What does the AWS DevOps Engineer Professional exam cover?
The AWS DevOps Engineer Professional (DOP-C02) covers six domains: SDLC automation, configuration management and IaC, resilient cloud solutions, monitoring and logging, incident and event response, and security and compliance automation. It is an advanced-level exam requiring a Professional or two Associate certifications as prerequisites and costs $300 USD.
The AWS Certified DevOps Engineer – Professional (DOP-C02) is one of AWS's most advanced certifications, validating expertise in provisioning, operating, and managing distributed application systems on AWS. It tests the ability to design and automate cloud infrastructure using DevOps practices specific to the AWS platform.
DevOps Engineer Professional holders demonstrate the highest level of AWS operational and automation expertise. The certification is commonly required for senior DevOps engineer, platform engineer, and site reliability engineer roles at AWS-heavy organizations. The exam costs $300 USD and certification is valid for 3 years.
Exam Overview
| Detail | Information |
|---|---|
| Exam Code | DOP-C02 |
| Full Name | AWS Certified DevOps Engineer – Professional |
| Number of Questions | 75 |
| Time Limit | 180 minutes |
| Passing Score | 750/1000 |
| Cost | $300 USD |
| Prerequisites | Developer Associate + SysOps Associate, or Solutions Architect Professional |
| Validity | 3 years |
The exam covers six domains:
- SDLC automation (22%)
- Configuration management and IaC (17%)
- Resilient cloud solutions (15%)
- Monitoring and logging (15%)
- Incident and event response (14%)
- Security and compliance automation (17%)
"DOP-C02 is a true professional-level exam. Questions describe complex scenarios with multiple competing requirements and ask which solution best balances operational efficiency, cost, reliability, and security. Candidates who have actually built CI/CD pipelines and operational systems on AWS perform significantly better than those studying from materials alone." -- AWS DevOps Professional certified community
Domain 1: SDLC Automation (22%)
AWS CI/CD Services
AWS CodePipeline: Orchestrates the CI/CD workflow:
Source (CodeCommit/GitHub) → Build (CodeBuild) → Test (CodeBuild) → Deploy (CodeDeploy/CloudFormation/ECS)
AWS CodeBuild: Managed build service executing build commands in containers:
# buildspec.yml
version: 0.2
phases:
install:
runtime-versions:
java: corretto17
pre_build:
commands:
- echo Logging in to Amazon ECR...
- aws ecr get-login-password --region $AWS_DEFAULT_REGION | docker login --username AWS --password-stdin $ECR_REGISTRY
build:
commands:
- mvn clean package
- docker build -t $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG .
post_build:
commands:
- docker push $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG
- printf '[{"name":"app","imageUri":"%s"}]' $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG > imagedefinitions.json
artifacts:
files: imagedefinitions.json
AWS CodeDeploy: Automated application deployment:
| Deployment Type | Description | Zero Downtime |
|---|---|---|
| In-place | Update existing instances | No (brief downtime per instance) |
| Blue/green (EC2/Lambda) | New deployment alongside existing | Yes |
| Canary (Lambda/ECS) | Route small percentage to new version | Yes |
| Linear (Lambda/ECS) | Increase percentage linearly over time | Yes |
Domain 2: Configuration Management and IaC (17%)
AWS CloudFormation
CloudFormation templates in YAML/JSON:
AWSTemplateFormatVersion: '2010-09-09'
Description: Web application stack
Parameters:
EnvironmentType:
Type: String
AllowedValues: [development, staging, production]
Mappings:
InstanceTypeMap:
development:
InstanceType: t3.micro
production:
InstanceType: t3.large
Resources:
WebServer:
Type: AWS::EC2::Instance
Properties:
InstanceType: !FindInMap [InstanceTypeMap, !Ref EnvironmentType, InstanceType]
ImageId: !Sub '{{resolve:ssm:/aws/service/ami-amazon-linux-latest/amzn2-ami-hvm-x86_64-gp2}}'
SecurityGroupIds:
- !Ref WebSecurityGroup
Tags:
- Key: Environment
Value: !Ref EnvironmentType
Outputs:
WebServerPublicIP:
Value: !GetAtt WebServer.PublicIp
Export:
Name: !Sub '${AWS::StackName}-WebIP'
CloudFormation features:
- StackSets: Deploy stacks across multiple accounts and regions
- Drift detection: Identify differences between deployed stack and template
- Change sets: Preview changes before executing
- Nested stacks: Modular templates calling other templates
- Custom resources: Lambda-backed resources for custom provisioning logic
AWS Systems Manager
SSM Parameter Store: Centralized configuration and secrets management:
# Store parameter
aws ssm put-parameter --name "/production/db/password" --value "secret" --type SecureString
# Retrieve in CloudFormation
!Sub '{{resolve:ssm:/production/db/password}}'
# Use in AWS CLI
aws ssm get-parameter --name "/production/db/password" --with-decryption --query 'Parameter.Value'
SSM Automation: Runbook automation for operational tasks:
- Patching EC2 instances with
AWS-RunPatchBaseline - Creating AMI snapshots with
AWS-CreateImage - Responding to incidents with custom automation documents
Domain 3: Resilient Cloud Solutions (15%)
Multi-Region Architecture
Active-active multi-region design:
- Route 53 latency-based routing: Routes users to the lowest-latency region
- DynamoDB Global Tables: Multi-region active-active database replication
- S3 Cross-Region Replication: Automatic object replication between buckets
Active-passive failover:
- Route 53 health checks: Automatically route traffic to secondary region when primary is unhealthy
- RDS read replicas: Promote read replica to primary after regional failure
- Aurora Global Database: Fast cross-region replication with sub-second RPO
Auto Scaling Strategies
| Scaling Policy | Description | Use Case |
|---|---|---|
| Target tracking | Maintain metric at target value | Simple CPU or request count scaling |
| Step scaling | Define scaling steps based on metric range | More control over scaling increments |
| Scheduled scaling | Scale at predetermined times | Known traffic patterns (business hours) |
| Predictive scaling | Machine learning to predict and scale proactively | Reduce latency for spiky workloads |
Domain 4: Monitoring and Logging (15%)
CloudWatch Architecture
CloudWatch Metrics: Numeric time-series data from AWS services and custom applications.
CloudWatch Logs: Log groups, log streams, metric filters, subscription filters.
CloudWatch Alarms: Actions triggered when metrics cross thresholds.
CloudWatch Dashboards: Custom operational views combining multiple metrics.
Key monitoring patterns:
# Custom metric published from application code
import boto3
cloudwatch = boto3.client('cloudwatch')
cloudwatch.put_metric_data(
Namespace='MyApp',
MetricData=[{
'MetricName': 'OrderProcessingTime',
'Value': processing_time_ms,
'Unit': 'Milliseconds',
'Dimensions': [{'Name': 'Environment', 'Value': 'production'}]
}]
)
AWS X-Ray
AWS X-Ray provides distributed tracing for microservices:
- Traces service map showing dependencies between services
- Performance bottleneck identification
- Error analysis and debugging
- Integration with Lambda, API Gateway, ECS, EC2
Domain 5: Incident and Event Response (14%)
AWS EventBridge
EventBridge enables event-driven architectures:
// Rule routing EC2 state change to Lambda
{
"source": ["aws.ec2"],
"detail-type": ["EC2 Instance State-change Notification"],
"detail": {
"state": ["terminated"]
}
}
Automated incident response patterns:
- GuardDuty finding → EventBridge → Lambda → SNS notification + automatic remediation
- CloudTrail log → CloudWatch Logs → Metric filter → Alarm → Lambda → Auto-remediation
- Config rule non-compliance → SNS → Lambda → Auto-remediation (SSM Automation)
AWS Config Rules
# Example Lambda-backed custom Config rule
def evaluate_compliance(configuration_item, rule_parameters):
if configuration_item['resourceType'] != 'AWS::S3::Bucket':
return 'NOT_APPLICABLE'
# Check if bucket has versioning enabled
if configuration_item['configuration'].get('versioningConfiguration', {}).get('status') == 'Enabled':
return 'COMPLIANT'
return 'NON_COMPLIANT'
Domain 6: Security and Compliance Automation (17%)
Security Automation Services
| Service | Purpose | Automated Response |
|---|---|---|
| GuardDuty | Threat detection | EventBridge → Lambda isolation |
| Security Hub | Security findings aggregation | Automated suppression, enrichment |
| AWS Config | Configuration compliance | Auto-remediation rules |
| IAM Access Analyzer | External access analysis | Alert on public exposure |
| Macie | S3 sensitive data | Alert on PII discovery |
IAM Security Automation
Service Control Policies (SCPs) for preventive controls:
{
"Effect": "Deny",
"Action": ["cloudtrail:StopLogging", "cloudtrail:DeleteTrail"],
"Resource": "*",
"Condition": {
"StringNotEquals": {
"aws:PrincipalARN": "arn:aws:iam::*:role/SecurityAdminRole"
}
}
}
Frequently Asked Questions
How is DOP-C02 different from the Solutions Architect Professional? Solutions Architect Professional focuses on designing complex architectures, evaluating trade-offs between services, and optimizing cost and performance. DevOps Engineer Professional focuses on automation, CI/CD pipelines, operational excellence, monitoring, and incident response. Both are expert-level but approach AWS from different angles: architecture design vs. operational automation.
What AWS certifications are required before DevOps Engineer Professional? AWS requires either passing both Developer Associate (DVA) and SysOps Administrator Associate (SOA), or having the Solutions Architect Professional certification. The required combination ensures candidates have both development (CI/CD, application deployment) and operations (monitoring, auto-scaling, reliability) foundations before attempting the Professional level.
How many practice exams should I take before DOP-C02? Take at least 3-5 full practice exams from multiple sources. Jon Bonso's Tutorials Dojo DOP-C02 practice exams are widely regarded as the closest to actual exam difficulty and style. Stephane Maarek's course includes practice questions. The official AWS practice exam ($40) provides questions from the actual exam question bank. Target 80%+ on practice exams before scheduling the real exam.
References
- Amazon Web Services. (2025). AWS Certified DevOps Engineer Professional Exam Guide. https://aws.amazon.com/certification/certified-devops-engineer-professional/
- Amazon Web Services. (2025). AWS CodePipeline Documentation. https://docs.aws.amazon.com/codepipeline/
- Amazon Web Services. (2025). AWS CloudFormation Documentation. https://docs.aws.amazon.com/cloudformation/
- Maarek, S. (2025). AWS Certified DevOps Engineer Professional. Udemy.
- Tutorials Dojo. (2025). DOP-C02 Practice Exams. https://tutorialsdojo.com/courses/aws-certified-devops-engineer-professional-practice-exams/
- Kim, G., Humble, J., Debois, P., & Willis, J. (2016). The DevOps Handbook. IT Revolution Press.