AWS Certified DevOps Engineer – Professional (DOP-C02) is AWS's senior DevOps certification. It tests whether you can build CI/CD pipelines, manage infrastructure as code across many accounts, design for failure, automate monitoring and incident response, and enforce security at scale. In India it is one of the most valued credentials for DevOps, SRE and platform engineers with a few years of AWS experience.
This guide follows AWS's official exam guide: all six domains with their weights, the services that matter in each, a 10-week plan and 15 original scenario questions.
Quick facts (AWS, November 2026)
| Item | Detail |
|---|---|
| Exam code | DOP-C02 |
| Time | 180 minutes |
| Questions | 75 (65 scored, 10 unscored), multiple choice and multiple response |
| Passing score | 750 on a 100–1,000 scale |
| Fee | USD 300 (plus applicable taxes and exchange charges) |
| Delivery | Pearson VUE test centre or online proctored |
| Languages | English, Japanese, Korean, Simplified Chinese (Korean retires after 31 December 2026) |
| Valid for | 3 years |
| Recommended experience | 2+ years provisioning, operating and managing AWS environments, plus SDLC and scripting experience |
Check the official DOP-C02 certification page and exam guide before booking. Passing DOP-C02 also renews the AWS CloudOps Engineer – Associate certification, so the two pair well (see our SOA-C03 guide).
Who should take DOP-C02?
- DevOps and cloud engineers with about 2+ years of hands-on AWS work.
- SREs and platform engineers who run multi-account AWS estates.
- Engineers who hold an associate certification such as Solutions Architect Associate and want the professional level.
There are no formal prerequisites, but freshers should start with the Cloud Practitioner or an associate exam. AWS lists advanced networking, deep database tuning and full-stack coding as out of scope.
Domains and weights
| Domain | Weight |
|---|---|
| 1. SDLC Automation | 22% |
| 2. Configuration Management and IaC | 17% |
| 3. Resilient Cloud Solutions | 15% |
| 4. Monitoring and Logging | 15% |
| 5. Incident and Event Response | 14% |
| 6. Security and Compliance | 17% |
Scoring is compensatory: you need to pass the exam overall, not each domain.
Domain 1: SDLC Automation (22%)
- CI/CD pipelines: code, image and artifact repositories; CodeBuild; build secrets in Secrets Manager or Parameter Store; deployment strategies with CodeDeploy; single- and multi-account pipeline patterns.
- Automated testing: unit, integration, acceptance, UI and security tests at the right pipeline stage; running builds on pull requests; load testing; health from exit codes; code coverage.
- Artifacts: CodeArtifact, S3 and ECR repositories; EC2 Image Builder for AMIs and container images; artifact lifecycle and secure access.
- Deployment strategies: EC2, ECS, EKS and Lambda; mutable vs immutable; blue/green and canary; the CodeDeploy agent; troubleshooting failed deployments.
# buildspec.yml – test, build and push an image to ECR
version: 0.2
phases:
pre_build:
commands:
- aws ecr get-login-password | docker login --username AWS --password-stdin $REPO_URI
- pytest -q --junitxml=reports/unit.xml
build:
commands:
- docker build -t $REPO_URI:$CODEBUILD_RESOLVED_SOURCE_VERSION .
post_build:
commands:
- docker push $REPO_URI:$CODEBUILD_RESOLVED_SOURCE_VERSION
reports:
unit-tests:
files: [reports/unit.xml]For the pipeline side in interviews, see how to answer CI/CD pipeline failure questions.
Domain 2: Configuration Management and IaC (17%)
- IaC: CloudFormation, AWS SAM and AWS CDK; StackSets across accounts and Regions; reusable patterns with Service Catalog, CloudFormation modules and CDK constructs.
- Multi-account automation: AWS Organizations and Control Tower for account creation and guardrails; SCPs and cross-account roles; Config, Security Hub, GuardDuty and Detective at scale.
- Automation of complex tasks: Systems Manager for inventory, patching and State Manager; Lambda and Step Functions for multi-step automations; keeping software compliant.
Terraform is common in Indian job descriptions even though the exam focuses on AWS-native IaC. Our Terraform interview questions cover the gap.
Domain 3: Resilient Cloud Solutions (15%)
- High availability: Multi-AZ and multi-Region design; SLAs; replication and failover for stateful services; removing single points of failure; cross-Region features of DynamoDB, RDS, Route 53, S3 and CloudFront.
- Scalability: scaling metrics; loosely coupled and serverless designs; ECS and EKS; API Gateway, Lambda and Fargate; caching.
- Automated recovery: RTO and RPO; backup and restore, pilot light, warm standby; AWS Backup across Regions; testing Aurora and RDS failover.
| DR strategy | RTO / RPO | Cost |
|---|---|---|
| Backup and restore | Hours | Lowest |
| Pilot light | Tens of minutes | Low |
| Warm standby | Minutes | Medium |
| Multi-site active/active | Near zero | Highest |
More practice: AWS disaster recovery interview questions.
Domain 4: Monitoring and Logging (15%)
- Collect and store: CloudWatch metrics, namespaces and dimensions; the CloudWatch agent for custom metrics; metric filters; metric streams to S3 or Firehose; log retention and S3 lifecycle; KMS encryption of logs.
- Analyse: anomaly detection alarms; dashboards; X-Ray for containers, API Gateway and Lambda; Logs Insights and Athena; Inspector; Config rules; CloudTrail events.
- Automate: EventBridge rules to SNS or Lambda; Auto Scaling for EC2, DynamoDB, ECS and EKS; Route 53 and ALB health checks; Config auto-remediation; SSM Agent.
# CloudWatch Logs Insights: top 5xx paths in the last hour
fields @timestamp, request, elb_status_code
| filter elb_status_code >= 500
| stats count(*) as errors by request
| sort errors desc
| limit 10Domain 5: Incident and Event Response (14%)
- Event sources: AWS Health, EventBridge and CloudTrail; fan-out, streaming and queuing with SQS, SNS, Kinesis, Lambda and Step Functions.
- Configuration changes on events: Systems Manager and Auto Scaling fleet changes; Config remediation of a non-desired state.
- Troubleshooting: failed CodePipeline, CodeBuild, CodeDeploy and CloudFormation runs; CloudWatch synthetics; failed scaling or ECS/EKS tasks; root cause analysis with CloudWatch, X-Ray and OpsCenter.
See production failure interview questions for scenario practice.
Domain 6: Security and Compliance (17%)
- Identity at scale: roles vs users for humans and machines; IAM Identity Center and federation; permissions boundaries; SCPs; least privilege; ABAC; automated rotation with Secrets Manager; MFA and STS.
- Automated security controls: Security Hub, Organizations, Control Tower and Systems Manager across accounts; defence in depth with ACM, WAF, Network Firewall, security groups and NACLs; Macie for sensitive data; KMS and CloudHSM encryption.
- Monitoring and auditing: CloudTrail, Config, VPC Flow Logs, CloudFormation drift detection, GuardDuty, Inspector and IAM Access Analyzer; alerting on anomalous events such as exposed access keys or public S3 buckets.
10-week study plan (about 2 hours a day)
| Week | Focus | Lab |
|---|---|---|
| 1 | CodeCommit/GitHub, CodeBuild, CodePipeline basics | Pipeline that tests and builds a container on every push |
| 2 | CodeDeploy: in-place, blue/green, canary on EC2, ECS and Lambda | Canary Lambda deployment with automatic rollback on alarm |
| 3 | CodeArtifact, ECR, Image Builder; cross-account pipelines | Pipeline in a tools account deploying to dev and prod accounts |
| 4 | CloudFormation, StackSets, CDK, SAM | StackSet that enables Config in every account |
| 5 | Organizations, Control Tower, SCPs, Service Catalog | SCP that denies leaving the organisation and unapproved Regions |
| 6 | Systems Manager: Patch Manager, State Manager, Automation | Patch baseline plus an automation runbook triggered by EventBridge |
| 7 | Multi-AZ/multi-Region, Aurora global, DynamoDB global tables, AWS Backup | Warm-standby design with Route 53 failover |
| 8 | CloudWatch agent, metric filters, Logs Insights, X-Ray, dashboards | Alarm on a log-derived metric that triggers Lambda remediation |
| 9 | Security Hub, GuardDuty, Config rules, Macie, Access Analyzer | Auto-remediate a public S3 bucket |
| 10 | Official practice question set, timed full practice | Review every wrong answer; book the exam |
15 scenario questions with answers
These are original scenarios written for this guide, not exam questions.
1. A Lambda update must go to 10% of traffic for 10 minutes, then all traffic, and roll back if errors rise. What do you use?
CodeDeploy with a canary deployment configuration (for example Canary10Percent10Minutes) and a CloudWatch alarm attached for automatic rollback.
2. Database passwords must not appear in buildspec files. Where do they go?
Secrets Manager or Parameter Store SecureString, referenced from the buildspec env section, with the CodeBuild role allowed to read them.
3. A pipeline in a shared tools account must deploy to five workload accounts. How?
Cross-account IAM roles in each target account that CodePipeline assumes, with a KMS key and artifact bucket policy shared to those accounts.
4. Every new account needs CloudTrail, Config and a baseline IAM role automatically. What do you use?
Control Tower (with its account factory and customisations) or CloudFormation StackSets with automatic deployment to the organisational unit.
5. Engineers must never launch resources outside Mumbai and Hyderabad Regions. How do you enforce it?
An SCP that denies actions when aws:RequestedRegion is not ap-south-1 or ap-south-2, with exceptions for global services.
6. Patches must be applied to 400 EC2 instances every Sunday with a report. What do you use?
Systems Manager Patch Manager with a patch baseline and maintenance window, and compliance reporting.
7. An application needs RPO of seconds and RTO of minutes across Regions on a relational database. What do you choose?
Aurora Global Database with a managed cross-Region failover, plus Route 53 health checks for the application tier.
8. You must count "PaymentFailed" lines in application logs and alarm above 20 a minute. How?
A CloudWatch Logs metric filter on the log group, then a CloudWatch alarm on that metric sending to SNS.
9. A slow API spans API Gateway, Lambda and DynamoDB. How do you find the slow segment?
Enable X-Ray tracing on API Gateway and Lambda and analyse the trace map and segment timings.
10. When someone makes an S3 bucket public, it must be fixed automatically. How?
An AWS Config managed rule for public S3 access with automatic remediation through a Systems Manager Automation document (or EventBridge to Lambda).
11. A CloudFormation stack update failed and rolled back. Where do you look first?
The stack's events in CloudFormation for the first failed resource and its status reason, then that service's logs or CloudTrail.
12. Teams must self-provision approved, pre-secured architectures. What do you use?
AWS Service Catalog portfolios with products built from CloudFormation templates, and launch constraints.
13. Credentials for a third-party API must rotate every 30 days with no downtime. How?
Secrets Manager with a rotation Lambda and a 30-day schedule; applications read the secret at runtime.
14. Someone changed a security group manually and the stack no longer matches its template. How do you detect it?
CloudFormation drift detection (and a Config rule or EventBridge alert on the change).
15. AWS announces scheduled maintenance on your EC2 hosts. How do you react automatically?
An EventBridge rule on AWS Health events that triggers Lambda or a Systems Manager Automation to stop and start or replace the instances.
After DOP-C02
- Prepare for interviews with AWS DevOps interview questions and SRE interview questions.
- Compare the Azure path in our AZ-400 guide.
- Read the DevOps engineer career path and see live DevOps and cloud jobs.
Cloud Soft Solutions in Ameerpet, Hyderabad trains AWS DevOps with real-time pipeline, IaC and monitoring projects. See all courses and the APEX program.
📞 Call +91 96660 19191 · WhatsApp · Flat No. 513, 5th Floor, Nilagiri Block, Aditya Enclave, Ameerpet, Hyderabad
Frequently Asked Questions
How long is the AWS DOP-C02 exam?
180 minutes, with 75 questions: 65 scored and 10 unscored.
What is the passing score for DOP-C02?
750 on a scaled score of 100 to 1,000.
How much does the AWS DevOps Engineer Professional exam cost?
USD 300, plus applicable taxes and exchange charges.
Which DOP-C02 domain has the most weight?
SDLC Automation, at 22% of scored content.
Do I need an associate certification before DOP-C02?
No. There are no formal prerequisites, but AWS recommends 2+ years of experience operating AWS environments.
How long is the certification valid?
3 years. Passing DOP-C02 also renews the AWS CloudOps Engineer Associate certification.
