AWS DevOps Professional Exam Guide (DOP-C02)
Master the AWS DevOps Professional certification with this advanced study guide covering CI/CD pipelines, infrastructure as code, configuration management, monitoring and logging, incident response, and compliance automation. This guide distills the six exam domains into actionable study material with real-world architecture patterns, CLI-driven lab exercises, and practice questions designed to mirror the difficulty of the actual exam. Whether you are an experienced AWS practitioner looking to validate your DevOps skills or a solutions architect expanding into automation, this guide provides the structured path to certification success.
Key Features
- Domain-aligned content covering all six DOP-C02 exam objectives with weighted study priorities
- CI/CD pipeline patterns using CodePipeline, CodeBuild, CodeDeploy, and CodeCommit with branching strategies
- Infrastructure as Code deep dives into CloudFormation, CDK, and Service Catalog portfolio management
- Monitoring and observability architectures with CloudWatch, X-Ray, and EventBridge alarm strategies
- Incident response runbooks covering automated remediation with Systems Manager and Lambda
- Configuration management patterns using SSM Parameter Store, Secrets Manager, and AppConfig
- Multi-account governance with AWS Organizations, Control Tower, and SCPs for compliance
- Deployment strategies including blue/green, canary, rolling, and immutable infrastructure patterns
Study Plan
Week 1-2: SDLC Automation (22% of exam)
- CodePipeline multi-stage pipelines with manual approval gates
- CodeBuild buildspec patterns and custom build environments
- CodeDeploy deployment configurations for EC2, ECS, and Lambda
- Artifact management with S3 and CodeArtifact
Week 3-4: Configuration Management and IaC (17% of exam)
- CloudFormation advanced features: nested stacks, custom resources, drift detection
- CDK constructs and synthesized template management
- SSM State Manager, Automation documents, and patch baselines
- AMI baking pipelines with EC2 Image Builder
Week 5-6: Resilient Cloud Solutions (15% of exam)
- Multi-region failover with Route 53 health checks
- Auto Scaling policies: target tracking, step, and predictive
- Data replication strategies across regions and accounts
- Disaster recovery patterns: pilot light, warm standby, active-active
Week 7-8: Monitoring and Logging (15% of exam)
- CloudWatch custom metrics, metric math, and anomaly detection
- Centralized logging with CloudWatch Logs, Kinesis Data Firehose, and OpenSearch
- X-Ray tracing for distributed microservices
- EventBridge rules for operational event routing
Week 9-10: Incident and Event Response (14% of exam)
- Automated remediation with Config Rules and SSM Automation
- GuardDuty findings and automated response patterns
- Incident Manager escalation plans and response plans
- Root cause analysis workflows
Week 11-12: Security and Compliance (17% of exam)
- IAM policies, permission boundaries, and cross-account roles
- Secrets rotation with Secrets Manager and Lambda
- Encryption strategies: KMS key policies, envelope encryption
- Audit trails with CloudTrail, Config, and Access Analyzer
Key Topics
| Domain | Weight | Core Services |
|---|---|---|
| SDLC Automation | 22% | CodePipeline, CodeBuild, CodeDeploy, CodeCommit |
| Configuration Management & IaC | 17% | CloudFormation, CDK, SSM, AppConfig |
| Resilient Cloud Solutions | 15% | Route 53, Auto Scaling, ELB, RDS Multi-AZ |
| Monitoring and Logging | 15% | CloudWatch, X-Ray, OpenSearch, Kinesis |
| Incident and Event Response | 14% | EventBridge, Systems Manager, GuardDuty |
| Security and Compliance | 17% | IAM, KMS, Secrets Manager, Config |
Practice Questions
Q1: A company runs a containerized application on Amazon ECS with a CodePipeline for deployments. They need to implement a deployment strategy that shifts 10% of traffic to the new version, monitors CloudWatch alarms for 5 minutes, then completes the rollout. Which approach should they use?
A1: Configure CodeDeploy with an ECS blue/green deployment using a CodeDeployDefault.ECSCanary10Percent5Minutes deployment configuration. Define the CloudWatch alarms in the deployment group to trigger automatic rollback if error thresholds are breached.
Q2: An operations team needs to ensure all EC2 instances across 15 accounts have the latest SSM Agent and comply with a custom patch baseline. Non-compliant instances must be automatically remediated. What solution requires the least operational overhead?
A2: Use AWS Systems Manager Quick Setup with an organization-wide targeting strategy. Configure a patch baseline with auto-approval rules and a maintenance window. Set up SSM State Manager associations to enforce compliance, and use Config Rules with SSM Automation remediation for non-compliant resources.
Q3: A development team uses CloudFormation to deploy a three-tier application. They need to update the RDS instance class from db.r5.large to db.r5.xlarge with minimal downtime. What should the DevOps engineer verify before updating the stack?
A3: Check the CloudFormation resource documentation for the AWS::RDS::DBInstance update behavior. Changing the DBInstanceClass property causes a replacement if the instance is not Multi-AZ, or a brief failover if Multi-AZ is enabled. The engineer should verify Multi-AZ is enabled, take a snapshot, and set the stack update policy to retain the snapshot on replacement.
Q4: A company needs to aggregate CloudTrail logs from all accounts in an AWS Organization into a central security account. What is the most operationally efficient approach?
A4: Create an organization trail from the management account with the --is-organization-trail flag, directing logs to an S3 bucket in the security account. Apply a bucket policy granting the CloudTrail service principal access from all organization accounts. Enable CloudTrail Lake for SQL-based querying of events.
Lab Exercises
Lab 1: Multi-Stage CodePipeline with Manual Approval
# Create a pipeline with source, build, approval, and deploy stages
aws codepipeline create-pipeline --cli-input-json file://pipeline.json
# Approve or reject a pending approval action
aws codepipeline put-approval-result \
--pipeline-name my-app-pipeline \
--stage-name Approval \
--action-name ManualApproval \
--result summary="Approved after review",status="Approved" \
--token "approval-token-id"
Lab 2: CloudFormation Drift Detection
# Detect drift on an existing stack
aws cloudformation detect-stack-drift --stack-name my-app-stack
# Check drift detection status
aws cloudformation describe-stack-drift-detection-status \
--stack-drift-detection-id "drift-id-here"
# View drifted resources
aws cloudformation describe-stack-resource-drifts \
--stack-name my-app-stack \
--stack-resource-drift-status-filters MODIFIED DELETED
Lab 3: Automated Incident Response with EventBridge
# Create a rule that triggers on GuardDuty findings
aws events put-rule \
--name "guardduty-high-severity" \
--event-pattern '{"source":["aws.guardduty"],"detail":{"severity":[{"numeric":[">=",7]}]}}'
# Add a Lambda target for automated remediation
aws events put-targets \
--rule "guardduty-high-severity" \
--targets "Id"="remediation","Arn"="arn:aws:lambda:us-east-1:123456789012:function:remediate-finding"
Exam Tips
- Know deployment strategies cold — blue/green, canary, rolling, and all-at-once across EC2, ECS, and Lambda
- CloudFormation is heavily tested — understand update behaviors (replacement vs. no interruption vs. some interruption)
- Multi-account is the default — assume questions involve AWS Organizations and cross-account access patterns
- Automation over manual — the correct answer almost always involves the least human intervention
- Read the "least operational overhead" questions carefully — they want managed services over custom solutions
- Understand the difference between SSM Parameter Store and Secrets Manager (rotation capability is key)
Resources
- AWS DOP-C02 Exam Guide (PDF)
- AWS Well-Architected Framework — Operational Excellence Pillar
- AWS DevOps Blog
- AWS CLI Command Reference
This is 1 of 11 resources in the Certification Prep Pro toolkit. Get the complete [AWS DevOps Professional Guide] with all files, templates, and documentation for $59.
Or grab the entire Certification Prep Pro bundle (11 products) for $249 — save 30%.
Top comments (0)