've studied the concepts but aren't sure you'll pass
You want questions harder than the real exam
You want to understand why answers are correct, not just memorize
Not for you if:
You're looking for braindumps or exam leaks
You haven't started studying the concepts yet
The AWS Certified DevOps Engineer – Professional (DOP-C02) is a professional-level AWS certification. The exam has 75 questions, runs 180 minutes, costs $300, and requires a passing score of 750/1000. CertSharp provides 500 exam-style DOP-C02 practice questions — 30 free with no credit card — each with a detailed explanation.
Study guides teach concepts. We prepare you for the actual DOP-C02 exam.
1
Professional-level scenarios that combine CodePipeline, CloudFormation, Systems Manager, Organizations, and EventBridge in a single question
2
Every answer checked against current AWS documentation, with explanations that say why each distractor fails
3
Covers all six DOP-C02 domains, from deployment strategies to automated incident response
4
Multiple-response questions included, matching the format of the real exam
Free Sample Questions
DOP-C02 Practice Questions (Free Sample)
Real DOP-C02 exam-style questions from our 500-question AWS Certified DevOps Engineer – Professional bank, each with the correct answer and a detailed explanation.
Question 1 — DOP-C02
A web tier receives unpredictable traffic spikes that load the application, but CPU stays low because requests wait on a downstream queue. Which metric is the better scaling signal?
A
A custom metric such as backlog per instance or requests per target
B
Free disk space on the root volume reported by the CloudWatch agent
C
Average CPU utilization of the entire group measured over five-minute periods
D
Instance network card temperature reported through the host hardware sensors
Correct answer: A — Explanation
Scaling on a metric that reflects the real bottleneck, such as ALBRequestCountPerTarget or queue backlog per instance, adds capacity when it is needed. CPU stays low here, so it does not trigger scaling, and the other metrics are irrelevant.
Question 2Security and ComplianceEasy
What is envelope encryption?
A
Encrypting the network packet header with a key from the transit gateway
B
Encrypting data with a data key and encrypting that data key with a KMS key
C
Using the same KMS key to encrypt each object directly through the Encrypt API call
D
Encrypting data with a password that the application stores next to the object
Show answer & explanation
Correct answer: B — Encrypting data with a data key and encrypting that data key with a KMS key
Envelope encryption protects data with a data key, which is itself encrypted under a master key such as a KMS key. The other options describe unrelated or weaker practices.
Question 3Monitoring and LoggingEasy
How can log data in CloudWatch Logs be encrypted with a key that the security team controls?
A
Enable S3 server-side encryption on the log group itself through its storage class setting
B
Associate a customer managed KMS key with the log group and allow the Logs service in the key policy
C
Use a security group to encrypt traffic from the agent
D
Turn on EBS encryption for the instances that generate the logs and for their snapshots
Show answer & explanation
Correct answer: B — Associate a customer managed KMS key with the log group and allow the Logs service in the key policy
Log groups can use a KMS key for encryption at rest, and the key policy must allow CloudWatch Logs to use it. S3 and EBS encryption do not apply to log groups, and security groups do not encrypt data.
Question 4Configuration Management and IaCEasy
Which tool can lint and validate CloudFormation templates in a pipeline before deployment?
A
cfn-lint
B
AWS CloudShell
C
Amazon Detective
D
AWS Direct Connect
Show answer & explanation
Correct answer: A — cfn-lint
cfn-lint validates CloudFormation templates against the resource specification and best practices. CloudShell is a shell, Detective investigates findings, and Direct Connect is a network service.
Question 5Resilient Cloud SolutionsEasy
Which service caches frequently read database results in memory to reduce database load and latency?
A
Amazon Macie
B
AWS Backup
C
Amazon ElastiCache
D
AWS Config
Show answer & explanation
Correct answer: C — Amazon ElastiCache
ElastiCache provides in-memory caching for hot data, lowering database reads. Backup, Macie, and Config serve data protection, discovery, and compliance purposes.
Question 6SDLC AutomationEasy
Which statement describes a benefit of semantic versioning for build artifacts?
A
The version number encodes the exact time the build finished in a compressed format that tools can decode
B
The version number selects the instance type the artifact runs on
C
The version number guarantees that a release will be free of defects
D
The version number communicates the compatibility impact of changes between releases
Show answer & explanation
Correct answer: D — The version number communicates the compatibility impact of changes between releases
Semantic versioning uses major, minor, and patch numbers to signal breaking changes, features, and fixes. It does not encode build time, guarantee quality, or choose infrastructure.
Question 7Incident and Event ResponseMedium
A pipeline deployment of a CloudFormation stack fails with 'Template format error: unresolved resource dependencies'. What is the likely cause?
A
The IAM role used by the action has a trust policy attached to it
B
The artifact bucket is located in another Region than the pipeline
C
The stack name is longer than the name of the pipeline that deploys it
D
A Ref or GetAtt points to a logical ID that the template never defines
Show answer & explanation
Correct answer: D — A Ref or GetAtt points to a logical ID that the template never defines
This error means that a Ref or GetAtt points to an undefined logical ID. Stack name length, bucket Region, and trust policies produce different errors.
Question 8Security and ComplianceMedium
Which approach should be used so that a Lambda function can read a secret without storing credentials in its code?
A
Store the secret in a config file inside the deployment package that ships with the code
B
Grant the function's execution role permission to secretsmanager:GetSecretValue on that secret
C
Embed the secret in an environment variable in plain text in the function configuration
D
Share the secret in the function's description field for the team members
Show answer & explanation
Correct answer: B — Grant the function's execution role permission to secretsmanager:GetSecretValue on that secret
The execution role provides temporary credentials, and a scoped permission allows the function to fetch the secret at runtime. Plain text variables, packaged files, and descriptions expose the secret.
Question 9Monitoring and LoggingMedium
An operations team receives too many alerts when several related alarms fire together. Which feature reduces noise by alerting only when a combination of conditions is true?
A
Metric filters with a lower pattern threshold
B
Log group retention with a shorter period
C
Composite alarms that use AND and OR logic across other alarms
D
Subscription filters that stream matching log events to additional Kinesis destinations
Show answer & explanation
Correct answer: C — Composite alarms that use AND and OR logic across other alarms
Composite alarms evaluate the state of other alarms with Boolean rules, so notifications fire only for meaningful combinations. Metric filters, subscriptions, and retention do not reduce alert noise.
Question 10Configuration Management and IaCMedium
An automation Lambda function calls an AWS API that throttles under heavy use, causing sporadic failures. What should the engineer implement?
A
A second function that calls the same API simultaneously to double throughput
B
Exponential backoff with jitter, using the SDK retry configuration
C
A larger Lambda timeout so the function can wait out the throttle without retrying
D
A tight loop that retries the request immediately until it succeeds
Show answer & explanation
Correct answer: B — Exponential backoff with jitter, using the SDK retry configuration
Exponential backoff with jitter spreads retries and reduces throttling, and SDKs offer retry modes for this. Immediate retries and duplicate callers worsen throttling, and waiting without requests does nothing.
Want more DOP-C02 practice questions?
Take the free DOP-C02 practice test: 30 questions per session with instant explanations. Unlock all 500 questions plus timed exam mode for $11.99 one-time.
Everything you need to know about AWS Certified DevOps Engineer – Professional
What is the DOP-C02 exam?
DOP-C02 is the AWS Certified DevOps Engineer – Professional exam. It validates provisioning, operating, and managing distributed systems on AWS. The exam costs $300, has 75 questions in 180 minutes, and requires a scaled score of 750 out of 1000 to pass.
How many questions are on DOP-C02?
The DOP-C02 exam has 75 questions: 65 scored and 10 unscored. Questions are multiple choice or multiple response, and the time limit is 180 minutes.
What is the DOP-C02 passing score?
The DOP-C02 passing score is 750 on a scale of 100–1000, higher than the 720 required on most Associate exams. Scoring is compensatory, so you need to pass the exam overall rather than every domain.
What are the DOP-C02 exam domains?
DOP-C02 has six domains: SDLC Automation (22%), Configuration Management and IaC (17%), Resilient Cloud Solutions (15%), Monitoring and Logging (15%), Incident and Event Response (14%), and Security and Compliance (17%).
How hard is DOP-C02?
DOP-C02 is a Professional exam and much harder than the Associate exams. Questions are long, combine several services, and often have more than one workable answer, so you must pick the one that best meets the stated constraint, such as least operational overhead or fastest recovery.
Do I need an Associate certification before DOP-C02?
No. AWS has no formal prerequisites, but it recommends 2 or more years of experience provisioning, operating, and managing AWS environments, plus experience with the software development lifecycle and programming or scripting. Many candidates take Developer – Associate or CloudOps Engineer – Associate first.
Which AWS services are on DOP-C02?
Expect CodePipeline, CodeBuild, CodeDeploy, CloudFormation, AWS CDK, Systems Manager, AWS Config, Organizations, Control Tower, CloudWatch, EventBridge, Lambda, ECS, Auto Scaling, and Route 53, combined in scenario questions.
How long does it take to prepare for DOP-C02?
Plan for 8–12 weeks at 1–2 hours per day if you already work in DevOps on AWS. Practise building pipelines and CloudFormation stacks, and take full-length timed exams to build stamina for 180 minutes.
How much does the DOP-C02 exam cost?
The AWS Certified DevOps Engineer – Professional (DOP-C02) exam costs $300 USD plus applicable taxes, at a Pearson VUE test center or online with a remote proctor. The certification is valid for 3 years.
Is there a free DOP-C02 practice test?
Yes. CertSharp offers a free DOP-C02 practice test for the AWS DevOps Engineer – Professional exam: 30 questions per session with detailed explanations, no credit card required. The full 500-question DOP-C02 bank, including timed exam mode, is $11.99 one-time with lifetime access, or included in Pro.
Also on CertSharp
Related AWS Certification Practice Tests
Same 500-question depth, with 30 free questions per session.