Amazon Web Services · DOP-C02

DOP-C02 Exam: Complete AWS DevOps Engineer Guide

Current DOP-C02 exam guide covering the $300 USD fee, 180-minute format, 750 passing score, six domains, automation, operations, and preparation.

Last verified September 6, 2026

DOP-C02 exam at a glance

Facts last verified September 6, 2026

Domain breakdown

Who should take the DOP-C02 exam?

DOP-C02 is for experienced DevOps engineers, platform engineers, site reliability engineers, and cloud operations professionals who provision and operate distributed systems on AWS. It validates the ability to automate delivery, infrastructure, governance, security, observability, recovery, and incident response at production scale.

There is no formal certification prerequisite. In practice, candidates need broad Associate-level architecture, development, and operations knowledge plus substantial hands-on AWS experience. Expect scenarios with several valid-looking designs where requirements around blast radius, recovery, security, deployment risk, or operational effort determine the best answer.

The exam is not a test of one CI/CD product. It covers native AWS services, organizational controls, multi-account patterns, event-driven automation, infrastructure as code, and the feedback systems that keep delivery safe.

Skills measured on DOP-C02

The official DOP-C02 exam guide defines six domains. Learn the objectives as an operating system: a pipeline deploys infrastructure, security constrains it, monitoring validates it, and incident automation responds when it fails.

SDLC Automation (22%)

Design source, build, test, artifact, deployment, and release workflows using services such as CodePipeline, CodeBuild, CodeDeploy, ECR, CloudFormation, and Systems Manager, with external tools where required. Apply version control, review, reproducible builds, artifact integrity, approvals, and environment promotion.

Choose deployment strategies based on risk and recovery: rolling, immutable, blue/green, canary, linear, feature flags, and traffic shifting. Automate rollback using health signals rather than waiting for manual confirmation after broad impact. Separate application changes from database changes carefully to preserve compatibility.

Testing spans unit, integration, security, infrastructure, policy, and failure validation. Pipelines should stop unsafe releases, preserve evidence, notify owners, and avoid exposing secrets. Optimize parallelism and caching without weakening gates.

Configuration Management and Infrastructure as Code (17%)

Use CloudFormation, CDK or approved IaC tooling to create repeatable environments. Understand stack sets, change sets, nested stacks, modules, custom resources, drift, policies, rollback behavior, cross-account roles, and deployment across organizations and regions.

Configuration management may use Systems Manager documents, State Manager, Parameter Store, Automation, inventory, Patch Manager, or image pipelines. Prefer immutable replacement where it reduces drift, but know when controlled in-place configuration is appropriate.

Manage shared patterns through versioned templates and guardrails. Parameterize genuine differences without creating a universal template that is impossible to test. Detect and remediate configuration drift and retain an auditable change path.

Resilient Cloud Solutions (15%)

Implement availability across instances, Availability Zones, and regions according to business requirements. Use health checks, load balancing, Auto Scaling, queues, retries, circuit breakers, and graceful degradation. Design for service quotas and dependency failure rather than only normal load.

Recovery design connects backups, replication, failover, restore testing, RTO, and RPO. AWS Backup, Route 53, Global Accelerator, database replication, S3 replication, and infrastructure automation can contribute, but no single service creates a tested disaster-recovery plan.

Automate scale and recovery while controlling feedback loops. An aggressive retry policy can amplify an outage; an autoscaling policy based on the wrong metric can add cost without relieving a bottleneck.

Monitoring and Logging (15%)

Create an observability strategy across accounts and regions. CloudWatch collects metrics, logs, alarms, dashboards, and events; X-Ray supports distributed tracing; CloudTrail records API activity; Config tracks resource configuration and compliance. Centralize data with secure cross-account access and retention appropriate to operational and audit needs.

Define service-level indicators and alarms that reflect user outcomes. Combine infrastructure and application telemetry, control alarm noise, use anomaly detection where suitable, and route actionable events. Protect log integrity and prevent sensitive data from leaking into telemetry.

Use Logs Insights, metric filters, Contributor Insights, OpenSearch, Athena, or other suitable tools to analyze evidence. Observability is useful only when engineers can correlate a release, trace, resource, identity, and customer impact quickly.

Incident and Event Response (14%)

Build event-driven remediation with EventBridge, Lambda, Systems Manager Automation, Step Functions, SNS, incident tools, and approval boundaries. Low-risk, well-understood actions can be automatic; destructive or ambiguous actions may require human authorization.

Incident troubleshooting follows evidence: define impact, stabilize service, preserve forensic data, find the failing dependency, recover safely, and document learning. Runbooks should be versioned, tested, least privileged, idempotent, and usable when normal systems are impaired.

After an incident, improve alarms, tests, capacity, permissions, playbooks, and architecture. The exam favors mechanisms that prevent recurrence and reduce mean time to recovery over one-off console fixes.

Security and Compliance (17%)

Automate least privilege across AWS Organizations, organizational units, accounts, IAM roles, service control policies, permission boundaries, and resource policies. Centralize identity where appropriate and avoid long-lived credentials. Separate deployment authority from approval and production operation.

Protect data with KMS, Secrets Manager, Certificate Manager, encryption, rotation, secure networking, and controlled artifact stores. Detect threats and vulnerabilities with services such as GuardDuty, Inspector, Security Hub, Macie, and Detective, then route and remediate findings consistently.

Compliance automation may use Config rules, conformance packs, CloudTrail, Audit Manager, Control Tower, and policy-as-code gates. Preserve evidence and prevent unauthorized changes without blocking every delivery workflow.

How to prepare for DOP-C02

Build a multi-account delivery system in a sandbox. Deploy versioned infrastructure and an application through a cross-account pipeline, use federated roles, scan artifacts, canary the release, and roll it back from a CloudWatch alarm. Centralize logs and configuration evidence in a security account.

Add controlled failures: template drift, denied KMS access, an expired secret, exhausted capacity, regional dependency loss, a poison queue message, or missing telemetry. Use a runbook to diagnose and remediate each case, then add a preventative control.

Study with architecture diagrams and decision logs. For every official objective, explain the simplest design, the failure mode, the detection signal, and the recovery action. Use AWS practice questions to train pacing for long scenarios.

DOP-C02 practice questions

Professional-level practice should include organization structure, existing systems, policy limits, failure symptoms, and desired operating outcome. Eliminate answers that require manual fleet changes, per-account duplication, broad permanent access, or untested recovery when managed automation exists.

Use only objective-aligned questions. Dumps violate AWS rules and remove the reasoning context that the Professional exam is designed to assess.

DOP-C02 compared with Developer Associate

Developer – Associate focuses on building and deploying an application. DOP-C02 expands to platform- wide delivery, multi-account infrastructure, resilience, incident operations, and compliance. Passing DOP-C02 can renew eligible lower-level AWS certifications, including Developer – Associate, under the current AWS recertification policy.

Career value of DOP-C02

The certification aligns with senior DevOps, platform, SRE, and cloud operations roles. It is most credible when paired with evidence of reusable pipelines, controlled multi-account access, tested recovery, useful service-level metrics, and measurable operational improvement.

The badge cannot substitute for incident experience. Be ready to discuss tradeoffs, failure modes, rollback decisions, and how your automation reduced lead time or risk.

Exam-day notes

• You have 180 minutes for 75 questions.
• Sixty-five questions are scored and 10 are unidentified unscored items.
• The US fee is $300 before tax and regional adjustments.
• The minimum scaled score is 750.
• Read the final constraint before evaluating long answer choices.

Prep resources

← More Amazon Web Services exams