The AWS Certified DevOps Engineer Professional (DOP-C02) is one of the most demanding AWS certifications available. Unlike associate-level exams that test service knowledge, this exam evaluates your ability to design and implement end-to-end DevOps workflows under complex operational constraints. If you have real-world experience building CI/CD pipelines and managing cloud infrastructure, many questions will feel familiar — but the devil is in the details.
Exam Specifications
Before you start preparing, understand the exam format:
| Item | Details | |------|---------| | Exam Code | DOP-C02 | | Questions | 75 total (65 scored + 10 unscored research questions) | | Duration | 180 minutes | | Passing Score | 750 out of 1000 | | Cost | $300 USD | | Format | Single-answer multiple choice and multiple-response | | Validity | 3 years |
With 75 questions in 180 minutes, you have roughly 2.4 minutes per question. Scenario-based questions often require 30-40 seconds just to read. Time management is critical. Flag uncertain questions and return to them — don't waste time getting stuck.
Six Domains and Their Weights
DOP-C02 (updated in late 2022) covers six domains:
D1 - SDLC Automation (22%)
The highest-weighted domain. This covers the entire CI/CD pipeline lifecycle: source control, build automation, testing gates, deployment strategies, and automatic rollback. CodePipeline, CodeBuild, CodeDeploy, and CodeCommit are the core services. Deployment strategies — blue/green, canary, rolling, in-place, immutable — each appear in multiple scenarios with different trade-offs.
D2 - Configuration Management and IaC (17%)
CloudFormation, CDK, Systems Manager (SSM), and OpsWorks. Key topics include drift detection, StackSets for multi-account deployments, Parameter Store vs Secrets Manager distinctions, Patch Manager, State Manager, and SSM documents. Understanding how to enforce configuration consistency at scale is the core competency tested here.
D3 - Resilient Cloud Solutions (15%)
Multi-AZ and Multi-Region architecture design, Auto Scaling policies (target tracking vs step scaling), Route 53 routing policies (failover, weighted, latency-based), RDS Multi-AZ vs Read Replica, and recovery objectives (RTO/RPO). Questions typically present a business constraint — "RTO of 5 minutes" or "zero data loss required" — and ask you to select the appropriate architecture.
D4 - Monitoring and Logging (15%)
CloudWatch Metrics, Logs, Alarms, and Dashboards; X-Ray distributed tracing; CloudTrail for API auditing; AWS Config for resource compliance. Designing metric-based alerting and automated remediation pipelines using CloudWatch Alarms connected to CodeDeploy or Systems Manager Automation is a recurring pattern.
D5 - Incident and Event Response (14%)
EventBridge rules for automated event processing, SNS and SQS for notification routing, Lambda for automated remediation, Systems Manager Incident Manager, and Auto Scaling health check integration with ELB. The key skill is designing event-driven architectures that detect and respond to operational events without human intervention.
D6 - Security and Compliance (17%)
IAM least privilege, Secrets Manager with automatic rotation, KMS key management, AWS Config conformance packs, GuardDuty threat detection, Security Hub findings aggregation, and SCPs for organizational policy enforcement.
!DOP-C02 exam domain weight breakdown
Key Service Patterns by Domain
CI/CD Stack
The core pipeline pattern is: CodePipeline (orchestration) + CodeBuild (build and test) + CodeDeploy (deployment and rollback). Each service has specific responsibilities that the exam tests in isolation and in combination.
CodePipeline waits for CodeBuild to complete — this matters for long-running integration tests (CodeBuild supports up to 8 hours; Lambda cannot handle tests exceeding 15 minutes). CodeDeploy handles deployment strategies and connects to CloudWatch Alarms for automated rollback.
Configuration and Secrets
Parameter Store is for configuration values (free tier supports standard parameters). Secrets Manager is for credentials that need automatic rotation — the exam consistently uses this distinction as a differentiator. When a question mentions "automatic rotation of database credentials," Secrets Manager is always the answer.
Infrastructure as Code
CloudFormation StackSets deploy stacks across multiple accounts and regions simultaneously — essential for organization-wide baseline enforcement. CDK is for developers who prefer programming languages over YAML. OpsWorks appears in scenarios where existing Chef or Puppet cookbooks must be reused.
Preparation Strategy
For practitioners with CI/CD experience
You likely understand the concepts already, but the exam tests AWS-specific implementation details. Focus on: appspec.yml lifecycle hooks structure (BeforeInstall, AfterInstall, BeforeAllowTraffic, AfterAllowTraffic, ValidateService), buildspec.yml phases and the CODEBUILD_BUILD_SUCCEEDING environment variable for conditional logic, and CloudFormation WaitCondition and DependsOn for orchestration.
For those building from scratch
Use AWS Skill Builder hands-on labs, especially CodePipeline blue/green deployment labs and Systems Manager automation runbooks. Theory alone is insufficient — many questions test understanding of failure modes that only become clear through hands-on experimentation.
Common pitfall areas
Know service limits that eliminate answer choices: Lambda 15-minute timeout eliminates it for long-running tests; CodeBuild does not have SSH-based manual intervention; Blue/Green deployments double infrastructure costs temporarily. These constraints appear as trap options designed to catch candidates who know the "happy path" but not the limitations.
Exam Key Points
"automatic rollback on deployment failure" -- CodeDeploy with CloudWatch Alarm rollback trigger configured in the deployment group
"canary traffic shifting with monitoring before full cutover" -- CodeDeploy LambdaCanary for Lambda, Blue/Green for ECS with test listener, ALB weighted target groups for EC2
"maintain full capacity during deployment with fast rollback" -- Elastic Beanstalk Immutable (single environment) or CodeDeploy Blue/Green (separate ASG)
"full pipeline automation from source to production" -- CodePipeline + CodeBuild + CodeDeploy combination
"centralized configuration management" -- Systems Manager Parameter Store (use Secrets Manager only when automatic rotation of credentials is required)
"deploy same infrastructure across multiple AWS accounts and regions" -- CloudFormation StackSets
"validate before traffic cutover with automatic rollback on failure" -- CodeDeploy BeforeAllowTraffic lifecycle hook (applies to both Lambda and ECS deployments)
"long-running integration tests (over 15 minutes)" -- CodeBuild (eliminates Lambda as an option due to 15-minute execution limit)
---
Domain Deep-Dive Series and Next Steps
With the big picture from this guide, continue with the deep-dive posts below to build service-level judgment for each domain.
| | Topic | |---|-------| | 2 | CodePipeline + CodeBuild + Automated Testing Complete Guide | | 3 | Deployment Strategies Mastery: From ECR and CodeArtifact to Blue/Green and Canary | | 4 | IaC, Multi-Account Management, and Large-Scale Automation | | 5 | Complete Guide: High Availability, Scalability & Disaster Recovery | | 6 | Mastering Monitoring and Logging | | 7 | Incident and Event Response | | 8 | Security and Compliance |
Ready to test where you stand? Try the DOP-C02 practice exam now.