What are the prerequisites for taking the DOP-C02 exam?

AWS recommends that candidates have at least 2 years of experience provisioning, operating, and managing AWS environments, plus strong knowledge of AWS services and DevOps practices. While there are no strict prerequisites, passing the AWS Certified Solutions Architect - Professional or AWS Certified SysOps Administrator - Associate exam first is highly recommended.

How long is the DOP-C02 exam and how many questions are there?

The DOP-C02 exam is 170 minutes long and contains 75 questions in multiple-choice and multiple-response formats. You must achieve a minimum score of 750 out of 1000 to pass the certification.

What topics are covered on the DOP-C02 exam?

The exam covers five main domains: SDLC Automation (22%), Configuration Management and Infrastructure as Code (17%), Resilience and High Availability (15%), Monitoring, Logging, and Remediation (18%), and Security and Compliance (28%). Each domain tests your ability to design, implement, and manage DevOps solutions on AWS.

How much does the DOP-C02 exam cost and where can I take it?

The exam costs $300 USD and can be taken either at an official Pearson VUE testing center or online from your home or office. AWS also occasionally offers exam voucher discounts during training events and promotions.

Is the DOP-C02 exam different from the previous DOP-C01 version?

Yes, DOP-C02 is the updated version that replaced DOP-C01 and reflects the current AWS services and best practices. The new version includes updated content on containerization, modern DevOps tooling, and recent AWS features while maintaining similar core competency requirements.

Free Amazon DOP-C02 Exam Questions

Q1 MultipleChoice

A development team manually builds an artifact locally and then places it in an Amazon S3 bucket. The application has a local cache that must be cleared when a deployment occurs. The team runs a command to do this downloads the artifact from Amazon S3 and unzips the artifact to complete the deployment.

A DevOps team wants to migrate to a CI/CD process and build in checks to stop and roll back the deployment when a failure occurs. This requires the team to track the progression of the deployment.

Which combination of actions will accomplish this? (Select THREE)

AAllow developers to check the code into a code repository Using Amazon EventBridge on every pull into the mam branch invoke an AWS Lambda function to build the artifact and store it in Amazon S3.

BCreate a custom script to clear the cache Specify the script in the Beforelnstall lifecycle hook in the AppSpec file.

CCreate user data for each Amazon EC2 instance that contains the clear cache script Once deployed test the application If it is not successful deploy it again.

DSet up AWS CodePipeline to deploy the application Allow developers to check the code into a code repository as a source tor the pipeline.

EUse AWS CodeBuild to build the artifact and place it in Amazon S3 Use AWS CodeDeploy to deploy the artifact to Amazon EC2 instances.

FUse AWS Systems Manager to fetch the artifact from Amazon S3 and deploy it to all the instances.

Correct Answer: B, D, E

Q2 MultipleChoice

A company is implementing a well-architected design for its globally accessible API stack. The design needs to ensure both high reliability and fast response times for users located in North America and Europe.

The API stack contains the following three tiers:

Amazon API Gateway

AWS Lambda

Amazon DynamoDB

Which solution will meet the requirements?

AConfigure Amazon Route 53 to point to API Gateway APIs in North America and Europe using health checks. Configure the APIs to forward requests to a Lambda function in that Region. Configure the Lambda functions to retrieve and update the data in a DynamoDB table in the same Region as the Lambda function.

BConfigure Amazon Route 53 to point to API Gateway APIs in North America and Europe using latency-based routing and health checks. Configure the APIs to forward requests to a Lambda function in that Region. Configure the Lambda functions to retrieve and update the data in a DynamoDB global table.

CConfigure Amazon Route 53 to point to API Gateway in North America, create a disaster recovery API in Europe, and configure both APIs to forward requests to the Lambda functions in that Region. Retrieve the data from a DynamoDB global table. Deploy a Lambda function to check the North America API health every 5 minutes. In the event of a failure, update Route 53 to point to the disaster recovery API.

DConfigure Amazon Route 53 to point to API Gateway API in North America using latency-based routing. Configure the API to forward requests to the Lambda function in the Region nearest to the user. Configure the Lambda function to retrieve and update the data in a DynamoDB table.

Correct Answer: B

Q3 MultipleChoice

A company manages an application that stores logs in Amazon CloudWatch Logs. The company wants to archive the logs to an Amazon S3 bucket Logs are rarely accessed after 90 days and must be retained tor 10 years.

Which combination of steps should a DevOps engineer take to meet these requirements? (Select TWO.)

AConfigure a CloudWatch Logs subscription filter to use AWS Glue to transfer all logs to an S3 bucket.

BConfigure a CloudWatch Logs subscription filter to use Amazon Kinesis Data Firehose to stream all logs to an S3 bucket.

CConfigure a CloudWatch Logs subscription fitter to stream all logs to an S3 bucket.

DConfigure the S3 bucket lifecycle policy to transition logs to S3 Glacier after 90 days and to expire logs after 3.650 days.

EConfigure the S3 bucket lifecycle policy to transition logs to Reduced Redundancy after 90 days and to expire logs after 3.650 days.

Correct Answer: B, D

Explanation:

https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/SubscriptionFilters.html

Q4 MultipleChoice

A company is divided into teams Each team has an AWS account and all the accounts are in an organization in AWS Organizations. Each team must retain full administrative rights to its AWS account. Each team also must be allowed to access only AWS services that the company approves for use AWS services must gam approval through a request and approval process.

How should a DevOps engineer configure the accounts to meet these requirements?

AUse AWS CloudFormation StackSets to provision IAM policies in each account to deny access to restricted AWS services. In each account configure AWS Config rules that ensure that the policies are attached to IAM principals in the account.

BUse AWS Control Tower to provision the accounts into OUs within the organization Configure AWS Control Tower to enable AWS IAM identity Center (AWS Single Sign-On). Configure 1AM Identity Center to provide administrative access Include deny policies on user roles for restricted AWS services.

CPlace all the accounts under a new top-level OU within the organization Create an SCP that denies access to restricted AWS services Attach the SCP to the OU.

DCreate an SCP that allows access to only approved AWS services. Attach the SCP to the root OU of the organization. Remove the FullAWSAccess SCP from the root OU of the organization.

Correct Answer: C

Explanation:

https://docs.aws.amazon.com/vpc/latest/userguide/managed-prefix-lists.html A managed prefix list is a set of one or more CIDR blocks. You can use prefix lists to make it easier to configure and maintain your security groups and route tables. https://docs.aws.amazon.com/vpc/latest/userguide/sharing-managed-prefix-lists.html With AWS Resource Access Manager (AWS RAM), the owner of a prefix list can share a prefix list with the following: Specific AWS accounts inside or outside of its organization in AWS Organizations An organizational unit inside its organization in AWS Organizations An entire organization in AWS Organizations

Q5 MultipleChoice

A DevOps engineer is implementing governance controls for a company that requires its infrastructure to be housed within the United States. The company has many AWS accounts in an organization in AWS Organizations that has all features enabled. The engineer must restrict which AWS Regions the company can use. The engineer must also ensure that an alert is sent as soon as possible if any activity outside the governance policy occurs. The controls must be automatically enabled on any new Region outside the United States. Which combination of steps will meet these requirements? (Select TWO.)

ACreate an Organizations SCP deny policy that has a condition that the aws:RequestedRegion property does not match a list of all US Regions. Include an exception in the policy for global services. Attach the policy to the root of the organization.

BConfigure AWS CloudTrail to send logs to Amazon CloudWatch Logs. Enable CloudTrail for all Regions. Use a CloudWatch Logs metric filter to create a metric in non-US Regions. Configure a CloudWatch alarm to send an alert if the metric is greater than 0.

CUse an AWS Lambda function that checks for AWS service activity. Deploy the Lambda function to all Regions. Write an Amazon EventBridge rule that runs the Lambda function every hour. Configure the rule to send an alert if the Lambda function finds any activity in a non-US Region.

DUse an AWS Lambda function to query Amazon Inspector to look for service activity in non-US Regions. Configure the Lambda function to send alerts if Amazon Inspector finds any activity.

ECreate an Organizations SCP allow policy that has a condition that the aws:RequestedRegion property matches a list of all US Regions. Include an exception in the policy for global services. Attach the policy to the root of the organization.

Correct Answer: A, B

DOP-C02 Exam Questions & Answers

Sample DOP-C02 Questions

Frequently Asked Questions

Pass DOP-C02 First Time