DOP-C02 Study Guide: AWS DevOps Engineer

How to Pass the AWS DevOps Engineer Professional (DOP-C02) Exam — hero

DOP-C02 (AWS Certified DevOps Engineer - Professional) has 75 questions in 180 minutes, costs USD 300 (JPY 40,000 in Japan) and passes at 750 out of 1,000. Its six domains are led by SDLC automation (22%), with configuration management and IaC, and security and compliance, at 17% each.

Practice this exam in timed mode with the StudyKits DOP-C02 DevOps Engineer Professional app. The AWS certification hub lists every AWS exam guide and practice app.

Most candidates come from a developer or operations associate exam and plan about 8 weeks. Exam facts are from the AWS pages under Sources, checked October 15, 2026.

If the Developer Associate (DVA-C02) taught you how to build applications on AWS and the CloudOps Engineer - Associate (SOA-C03, formerly SysOps Administrator) taught you how to operate them, the DevOps Engineer Professional teaches you how to automate everything in between. This exam sits at the intersection of development and operations, and it demands expertise in both.

What is the DOP-C02 exam format?

The DOP-C02 has 75 questions (65 scored + 10 unscored) and gives you 180 minutes. You need a scaled score of 750 out of 1,000 to pass. The exam costs USD 300.

You need solid experience provisioning, operating and managing AWS environments, plus a strong grasp of CI/CD, infrastructure as code and monitoring. AWS does not require an associate certification first, but DVA or SOA-C03 is a useful step.

Like the Solutions Architect Professional (SAP-C02), this exam features long, scenario-based questions that test your ability to choose the best solution among several reasonable options. The questions are complex, the answer choices are nuanced, and time management matters.

What are the six DOP-C02 domains?

Domain 1: SDLC Automation (22%)

This domain tests your ability to automate the software development lifecycle.

CI/CD pipeline design:

CodePipeline — multi-stage pipelines, cross-Region deployments, cross-account deployments, manual approvals, pipeline triggers (CloudWatch Events, webhooks)
CodeBuild — buildspec.yml structure, build phases, caching, secrets management, custom build environments, batch builds
CodeDeploy — appspec.yml, deployment configurations, hooks, rollback triggers, deployment to EC2/ECS/Lambda
Third-party integrations — Jenkins on AWS, GitHub Actions with AWS, GitLab CI with AWS

Deployment strategies:

Blue/green deployments — implementation with CodeDeploy, ECS, Elastic Beanstalk, Route 53, and CloudFormation
Canary deployments — Lambda aliases with weighted traffic, CodeDeploy traffic shifting
Rolling deployments — with and without additional batch, minimum healthy percentage
Immutable deployments — new instances, swap, terminate old
Feature flags and dark launches

Testing automation:

Integration testing in CI/CD pipelines
Automated security scanning (CodeGuru Reviewer, SAST, DAST)
Load testing integration
Approval gates and quality gates

Multi-environment management:

Environment promotion strategies (dev, staging, production)
Parameter management across environments — Parameter Store, Secrets Manager
Configuration management — environment-specific configurations in CodePipeline

Domain 2: Configuration Management and IaC (17%)

CloudFormation advanced:

Nested stacks — when to use, cross-stack references with exports/imports
StackSets — multi-account and multi-Region deployment, auto-deployment, drift detection
Custom resources — Lambda-backed custom resources, response handling
CloudFormation Guard — policy-as-code for template validation
Change sets and stack policies
cfn-init, cfn-signal, and CreationPolicy for EC2 bootstrap
DeletionPolicy and UpdatePolicy
CloudFormation drift detection and remediation

CDK (Cloud Development Kit):

Constructs — L1 (CFN), L2 (curated), L3 (patterns)
CDK Pipelines — self-mutating pipelines
CDK testing — snapshot tests, fine-grained assertions
CDK best practices — construct libraries, context values

SAM (Serverless Application Model):

SAM template syntax — globals, functions, APIs, layers
sam build, sam deploy, sam local for testing
SAM Accelerate for faster development cycles
SAM policy templates

Configuration management:

Systems Manager — Parameter Store (standard vs advanced), document types, Automation runbooks
AWS AppConfig — feature flags, deployment strategies, validators
OpsWorks — Chef and Puppet managed configurations

Domain 3: Resilient Cloud Solutions (15%)

High availability patterns:

Multi-AZ architectures for all service types
Multi-Region architectures — active-active, active-passive
Auto Scaling advanced — predictive scaling, target tracking with custom metrics, lifecycle hooks for graceful shutdown
Health check strategies — ELB health checks, Route 53 health checks, custom health checks

Fault tolerance:

Circuit breaker patterns
Retry strategies with exponential backoff
Dead-letter queues for failed processing
Idempotency in distributed systems
Saga pattern for distributed transactions

Disaster recovery automation:

Automated DR failover with Route 53 and Lambda
Cross-Region replication automation
RDS automated failover and read replica promotion
DynamoDB global tables
Pilot light and warm standby automation

Domain 4: Monitoring and Logging (15%)

Centralized logging:

CloudWatch Logs — cross-account log aggregation, subscription filters to Kinesis/Lambda/OpenSearch
CloudTrail — organization trails, log integrity validation
VPC Flow Logs — analysis patterns, Athena queries
AWS Firewall Manager — centralized logging for WAF

Monitoring and alerting:

CloudWatch — custom metrics, composite alarms, anomaly detection, Contributor Insights
CloudWatch ServiceLens — distributed tracing integration
X-Ray — distributed tracing, service maps, trace groups, sampling rules
CloudWatch Synthetics — canary scripts for endpoint monitoring
CloudWatch RUM — real user monitoring

Dashboarding and reporting:

CloudWatch Dashboards — cross-account, automatic dashboards
AWS Health events — event-driven automation
Trusted Advisor integration
Custom operational dashboards

Log analysis:

CloudWatch Logs Insights — query syntax, visualization
Amazon OpenSearch Service — log analysis patterns, Kibana/OpenSearch Dashboards
Amazon Athena for S3-based log analysis

Domain 5: Incident and Event Response (14%)

Event-driven automation:

EventBridge — event patterns, rules, targets, event buses (default, custom, partner)
EventBridge Pipes — point-to-point integrations with filtering and enrichment
Lambda event-driven patterns — event sources, error handling, DLQ
Step Functions — standard vs express workflows, error handling, retry policies

Incident management:

AWS Systems Manager Incident Manager — incident plans, response plans, runbooks
Systems Manager OpsCenter — OpsItems, operational insights
Automated remediation with Config rules and Lambda
Auto Scaling troubleshooting — capacity issues, health check failures

Auto-remediation patterns:

CloudWatch Alarm + Lambda for automated fixes
Config rule + Systems Manager Automation for compliance remediation
EventBridge + Step Functions for complex remediation workflows
Self-healing infrastructure patterns

Scaling automation:

Auto Scaling with custom metrics
Application Auto Scaling for non-EC2 resources (DynamoDB, ECS, Lambda provisioned concurrency)
Scheduled scaling for predictable patterns
Capacity management and capacity reservations

Domain 6: Security and Compliance (17%)

Security automation:

IAM — permission boundaries, SCPs, session policies
Secrets rotation with Secrets Manager and Lambda
Certificate management with ACM — auto-renewal, validation
Security Hub — automated findings, custom actions
GuardDuty — automated threat response with EventBridge

Compliance as code:

AWS Config rules — managed rules, custom rules with Lambda
Config conformance packs
CloudFormation Guard for template compliance
AWS Audit Manager for compliance evidence

Pipeline security:

Secrets in CI/CD — Parameter Store, Secrets Manager, CodeBuild environment variables
Container image scanning — ECR image scanning, Snyk/Trivy integration
SAST/DAST in pipelines
IAM roles for pipeline stages — least privilege

Data protection:

KMS — key policies, cross-account key sharing, automatic rotation
S3 encryption enforcement
EBS encryption by default
Encryption in transit — ACM, ALB TLS termination

What does an 8-week study plan look like?

Weeks 1-2: CI/CD and SDLC Automation

Week 1: Study CodePipeline, CodeBuild, and CodeDeploy in depth. Understand buildspec.yml, appspec.yml, deployment strategies, and cross-account pipelines. Build a complete pipeline in your AWS account.
Week 2: Study deployment strategies (blue/green, canary, rolling, immutable) across different services (EC2, ECS, Lambda, Elastic Beanstalk). Complete 4 practice question sets.

Weeks 3-4: Infrastructure as Code

Week 3: Study CloudFormation advanced topics: nested stacks, StackSets, custom resources, cfn-init/cfn-signal, drift detection. Study CloudFormation Guard.
Week 4: Study CDK (constructs, CDK Pipelines, testing), SAM (template syntax, local testing), and Systems Manager (Parameter Store, AppConfig, Automation). Complete 4 practice question sets.

Weeks 5-6: Monitoring, Resilience, and Incident Response

Week 5: Study CloudWatch (metrics, logs, alarms, Logs Insights, anomaly detection), X-Ray (tracing, service maps), and centralized logging patterns. Study EventBridge and event-driven automation.
Week 6: Study high availability patterns, DR automation, incident management (Incident Manager, OpsCenter), and auto-remediation patterns. Complete 4 practice question sets.

Weeks 7-8: Security and Exam Preparation

Week 7: Study security automation (Secrets Manager rotation, Security Hub, GuardDuty automation), compliance as code (Config rules, conformance packs), and pipeline security. Take a full-length practice exam. Identify weak domains.
Week 8: Targeted review of weak areas. Take a second full-length practice exam. Before scheduling, meet our rule of thumb: 80%+ on fresh questions, no domain below 70%.

What study tips matter most for DOP-C02?

Understand “why” not just “what.” The exam does not just ask what CodeDeploy does. It asks you to choose between CodeDeploy blue/green on EC2 vs ECS blue/green with CodeDeploy vs CloudFormation blue/green for a specific scenario. You need to know the tradeoffs.

Master event-driven patterns. Many DOP-C02 scenarios involve event-driven automation. If a scenario says “when X happens, we need to automatically do Y,” you need to instantly know whether the answer involves EventBridge, CloudWatch Alarms, Config rules, or Lambda triggers.

Know your deployment strategies cold. For every deployment strategy (blue/green, canary, rolling, immutable), know:

Which services support it natively
How to implement it
The rollback mechanism
When to choose it over alternatives

Practice cross-account and cross-Region patterns. The professional exam loves questions about deploying across multiple accounts and Regions. Know how CodePipeline handles cross-account deployments, how StackSets deploy across an organization, and how to replicate data and configurations across Regions.

Think automation first. If your instinct on a question is “log into the console and click…” that answer is almost certainly wrong. The DOP-C02 expects automated solutions for everything. Manual intervention is the anti-pattern.

Should you take DOP-C02 or SAP-C02?

Both are professional-level and both are hard. The difference is focus:

SAP-C02 focuses on architecture: designing complex multi-account, hybrid, and multi-Region solutions
DOP-C02 focuses on automation: building and maintaining CI/CD pipelines, IaC, monitoring, and incident response

Many candidates earn both, and there is noticeable topic overlap. If you are a solutions architect, start with SAP-C02. If you are a DevOps or platform engineer, start with DOP-C02. If you are pursuing both, the order matters less than completing them within a few months of each other while the shared knowledge is fresh.

What comes after DOP-C02?

Common next steps:

Solutions Architect - Professional if you have not already taken it (SAP-C02 ends November 16, 2026; SAP-C03 from November 17, 2026)
AWS Security Specialty if you want to deepen your security automation skills
AWS Generative AI Developer - Professional (AIP-C01) or Machine Learning Engineer - Associate to add AI/ML operations knowledge

To practise, the StudyKits DOP-C02 app has original questions with explanations, a timed exam mode and domain tracking. Follow the 8-week plan and practise full 75-question sets under time.

Frequently asked questions

How much does the DOP-C02 exam cost?

USD 300. In Japan it is JPY 40,000.

What is the DOP-C02 passing score?

750 on a scale of 100-1,000.

How many questions are on DOP-C02?

75: 65 scored and 10 unscored, in 180 minutes.

Is DOP-C02 being replaced?

AWS has not announced a DOP-C03 as of October 15, 2026. The Korean version of DOP-C02 is retired after December 31, 2026.

Keep reading

AWS Professional vs Associate: when to step up

Sources

Checked October 15, 2026:

How to Pass the AWS DevOps Engineer Professional (DOP-C02) Exam