AWS DevOps Engineer Professional (DOP-C02) Practice Questions¶

40 scenario-based questions weighted by exam domain.

Exam Domain Breakdown¶

Cert page: exams/aws/professional/devops-engineer-pro-dop-c02/

Domain 1: SDLC Automation (Questions 1-9)¶

Question 1¶

Scenario: A development team wants to implement a CI/CD pipeline that automatically deploys to production after passing tests in staging. However, they need a manual approval gate before production deployment and want to roll back automatically if CloudWatch alarms trigger within 10 minutes of deployment.

A. Use Jenkins on EC2 with the AWS CodeDeploy and CloudWatch plugins, with a custom script that rolls back to the last good build when an alarm fires B. Use CodePipeline with manual approval action, CodeDeploy with CloudWatch alarms for automatic rollback C. Use CodePipeline with Lambda approval function and CodeDeploy blue/green deployment D. Use Step Functions to orchestrate deployment with manual approval and rollback logic

Question 2¶

Scenario: A company uses CodeCommit for source control. They want to make sure that no one can push directly to the main branch and that every change reaches main only through an approved pull request.

A. Use an AWS Organizations SCP that requires pull requests for every CodeCommit repository in the member accounts B. Deny codecommit:GitPush to main with IAM and add approval rule templates C. Set up a repository trigger that invokes Lambda after each push to main and alerts the team D. Turn on a repository setting that requires pull requests for main, enforced for every IAM user in the account

Question 3¶

Scenario: A team wants to implement automated testing in their pipeline including unit tests, integration tests, and security scanning. Integration tests require a database, and security scanning should check for vulnerabilities in dependencies. What's the most efficient pipeline structure?

A. Run all tests sequentially in a single CodeBuild project B. Use CodePipeline with parallel actions: CodeBuild for unit tests, CodeBuild with a shared RDS instance for integration tests, and Amazon Inspector for security scanning of the build artifacts C. Use CodePipeline with parallel actions: CodeBuild for unit/integration tests with LocalStack, and CodeBuild with Snyk/Trivy for dependency scanning D. Use GitHub Actions for unit, integration and dependency tests in parallel jobs, with CodePipeline used for deployment only, to keep test tooling separate from release

Question 4¶

Scenario: A company wants to standardize their CI/CD pipelines across 50 microservices. Each service has similar build, test, and deploy stages but different configuration values. How should they implement this efficiently?

A. Implement CodeCatalyst workflows from one shared blueprint, so that all 50 services run the same identical pipeline with no per-service values B. Create a custom CI/CD framework using Step Functions C. Use CodePipeline with a single reusable CloudFormation template and parameters for service-specific values D. Create 50 separate CodePipeline definitions in CloudFormation, each copied from the first and edited by hand for its service

Question 5¶

Scenario: A development team deploys Lambda functions using SAM. They want to implement canary deployments where 10% of traffic goes to the new version for 10 minutes before full rollout. If errors increase, the deployment should automatically roll back.

A. Use Lambda aliases with manual traffic shifting B. Deploy two Lambda versions behind API Gateway with weighted routing C. Use CodeDeploy Lambda deployment with the predefined Linear10PercentEvery10Minutes configuration and the alarms D. Use SAM with DeploymentPreference type Canary10Percent10Minutes, an AutoPublishAlias on the function, and CloudWatch alarms for rollback

Question 6¶

Scenario: A team needs to deploy an application to both development and production accounts. The pipeline runs in a central DevOps account. They want to use the same pipeline definition but deploy to different accounts based on the branch (develop → dev account, main → prod account).

A. Deploy from local machines using the AWS CLI with a different named profile for each of the dev and prod accounts B. Use CodePipeline with the account ID as a pipeline parameter that is changed per deployment, so one definition serves the dev and prod accounts C. Use CodePipeline with cross-account roles, branch-based triggers, and account-specific stages D. Create separate pipelines for each account

Question 7¶

Scenario: A company wants to implement feature flags that can be changed without redeploying the application. Flags should support gradual rollouts (e.g., 10% of users see new feature) and instant kill switches. What AWS service should they use?

A. Systems Manager Parameter Store with Lambda to manage flag logic B. AWS AppConfig with feature flags C. DynamoDB with application-level caching D. S3 with CloudFront for configuration file distribution

Question 8¶

Scenario: A team uses CodeBuild for their builds. Build times have increased to 15 minutes, with 5 minutes spent downloading dependencies. How can they reduce build time?

A. Use a larger CodeBuild compute type with more vCPUs and memory, and run the dependency installs in parallel threads B. Enable only the local source cache mode, which caches the Git source but does not keep downloaded dependency packages between builds C. Raise the build timeout and add automatic retries so that slow dependency downloads are not abandoned partway through a build D. Cache the dependency directories (S3 or local cache) and pre-install static dependencies in a custom image

Question 9¶

Scenario: A company needs to deploy to an on-premises data center as part of their hybrid CI/CD pipeline. The deployment target is a fleet of Linux servers behind a firewall that cannot accept inbound connections.

A. Install the CodeDeploy agent and set up a VPN so that AWS can open inbound connections to the servers and push each deployment B. Use a CodePipeline SSH deploy action through a public bastion host, with the firewall changed to allow inbound SSH from AWS C. Use CodeDeploy with the firewall allowing the CodeDeploy service address ranges inbound, so the service can push to each agent D. Register the servers with CodeDeploy as on-premises instances or with Systems Manager hybrid activations, since the agents poll outbound only

Domain 2: Configuration Management and IaC (Questions 10-16)¶

Question 10¶

Scenario: A company manages infrastructure across 20 AWS accounts using CloudFormation. They want to ensure all accounts have consistent VPC configurations, security groups, and IAM roles. Updates should roll out to all accounts with failure handling.

A. Use Terraform with multiple provider configurations and a remote state backend, with one workspace per account applying the same shared modules B. Manually deploy CloudFormation stacks to each account C. Create Lambda functions to deploy templates to each account D. Use CloudFormation StackSets with automatic deployment to organizational units

Question 11¶

Scenario: A team uses CloudFormation for infrastructure. They need to update an RDS instance from db.t3.medium to db.t3.large. The update requires replacement, which would cause data loss. How should they handle this?

A. Add a DeletionPolicy: Snapshot to the RDS resource B. Modify the instance directly in the console and update the template C. Create a new RDS instance with the larger size and migrate data manually D. Use CloudFormation stack policies to prevent replacement

Question 12¶

Scenario: A team needs to manage secrets used by their CloudFormation-deployed applications. Secrets should be encrypted, rotatable, and not stored in version control. CloudFormation templates should reference secrets without exposing values.

A. Use SSM Parameter Store SecureString with KMS encryption and reference the parameters from the templates with dynamic references B. Use CloudFormation parameters with NoEcho C. Encrypt the secrets as objects in an S3 bucket with SSE-KMS and reference the object in the templates D. Store secrets in Secrets Manager and use dynamic references in CloudFormation

Question 13¶

Scenario: A company uses AWS CDK for infrastructure. They want to implement a policy that requires all S3 buckets to have encryption and versioning enabled. This should be enforced before deployment, not after.

A. Use AWS Config rules to detect non-compliant buckets after they have been created and send the findings to the security team B. Add a CDK unit test with the assertions module that developers can run on their own machines before they deploy C. Use CloudFormation Guard rules inside an AWS Config custom policy rule to evaluate buckets once the stack is deployed D. Implement CDK Aspects that validate and enforce encryption and versioning before synthesis, plus CloudFormation Guard on the synthesized template

Question 14¶

Scenario: A team wants to implement infrastructure testing. They need to verify that deployed infrastructure matches expected configuration (e.g., security groups have correct rules, instances are in the right subnets). What approach should they use?

A. Use Open Policy Agent (OPA) with Terraform to evaluate the plan against rules written in Rego, run on every pull request in the pipeline B. Use AWS Config conformance packs C. Use CloudFormation drift detection D. Implement infrastructure tests using AWS SDK calls in their CI/CD pipeline

Question 15¶

Scenario: A company needs to automate AMI creation with security patches applied. AMIs should be tested before promotion to production. The process should run monthly.

A. Manually patch an instance and create the AMI by hand each month, then test it B. Create a Lambda function that launches an instance, runs updates, and creates an AMI C. Use EC2 Image Builder pipelines with test components D. Use Packer with CodeBuild scheduled by EventBridge each month, with a Lambda function that runs smoke tests on the new AMI before sharing it

Question 16¶

Scenario: A team has CloudFormation stacks deployed across multiple Regions. They need to update a parameter value (such as an AMI ID) one Region at a time and stop the rollout at the first Region that fails, so later Regions are not touched.

A. Use StackSets with sequential Region deployment and a failure tolerance of 0, so a failure in one Region stops the operation in every later Region B. Use CodePipeline with parallel deploy actions C. Use StackSets with the SEQUENTIAL operation preference and a failure tolerance of 100 percent D. Update stacks sequentially in each region

Domain 3: Resilient Cloud Solutions (Questions 17-22)¶

Question 17¶

Scenario: An application runs on EC2 in an Auto Scaling group. During deployments, the ASG scales up with new instances, but old instances must complete in-flight requests before termination (up to 5 minutes). How should this be configured?

A. Set the ASG health check grace period to 5 minutes so that instances being replaced are given time to finish their requests B. Use a lifecycle hook on instance launch with a 5-minute heartbeat timeout, so new instances finish bootstrapping before they receive traffic C. Configure the load balancer idle timeout to 5 minutes so that connections are kept open until the in-flight requests finish D. Add a termination lifecycle hook with a 5-minute heartbeat timeout and enable connection draining on the load balancer

Question 18¶

Scenario: A company wants to implement automatic recovery for their application. If the primary region becomes unavailable, traffic should failover to the DR region within 5 minutes. The application is stateless but requires a healthy instance to be running in DR.

A. Use Route 53 simple routing with a one-hour TTL and have the operations team change the record by hand to the DR region B. Use CloudFront with a single origin pointing at the primary region's load balancer and rely on cached content during an outage C. Implement Global Accelerator with endpoints only in the primary region, relying on its static IP addresses to restore service after a failure D. Use Route 53 health checks with failover routing to a warm standby in the DR region

Question 19¶

Scenario: An application processes messages from SQS. If the application crashes, messages should not be lost and should be reprocessed. If a message fails repeatedly (poison pill), it should be moved aside for investigation. What configuration is needed?

A. Enable long polling B. Use FIFO queue with deduplication C. Configure visibility timeout longer than processing time and set up a dead-letter queue with maxReceiveCount D. Run multiple consumers and rely on the queue retention period to keep failed messages

Question 20¶

Scenario: A company runs stateful containers on ECS. They need to ensure that when a container task fails, a new task is started and can access the same data. Tasks run in Fargate.

A. Use EFS mounted into the tasks B. Use a managed EBS volume configured on each task, created fresh for every task that starts C. Use instance store volumes on the host that runs the task and copy the data to the replacement task when it starts D. Use S3 for data storage, with the application syncing files to and from a bucket each time a task starts and stops

Question 21¶

Scenario: A database application needs to survive an Availability Zone failure without data loss. It uses PostgreSQL and requires synchronous replication. What is the most appropriate AWS service?

A. RDS PostgreSQL with cross-region read replica B. RDS PostgreSQL read replica C. RDS PostgreSQL with Multi-AZ deployment D. Self-managed PostgreSQL on EC2 with synchronous replication

Question 22¶

Scenario: A company wants to implement chaos engineering to test system resilience. They want to randomly terminate EC2 instances during business hours to verify the application handles failures gracefully.

A. Manually terminate instances periodically B. Use AWS Fault Injection Simulator (FIS) with EC2 actions C. Use Systems Manager Automation documents to terminate instances D. Write a Lambda function triggered by CloudWatch Events to randomly terminate instances

Domain 4: Monitoring and Logging (Questions 23-28)¶

Question 23¶

Scenario: A company needs centralized logging from EC2 instances, Lambda functions, and containers. They want to search logs, create dashboards, and set up alerts when error rates exceed thresholds.

A. Use an Elasticsearch (OpenSearch) cluster with Kibana dashboards, with Beats agents shipping logs from the instances, functions and containers B. Use CloudWatch Logs with Logs Insights, dashboards, and metric filters for alarms C. Send all logs to S3 and use Athena for querying D. Use third-party logging service

Question 24¶

Scenario: A microservices application has high latency issues. The team needs to identify which service is causing the bottleneck. Requests pass through API Gateway, Lambda, and DynamoDB.

A. Implement AWS X-Ray tracing across all services B. Add custom logging with timestamps at each service boundary C. Use CloudWatch ServiceLens without enabling X-Ray tracing on the services D. Enable detailed monitoring

Question 25¶

Scenario: A company wants to monitor API Gateway for 4XX and 5XX errors and alert when error rate exceeds 5% of total requests over 5 minutes. How should they configure this?

A. Use CloudWatch metric math to calculate error rate: (4XX + 5XX) / Count * 100, create alarm on this expression B. Use CloudWatch Contributor Insights C. Enable API Gateway access logging and create metric filters D. Create alarms on the 4XXError and 5XXError counts with a threshold set at 5% of expected traffic

Question 26¶

Scenario: A company needs to retain CloudWatch Logs for 7 years for compliance. They also need the ability to search recent logs (last 30 days) quickly. How should they configure retention?

A. Export logs to S3 daily using Lambda and delete the log groups afterwards so that only S3 remains B. Set CloudWatch Logs retention to 7 years so that all logs stay searchable in one place, paying CloudWatch storage prices for the whole period C. Keep 30 days in CloudWatch Logs and stream to S3 with a subscription filter D. Set CloudWatch Logs retention to never expire and use Logs Insights to query all 7 years, paying CloudWatch storage prices throughout

Question 27¶

Scenario: A company wants to be notified immediately when someone logs into the AWS console as root user or when root credentials are used for API calls.

A. Create an EventBridge rule for AWS Console Sign-in events with a root user filter, targeting an SNS topic that notifies the security team B. Use an AWS Config rule that checks root MFA is enabled and notify the team on noncompliance C. Use GuardDuty and review its root credential findings in the console at the start of each day D. Create EventBridge rules for console sign-in events and for CloudTrail API events, each filtering for the root user

Question 28¶

Scenario: A company runs containers on EKS and needs to collect metrics from applications using Prometheus format. They want to visualize metrics in Grafana and store them long-term.

A. Deploy self-managed Prometheus and Grafana on EKS B. Use Amazon Managed Service for Prometheus (AMP) and Amazon Managed Grafana for long-term storage C. Use CloudWatch Container Insights with Prometheus collection and CloudWatch dashboards only D. Deploy Prometheus on EC2 with remote write to a self-managed Cortex cluster, and use CloudWatch dashboards for visualization

Domain 5: Incident and Event Response (Questions 29-34)¶

Question 29¶

Scenario: An Auto Scaling group has instances failing health checks and being replaced repeatedly. The team needs to troubleshoot but instances terminate before they can investigate. How should they approach this?

A. SSH into instances before they fail B. Suspend the ReplaceUnhealthy process, investigate, then resume C. Remove the ELB and EC2 health checks from the group temporarily, then add them back D. Increase the health check grace period so new instances have more time to pass health checks before they are replaced

Question 30¶

Scenario: A company wants automated incident response when GuardDuty detects cryptocurrency mining activity. The response should isolate the affected instance, create a snapshot for investigation, and notify the security team.

A. Use Security Hub to aggregate and respond to findings B. Configure GuardDuty to send findings to EventBridge, trigger Step Functions orchestrating remediation actions C. Configure GuardDuty to publish findings to an SNS topic that emails the security team, who then isolate the instance and snapshot the volume by hand D. Manually review GuardDuty findings daily

Question 31¶

Scenario: During a production incident, the team needs to quickly roll back an ECS service to the previous task definition version. What's the fastest approach?

A. Update the CloudFormation stack with the previous task definition revision and let CloudFormation roll the service to it during the stack update B. Create a new task definition and update the service C. Redeploy through the CI/CD pipeline with previous code version D. Call the ECS UpdateService API with the previous task definition revision ARN, which starts a rolling deployment back to the old version without a new build

Question 32¶

Scenario: A company uses Systems Manager to manage their EC2 fleet. They need to patch instances during maintenance windows and automatically roll back if patching causes failures.

A. Use Patch Manager with maintenance windows and baselines and rely on it to roll back failures B. Run the AWS-PatchInstanceWithRollback Automation runbook as a maintenance window task, which restores the root volume if patching fails C. Create custom SSM documents for patching D. Schedule Lambda functions to apply patches

Question 33¶

Scenario: A DynamoDB table is experiencing throttling. CloudWatch shows consumed capacity exceeding provisioned. The table uses provisioned capacity mode. What immediate action should be taken?

A. Increase provisioned read/write capacity B. Add a DAX cluster C. Enable DynamoDB auto scaling D. Switch to on-demand capacity mode

Question 34¶

Scenario: A company needs to create runbooks for common operational tasks like restarting services, clearing caches, and rotating credentials. These should be executable by operators without requiring console access.

A. Create Lambda functions for each task and let operators invoke them from the CLI with an IAM role, logging each invocation in CloudWatch B. Implement SSM Automation documents with approval workflows C. Use Step Functions state machines D. Create wiki documentation with CLI commands

Domain 6: Security and Compliance (Questions 35-40)¶

Question 35¶

Scenario: A company needs to ensure all data at rest is encrypted across their AWS environment. They want automated detection of unencrypted resources and automatic remediation where possible.

A. Manually audit resources monthly B. Use Security Hub with the AWS Foundational Security Best Practices standard to detect unencrypted resources and send findings to the team C. Use SCPs to prevent creation of unencrypted resources D. Use AWS Config rules to detect unencrypted resources and Lambda for remediation

Question 36¶

Scenario: A DevOps team needs access to production EC2 instances for troubleshooting but the security team doesn't want to manage SSH keys or open port 22. How should they provide secure access?

A. Use Session Manager B. Use AWS Cloud9 for instance access C. Set up a bastion host in a public subnet with centrally managed key pairs and a security group limited to the office IP range D. Use EC2 Instance Connect with temporary keys pushed by IAM

Question 37¶

Scenario: A CI/CD pipeline needs to deploy to AWS. The pipeline runs on self-hosted runners outside AWS. What's the most secure way to provide AWS credentials to the pipeline?

A. Use IAM Roles Anywhere with X.509 certificates B. Store access keys in environment variables on the runner hosts C. Use EC2 instance roles D. Store AWS access keys in the pipeline's secrets management

Question 38¶

Scenario: A company needs to scan container images for vulnerabilities before deployment. They use ECR for container registry. Scanning should happen automatically when images are pushed.

A. Enable ECR basic scanning, with an engineer starting a scan from the console after each image has been pushed B. Use Amazon Inspector, with an engineer starting a scan from the console before each release C. Use third-party scanning tools in the CI/CD pipeline, run once a week against the latest images in the registry D. Enable ECR enhanced scanning with Amazon Inspector so that every push is scanned automatically, with deeper OS and language package analysis

Question 39¶

Scenario: A company needs to rotate database credentials used by applications automatically. Applications run on Lambda and retrieve credentials at runtime. How should they implement this?

A. Store credentials in Lambda environment variables encrypted with a KMS key and redeploy the function with new values after each rotation B. Use IAM database authentication C. Use Secrets Manager with automatic rotation and Lambda retrieves credentials using the SDK D. Store credentials in Parameter Store SecureString and rotate manually

Question 40¶

Scenario: A company must ensure their AWS environment meets PCI DSS compliance. They need continuous compliance monitoring with evidence collection for auditors.

A. Implement all controls manually B. Hire auditors to manually check compliance quarterly C. Use AWS Artifact to download AWS's own compliance reports only D. Use AWS Config with PCI DSS conformance pack

Answer Key¶