Free DOP-C02 Practice Test Questions and Answers (2026)

View Mode
Q: 1
A development team is using AWS CodeCommit to version control application code and AWS CodePipeline to orchestrate software deployments. The team has decided to use a remote main branch as the trigger for the pipeline to integrate code changes. A developer has pushed code changes to the CodeCommit repository, but noticed that the pipeline had no reaction, even after 10 minutes. Which of the following actions should be taken to troubleshoot this issue?
Options
37 comments in the community discussion
3
Option A D is a trap since no logs if the event never triggers.
2
I see the logic, but wouldn't B be possible too? If the pipeline role can't access CodeCommit, it wouldn't run either.
Q: 2
A company uses an AWS CodeArtifact repository to store Python packages that the company developed internally. A DevOps engineer needs to use AWS CodeDeploy to deploy an application to an Amazon EC2 instance. The application uses a Python package that is stored in the CodeArtifact repository. A BeforeInstall lifecycle event hook will install the package. The DevOps engineer needs to grant the EC2 instance access to the CodeArtifact repository. Which solution will meet this requirement?
Options
35 comments in the community discussion
5
Option D again with more AWS hoops to jump through just for package access, but that's their typical stance.
2
Maybe B, since a resource-based policy can allow access from specific principals, and EC2 does have an identity. I think it feels more straightforward to just grant read permissions this way, but not 100% sure if CodeArtifact supports that for EC2 directly. D is definitely the official IAM play, though.
Q: 3
A DevOps team uses AWS CodePipeline, AWS CodeBuild, and AWS CodeDeploy to deploy an application. The application is a REST API that uses AWS Lambda functions and Amazon API Gateway Recent deployments have introduced errors that have affected many customers. The DevOps team needs a solution that reverts to the most recent stable version of the application when an error is detected. The solution must affect the fewest customers possible. Which solution Will meet these requirements With the MOST operational efficiency?
Options
23 comments in the community discussion
4
B . That canary config with auto rollback is shown a lot in the official guide and practice exams for limiting customer impact. If you want to go deeper, AWS whitepapers or labs are helpful for this topic.
1
Its B here. Canary10Percent10Minutes limits how many users get the buggy version if something goes wrong, and automatic rollback kicks in fast with the right CloudWatch alarm. Saw this setup in some practice sets and it matches AWS best practices for efficiency. Anyone see a reason to go with A instead? Pretty sure B i
Q: 4
A company is building a new pipeline by using AWS CodePipeline and AWS CodeBuild in a build account. The pipeline consists of two stages. The first stage is a CodeBuild job to build and package an AWS Lambda function. The second stage consists of deployment actions that operate on two different AWS accounts a development environment account and a production environment account. The deployment stages use the AWS Cloud Format ion action that CodePipeline invokes to deploy the infrastructure that the Lambda function requires. A DevOps engineer creates the CodePipeline pipeline and configures the pipeline to encrypt build artifacts by using the AWS Key Management Service (AWS KMS) AWS managed key for Amazon S3 (the aws/s3 key). The artifacts are stored in an S3 bucket When the pipeline runs, the Cloud Formation actions fail with an access denied error. Which combination of actions must the DevOps engineer perform to resolve this error? (Select TWO.)
Options
22 comments in the community discussion
2
Yeah, BE makes sense here. The aws/s3 managed key doesn't let you do cross-account decrypt, so option B's custom KMS key is needed. E is about updating the S3 bucket policy for those external roles. Pretty sure that's the fix but open to input if anyone disagrees.
1
B and E
Q: 5
A DevOps engineer has automated a web service deployment by using AWS CodePipeline with the following steps: 1) An AWS CodeBuild project compiles the deployment artifact and runs unit tests. 2) An AWS CodeDeploy deployment group deploys the web service to Amazon EC2 instances in the staging environment. 3) A CodeDeploy deployment group deploys the web service to EC2 instances in the production environment. The quality assurance (QA) team requests permission to inspect the build artifact before the deployment to the production environment occurs. The QA team wants to run an internal penetration testing tool to conduct manual tests. The tool will be invoked by a REST API call. Which combination of actions should the DevOps engineer take to fulfill this request? (Choose two.)
Options
34 comments in the community discussion
2
Labs on CodePipeline approvals and Lambda triggers helped with this one. A, E.
2
Its D and C. For D, the pipeline can hit the penetration testing tool REST API directly, doesn't seem like Lambda is needed here. C could fit since CodeDeploy groups allow hooks for manual steps. Not totally sure though if I missed something with CodePipeline stages.
Q: 6
A company has deployed an application in a production VPC in a single AWS account. The application is popular and is experiencing heavy usage. The company’s security team wants to add additional security, such as AWS WAF, to the application deployment. However, the application's product manager is concerned about cost and does not want to approve the change unless the security team can prove that additional security is necessary. The security team believes that some of the application's demand might come from users that have IP addresses that are on a deny list. The security team provides the deny list to a DevOps engineer. If any of the IP addresses on the deny list access the application, the security team wants to receive automated notification in near real time so that the security team can document that the application needs additional security. The DevOps engineer creates a VPC flow log for the production VPC. Which set of additional steps should the DevOps engineer take to meet these requirements MOST cost-effectively?
Options
27 comments in the community discussion
8
Option A. Similar practice questions point to CloudWatch Logs with a metric filter as the fastest and cheapest alerting option for this scenario.
2
Yeah, makes sense to pick A. CloudWatch metric filters plus SNS is about as cost-efficient and quick as it gets for alerting on VPC flow logs. The other options have way more moving parts. If someone found a cheaper way, let me know!
Q: 7
A company that runs many workloads on AWS has an Amazon EBS spend that has increased over time. The DevOps team notices there are many unattached EBS volumes. Although there are workloads where volumes are detached, volumes over 14 days old are stale and no longer needed. A DevOps engineer has been tasked with creating automation that deletes unattached EBS volumes that have been unattached for 14 days. Which solution will accomplish this?
Options
27 comments in the community discussion
5
C . CloudWatch + Lambda lets you actually target unattached volumes, while B is a common trap since Data Lifecycle Manager doesn't work for unattached EBS. Easy to miss that detail, but I've seen similar in exam prep.
1
Its C no question
Q: 8
A company has multiple development teams in different business units that work in a shared single AWS account All Amazon EC2 resources that are created in the account must include tags that specify who created the resources. The tagging must occur within the first hour of resource creation. A DevOps engineer needs to add tags to the created resources that Include the user ID that created the resource and the cost center ID The DevOps engineer configures an AWS Lambda function With the cost center mappings to tag the resources. The DevOps engineer also sets up AWS CloudTrail in the AWS account. An Amazon S3 bucket stores the CloudTrail event logs Which solution will meet the tagging requirements?
Options
36 comments in the community discussion
8
D . EventBridge lets you catch those EC2 API calls from CloudTrail in near real time so tagging happens quickly and automatically. The other options don’t hook directly into resource creation events the way D does. Pretty sure this is the most efficient solution, but open to seeing if someone had luck with C.
6
D . EventBridge picks up the EC2 API calls from CloudTrail almost instantly and triggers Lambda, so tags are added within the first hour every time. C could work but would be slower and might not tag fast enough. Pretty sure D is what AWS recommends for this flow. Anyone see a scenario where C might fit better?
Q: 9
A production account has a requirement that any Amazon EC2 instance that has been logged in to manually must be terminated within 24 hours. All applications in the production account are using Auto Scaling groups with the Amazon CloudWatch Logs agent configured. How can this process be automated?
Options
35 comments in the community discussion
1
D , official guide and practice exams cover this automation flow.
D , since this is the only option that fully automates the required workflow with tagging on manual login and scheduled termination, no humans needed. The CloudWatch Logs subscription to Lambda makes it seamless. One minor edge case: if you had very specific retention/audit or approval requirements, A could be consider
Q: 10
A company is using AWS CodePipeline to automate its release pipeline. AWS CodeDeploy is being used in the pipeline to deploy an application to Amazon Elastic Container Service (Amazon ECS) using the blue/green deployment model. The company wants to implement scripts to test the green version of the application before shifting traffic. These scripts will complete in 5 minutes or less. If errors are discovered during these tests, the application must be rolled back. Which strategy will meet these requirements?
Options
37 comments in the community discussion
6
Option C The AfterAllowTestTraffic hook in CodeDeploy runs tests after test traffic but before full production traffic, so errors found here can trigger rollback. Pretty sure that fits what the question's looking for.
3
C . AfterAllowTestTraffic lets you run tests on the green environment after test traffic but before shifting prod users, which matches what they're asking. D is a trap since AfterAllowTraffic happens after full cutover, so too late to catch errors before users hit it. Pretty sure this matches exam reports but open to c
Q: 11
A company is using an organization in AWS Organizations to manage multiple AWS accounts. The company's development team wants to use AWS Lambda functions to meet resiliency requirements and is rewriting all applications to work with Lambda functions that are deployed in a VPC. The development team is using Amazon Elastic Pile System (Amazon EFS) as shared storage in Account A in the organization. The company wants to continue to use Amazon EPS with Lambda Company policy requires all serverless projects to be deployed in Account B. A DevOps engineer needs to reconfigure an existing EFS file system to allow Lambda functions to access the data through an existing EPS access point. Which combination of steps should the DevOps engineer take to meet these requirements? (Select THREE.)
Options
5 comments in the community discussion
1
I don’t think D or C are right here. E is needed for VPC peering, and F covers cross-account IAM, so A, E, F makes sense. Always watch out for B as a trap since SCPs won’t grant service permissions directly.
C or D, I remember a similar question and always went with D for Lambda role permissions.
Q: 12
A company's application development team uses Linux-based Amazon EC2 instances as bastion hosts. Inbound SSH access to the bastion hosts is restricted to specific IP addresses, as defined in the associated security groups. The company's security team wants to receive a notification if the security group rules are modified to allow SSH access from any IP address. What should a DevOps engineer do to meet this requirement?
Options
10 comments in the community discussion
4
Option A not B. GuardDuty is a trap here since it doesn't alert on SG rule changes directly.
1
A
Q: 13
A company deploys its corporate infrastructure on AWS across multiple AWS Regions and Availability Zones. The infrastructure is deployed on Amazon EC2 instances and connects with AWS loT Greengrass devices. The company deploys additional resources on on-premises servers that are located in the corporate headquarters. The company wants to reduce the overhead involved in maintaining and updating its resources. The company's DevOps team plans to use AWS Systems Manager to implement automated management and application of patches. The DevOps team confirms that Systems Manager is available in the Regions that the resources are deployed m Systems Manager also is available in a Region near the corporate headquarters. Which combination of steps must the DevOps team take to implement automated patch and configuration management across the company's EC2 instances loT devices and on-premises infrastructure? (Select THREE.)
Options
6 comments in the community discussion
1
CEF imo. Systems Manager Patch Manager (C) handles the patching automation itself, but you'll need the proper IAM setup (E) for SSM to access both EC2 and on-prem/IoT devices. F is crucial because hybrid/on-prem and Greengrass need SSM Agent activation codes, otherwise they won't register as managed instances. Tagging
1
D imo, but does "automated management" mean periodic scheduling or just triggering patches when needed? That changes which to pick.
Q: 14
A company is developing an application that will generate log events. The log events consist of five distinct metrics every one tenth of a second and produce a large amount of data The company needs to configure the application to write the logs to Amazon Time stream The company will configure a daily query against the Timestream table. Which combination of steps will meet these requirements with the FASTEST query performance? (Select THREE.)
Options
5 comments in the community discussion
1
Its ADF, but memory store period can't be longer than magnetic so E is out if you check the docs.
Makes sense to stick with ADF. Batch writes (A) help performance, multi-measure (D) packs the metrics per timestamp, and memory retention in F is key for Timestream storage rules. Not 100% but this fits best.
Q: 15
A company has many AWS accounts. During AWS account creation the company uses automation to create an Amazon CloudWatch Logs log group in every AWS Region that the company operates in. The automaton configures new resources in the accounts to publish logs to the provisioned log groups in their Region. The company has created a logging account to centralize the logging from all the other accounts. A DevOps engineer needs to aggregate the log groups from all the accounts to an existing Amazon S3 bucket in the logging account. Which solution will meet these requirements in the MOST operationally efficient manner?
Options
9 comments in the community discussion
C is the way to go here. With multiple regions, AWS recommends setting up CloudWatch Log destinations and Kinesis streams per region to avoid cross-region latency and bottlenecks. This setup scales better and is more robust, especially when you have lots of accounts sending logs. Pretty sure that's what the exam wants,
Official AWS docs and practice exams both steer toward C. Region-specific Kinesis streams and Firehose for each region prevent bottlenecks and latency issues that can happen with a single centralized setup. Not 100% if there's a crazy new AWS feature, but this matches exam patterns I've seen reported. Agree?
Q: 16
To run an application, a DevOps engineer launches an Amazon EC2 instance with public IP addresses in a public subnet. A user data script obtains the application artifacts and installs them on the instances upon launch. A change to the security classification of the application now requires the instances to run with no access to the internet. While the instances launch successfully and show as healthy, the application does not seem to be installed. Which of the following should successfully install the application while complying with the new rule?
Options
5 comments in the community discussion
2
C, since using the S3 VPC endpoint lets you grab artifacts without any internet access. If the artifacts are in S3, C checks the compliance box. I think that's what AWS wants here. Disagree?
C tbh, because VPC endpoint for S3 lets instances download artifacts securely with no internet. But does the artifact repo only support S3? If it were on a different service, this might not work and B could be needed.
Q: 17
A company has chosen AWS to host a new application. The company needs to implement a multi- account strategy. A DevOps engineer creates a new AWS account and an organization in AWS Organizations. The DevOps engineer also creates the OU structure for the organization and sets up a landing zone by using AWS Control Tower. The DevOps engineer must implement a solution that automatically deploys resources for new accounts that users create through AWS Control Tower Account Factory. When a user creates a new account, the solution must apply AWS CloudFormation templates and SCPs that are customized for the OU or the account to automatically deploy all the resources that are attached to the account. All the OUs are enrolled in AWS Control Tower. Which solution will meet these requirements in the MOST automated way?
Options
11 comments in the community discussion
D since CfCT actually plugs into Control Tower lifecycle events so it does the SCP and CFN deployment as soon as an account is spun up, fully hands-off. StackSets (B) need extra management steps to keep in sync. Pretty sure CfCT wins on automation, unless something about the org changes. Anyone see a catch?
Yeah, D is the clear winner here since CfCT hooks directly into Control Tower’s lifecycle events and rolls out both CFN templates and SCPs without manual work. B gets you some automation but not the full hands-free integration. Pretty sure D is what AWS wants for this use case, but open if anyone thinks otherwise.
Q: 18
A company manages a web application that runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The EC2 instances run in an Auto Scaling group across multiple Availability Zones. The application uses an Amazon RDS for MySQL DB instance to store the dat a. The company has configured Amazon Route 53 with an alias record that points to the ALB. A new company guideline requires a geographically isolated disaster recovery (DR> site with an RTO of 4 hours and an RPO of 15 minutes. Which DR strategy will meet these requirements with the LEAST change to the application stack?
Options
4 comments in the community discussion
1
Option DLeast changes since you just add a cross-region read replica and DR stack, then promote if needed. RPO and RTO requirements are met pretty cleanly this way. Pretty sure that’s what AWS recommends for MySQL DR. Anyone see a reason B would actually be better?
1
B tbh, this setup feels right based on official guide and practice test questions.
Q: 19
A development team uses AWS CodeCommit, AWS CodePipeline, and AWS CodeBuild to develop and deploy an application. Changes to the code are submitted by pull requests. The development team reviews and merges the pull requests, and then the pipeline builds and tests the application. Over time, the number of pull requests has increased. The pipeline is frequently blocked because of failing tests. To prevent this blockage, the development team wants to run the unit and integration tests on each pull request before it is merged. Which solution will meet these requirements?
Options
7 comments in the community discussion
4
Option B
1
B makes sense here since it hooks into the pullRequestCreated event using EventBridge, then triggers CodeBuild for testing. That way, you automatically run tests before merges, which is what they want. D looks tempting but notification rules just send messages, they don't directly invoke builds. Pretty sure B is right
Q: 20
A company runs an application on one Amazon EC2 instance. Application metadata is stored in Amazon S3 and must be retrieved if the instance is restarted. The instance must restart or relaunch automatically if the instance becomes unresponsive. Which solution will meet these requirements?
Options
6 comments in the community discussion
1
C/D? Since EC2 Auto Recovery handles system failure but not app-level issues, but OpsWorks feels a bit heavyweight for just restart plus S3.
Maybe C fits-EC2 Auto Recovery should handle the restart if the instance hangs, and you can trigger S3 notifications to push metadata. Not sure if it's a trap since it doesn’t check app health like OpsWorks but seems close.
Question 1 of 20

Premium Access Includes

  • Quiz Simulator
  • Exam Mode
  • Progress Tracking
  • Question Saving
  • Flash Cards
  • Drag & Drops
  • 3 Months Access
  • PDF Downloads
Get Premium Access
Scroll to Top

FLASH OFFER

Days
Hours
Minutes
Seconds

avail 10% DISCOUNT on YOUR PURCHASE