AWS DevOps Engineer Professional (DOP-C02) Practice Questions¶

40 scenario-based questions weighted by exam domain.

Exam Domain Breakdown¶

Cert page: exams/aws/professional/devops-engineer-pro-dop-c02/

Domain 1: SDLC Automation (Questions 1-9)¶

Question 1¶

Scenario: A development team wants to implement a CI/CD pipeline that automatically deploys to production after passing tests in staging. However, they need a manual approval gate before production deployment and want to roll back automatically if CloudWatch alarms trigger within 10 minutes of deployment.

A. Use CodePipeline with manual approval action, CodeDeploy with CloudWatch alarms for automatic rollback B. Use Jenkins with AWS plugins and custom rollback scripts C. Use CodePipeline with Lambda approval function and CodeDeploy blue/green deployment D. Use Step Functions to orchestrate deployment with manual approval and rollback logic

Question 2¶

Scenario: A company uses CodeCommit for source control. They want to enforce that all commits are GPG-signed and that no one can push directly to the main branch without a pull request review.

A. Configure CodeCommit repository settings to require signed commits B. Use IAM policies to deny codecommit:GitPush to main branch and implement approval rule templates C. Set up a Lambda trigger to reject unsigned commits D. Use AWS Organizations SCP to enforce commit signing

Question 3¶

Scenario: A team wants to implement automated testing in their pipeline including unit tests, integration tests, and security scanning. Integration tests require a database, and security scanning should check for vulnerabilities in dependencies. What's the most efficient pipeline structure?

A. Run all tests sequentially in a single CodeBuild project B. Use CodePipeline with parallel actions: CodeBuild for unit tests, CodeBuild with RDS for integration tests, and Amazon Inspector for security scanning C. Use CodePipeline with parallel actions: CodeBuild for unit/integration tests with LocalStack, and CodeBuild with Snyk/Trivy for dependency scanning D. Use GitHub Actions for testing and CodePipeline for deployment only

Question 4¶

Scenario: A company wants to standardize their CI/CD pipelines across 50 microservices. Each service has similar build, test, and deploy stages but different configuration values. How should they implement this efficiently?

A. Create 50 separate CodePipeline definitions in CloudFormation B. Use CodePipeline with a single reusable CloudFormation template and parameters for service-specific values C. Implement CodeCatalyst workflows with reusable workflow templates D. Create a custom CI/CD framework using Step Functions

Question 5¶

Scenario: A development team deploys Lambda functions using SAM. They want to implement canary deployments where 10% of traffic goes to the new version for 10 minutes before full rollout. If errors increase, the deployment should automatically roll back.

A. Use SAM with DeploymentPreference type Canary10Percent10Minutes and configure alarms B. Use Lambda aliases with manual traffic shifting C. Deploy two Lambda versions behind API Gateway with weighted routing D. Use CodeDeploy Lambda deployment with custom deployment configuration

Question 6¶

Scenario: A team needs to deploy an application to both development and production accounts. The pipeline runs in a central DevOps account. They want to use the same pipeline definition but deploy to different accounts based on the branch (develop → dev account, main → prod account).

A. Create separate pipelines for each account B. Use CodePipeline with cross-account roles, branch-based triggers, and account-specific stages C. Deploy from local machines using AWS CLI with different profiles D. Use CodePipeline with account ID as a parameter that changes per deployment

Question 7¶

Scenario: A company wants to implement feature flags that can be changed without redeploying the application. Flags should support gradual rollouts (e.g., 10% of users see new feature) and instant kill switches. What AWS service should they use?

A. Systems Manager Parameter Store with Lambda to manage flag logic B. AWS AppConfig with feature flags C. DynamoDB with application-level caching D. S3 with CloudFront for configuration file distribution

Question 8¶

Scenario: A team uses CodeBuild for their builds. Build times have increased to 15 minutes, with 5 minutes spent downloading dependencies. How can they reduce build time?

A. Use a larger CodeBuild instance B. Enable CodeBuild local caching and store dependencies in an S3 cache C. Pre-install dependencies in a custom Docker image D. Both B and C

Question 9¶

Scenario: A company needs to deploy to an on-premises data center as part of their hybrid CI/CD pipeline. The deployment target is a fleet of Linux servers behind a firewall that cannot accept inbound connections.

A. Install CodeDeploy agent with VPN connection back to AWS B. Use CodeDeploy on-premises instances with the agent polling for deployments C. Use Systems Manager Hybrid Activations with Run Command D. Both B and C are valid approaches

Domain 2: Configuration Management and IaC (Questions 10-16)¶

Question 10¶

Scenario: A company manages infrastructure across 20 AWS accounts using CloudFormation. They want to ensure all accounts have consistent VPC configurations, security groups, and IAM roles. Updates should roll out to all accounts with failure handling.

A. Manually deploy CloudFormation stacks to each account B. Use CloudFormation StackSets with automatic deployment to organizational units C. Use Terraform with multiple provider configurations D. Create Lambda functions to deploy templates to each account

Question 11¶

Scenario: A team uses CloudFormation for infrastructure. They need to update an RDS instance from db.t3.medium to db.t3.large. The update requires replacement, which would cause data loss. How should they handle this?

A. Add a DeletionPolicy: Snapshot to the RDS resource B. Create a new RDS instance with the larger size and migrate data manually C. Use CloudFormation stack policies to prevent replacement D. Modify the instance directly in the console and update the template

Question 12¶

Scenario: A team needs to manage secrets used by their CloudFormation-deployed applications. Secrets should be encrypted, rotatable, and not stored in version control. CloudFormation templates should reference secrets without exposing values.

A. Use CloudFormation parameters with NoEcho B. Store secrets in Secrets Manager and use dynamic references in CloudFormation C. Encrypt secrets in S3 and reference them in templates D. Use SSM Parameter Store SecureString with KMS encryption

Question 13¶

Scenario: A company uses AWS CDK for infrastructure. They want to implement a policy that requires all S3 buckets to have encryption and versioning enabled. This should be enforced before deployment, not after.

A. Use AWS Config rules to detect non-compliant buckets B. Implement CDK Aspects to validate and modify constructs before synthesis C. Use CloudFormation Guard to validate synthesized templates D. Both B and C

Question 14¶

Scenario: A team wants to implement infrastructure testing. They need to verify that deployed infrastructure matches expected configuration (e.g., security groups have correct rules, instances are in the right subnets). What approach should they use?

A. Use CloudFormation drift detection B. Implement infrastructure tests using AWS SDK calls in their CI/CD pipeline C. Use Open Policy Agent (OPA) with Terraform D. Use AWS Config conformance packs

Question 15¶

Scenario: A company needs to automate AMI creation with security patches applied. AMIs should be tested before promotion to production. The process should run monthly.

A. Use EC2 Image Builder with image pipelines, test components, and distribution settings B. Create a Lambda function that launches an instance, runs updates, and creates an AMI C. Use Packer with CodeBuild scheduled by EventBridge D. Manually update and create AMIs monthly

Question 16¶

Scenario: A team has CloudFormation stacks deployed across multiple regions. They need to update a parameter value (e.g., AMI ID) in all regions atomically. If any region fails, all should roll back.

A. Update stacks sequentially in each region B. Use StackSets with SEQUENTIAL operation preference C. Use StackSets with operation preferences for failure tolerance set to 0 D. Use CodePipeline with parallel deploy actions

Domain 3: Resilient Cloud Solutions (Questions 17-22)¶

Question 17¶

Scenario: An application runs on EC2 in an Auto Scaling group. During deployments, the ASG scales up with new instances, but old instances must complete in-flight requests before termination (up to 5 minutes). How should this be configured?

A. Set the ASG health check grace period to 5 minutes B. Use lifecycle hooks with a heartbeat timeout of 5 minutes on instance termination C. Configure connection draining on the load balancer D. Both B and C

Question 18¶

Scenario: A company wants to implement automatic recovery for their application. If the primary region becomes unavailable, traffic should failover to the DR region within 5 minutes. The application is stateless but requires a healthy instance to be running in DR.

A. Use Route 53 health checks with failover routing and maintain a warm standby in DR B. Use CloudFront with origin failover C. Implement Global Accelerator with endpoint health checks D. All of the above can achieve the requirement

Question 19¶

Scenario: An application processes messages from SQS. If the application crashes, messages should not be lost and should be reprocessed. If a message fails repeatedly (poison pill), it should be moved aside for investigation. What configuration is needed?

A. Configure visibility timeout longer than processing time and set up a dead-letter queue with maxReceiveCount B. Use FIFO queue with deduplication C. Enable long polling D. Use multiple consumers with message grouping

Question 20¶

Scenario: A company runs stateful containers on ECS. They need to ensure that when a container task fails, a new task is started and can access the same data. Tasks run in Fargate.

A. Use EBS volumes attached to tasks B. Use EFS file systems mounted to tasks C. Use S3 for data storage D. Use instance store volumes

Question 21¶

Scenario: A database application needs to survive an Availability Zone failure without data loss. It uses PostgreSQL and requires synchronous replication. What is the most appropriate AWS service?

A. RDS PostgreSQL with Multi-AZ deployment B. Aurora PostgreSQL with read replicas C. RDS PostgreSQL with cross-region read replica D. Self-managed PostgreSQL on EC2 with synchronous replication

Question 22¶

Scenario: A company wants to implement chaos engineering to test system resilience. They want to randomly terminate EC2 instances during business hours to verify the application handles failures gracefully.

A. Write a Lambda function triggered by CloudWatch Events to randomly terminate instances B. Use AWS Fault Injection Simulator (FIS) with EC2 actions C. Use Systems Manager Automation documents to terminate instances D. Manually terminate instances periodically

Domain 4: Monitoring and Logging (Questions 23-28)¶

Question 23¶

Scenario: A company needs centralized logging from EC2 instances, Lambda functions, and containers. They want to search logs, create dashboards, and set up alerts when error rates exceed thresholds.

A. Use CloudWatch Logs with Logs Insights, dashboards, and metric filters for alarms B. Use Elasticsearch (OpenSearch) cluster with Kibana C. Send all logs to S3 and use Athena for querying D. Use third-party logging service

Question 24¶

Scenario: A microservices application has high latency issues. The team needs to identify which service is causing the bottleneck. Requests pass through API Gateway, Lambda, and DynamoDB.

A. Enable CloudWatch detailed monitoring on all services B. Implement AWS X-Ray tracing across all services C. Add custom logging with timestamps at each service boundary D. Use CloudWatch ServiceLens

Question 25¶

Scenario: A company wants to monitor API Gateway for 4XX and 5XX errors and alert when error rate exceeds 5% of total requests over 5 minutes. How should they configure this?

A. Create CloudWatch alarms on Count metrics for 4XXError and 5XXError B. Use CloudWatch metric math to calculate error rate: (4XX + 5XX) / Count * 100, create alarm on this expression C. Enable API Gateway access logging and create metric filters D. Use CloudWatch Contributor Insights

Question 26¶

Scenario: A company needs to retain CloudWatch Logs for 7 years for compliance. They also need the ability to search recent logs (last 30 days) quickly. How should they configure retention?

A. Set CloudWatch Logs retention to 7 years B. Set CloudWatch Logs retention to 30 days and create a subscription filter to stream logs to S3 for long-term storage C. Set CloudWatch Logs retention to never expire D. Export logs to S3 daily using Lambda

Question 27¶

Scenario: A company wants to be notified immediately when someone logs into the AWS console as root user or when root credentials are used for API calls.

A. Create an EventBridge rule for AWS Console Sign-in events with root user filter B. Create a CloudWatch alarm on root user API activity metrics C. Use GuardDuty to detect root credential usage D. Create EventBridge rules for both console sign-in and CloudTrail API events filtering for root

Question 28¶

Scenario: A company runs containers on EKS and needs to collect metrics from applications using Prometheus format. They want to visualize metrics in Grafana and store them long-term.

A. Deploy self-managed Prometheus and Grafana on EKS B. Use Amazon Managed Service for Prometheus (AMP) and Amazon Managed Grafana C. Use CloudWatch Container Insights with Prometheus metrics collection D. Both B and C

Domain 5: Incident and Event Response (Questions 29-34)¶

Question 29¶

Scenario: An Auto Scaling group has instances failing health checks and being replaced repeatedly. The team needs to troubleshoot but instances terminate before they can investigate. How should they approach this?

A. Increase the health check grace period B. Suspend the ReplaceUnhealthy process, investigate, then resume C. Remove health checks temporarily D. SSH into instances before they fail

Question 30¶

Scenario: A company wants automated incident response when GuardDuty detects cryptocurrency mining activity. The response should isolate the affected instance, create a snapshot for investigation, and notify the security team.

A. Configure GuardDuty to send findings to CloudWatch Events and trigger a Lambda function for remediation B. Configure GuardDuty to send findings to EventBridge, trigger Step Functions orchestrating remediation actions C. Manually review GuardDuty findings daily D. Use Security Hub to aggregate and respond to findings

Question 31¶

Scenario: During a production incident, the team needs to quickly roll back an ECS service to the previous task definition version. What's the fastest approach?

A. Update the CloudFormation stack with the previous task definition B. Use ECS UpdateService API to specify the previous task definition ARN C. Redeploy through the CI/CD pipeline with previous code version D. Create a new task definition and update the service

Question 32¶

Scenario: A company uses Systems Manager to manage their EC2 fleet. They need to automatically patch instances during maintenance windows and roll back if patching causes failures.

A. Use SSM Patch Manager with maintenance windows and patch baselines B. Create custom SSM documents for patching C. Use AWS-RunPatchBaseline with automatic rollback on failure D. Schedule Lambda functions to apply patches

Question 33¶

Scenario: A DynamoDB table is experiencing throttling. CloudWatch shows consumed capacity exceeding provisioned. The table uses provisioned capacity mode. What immediate action should be taken?

A. Switch to on-demand capacity mode B. Increase provisioned read/write capacity C. Enable DynamoDB auto scaling D. Add a DAX cluster

Question 34¶

Scenario: A company needs to create runbooks for common operational tasks like restarting services, clearing caches, and rotating credentials. These should be executable by operators without requiring console access.

A. Create wiki documentation with CLI commands B. Implement SSM Automation documents with approval workflows C. Create Lambda functions for each task D. Use Step Functions state machines

Domain 6: Security and Compliance (Questions 35-40)¶

Question 35¶

Scenario: A company needs to ensure all data at rest is encrypted across their AWS environment. They want automated detection of unencrypted resources and automatic remediation where possible.

A. Use AWS Config rules to detect unencrypted resources and Lambda for remediation B. Use Security Hub with AWS Foundational Security Best Practices standard C. Manually audit resources monthly D. Use SCPs to prevent creation of unencrypted resources

Question 36¶

Scenario: A DevOps team needs access to production EC2 instances for troubleshooting but the security team doesn't want to manage SSH keys or open port 22. How should they provide secure access?

A. Use EC2 Instance Connect B. Use Session Manager with IAM-based access control C. Set up a bastion host with key management D. Use AWS Cloud9 for instance access

Question 37¶

Scenario: A CI/CD pipeline needs to deploy to AWS. The pipeline runs on self-hosted runners outside AWS. What's the most secure way to provide AWS credentials to the pipeline?

A. Store AWS access keys in the pipeline's secrets management B. Use IAM Roles Anywhere with X.509 certificates C. Store access keys in environment variables D. Use EC2 instance roles

Question 38¶

Scenario: A company needs to scan container images for vulnerabilities before deployment. They use ECR for container registry. Scanning should happen automatically when images are pushed.

A. Enable ECR basic scanning on push B. Enable ECR enhanced scanning with Amazon Inspector C. Use third-party scanning tools in the CI/CD pipeline D. Both A and B provide automatic scanning, but B provides deeper analysis

Question 39¶

Scenario: A company needs to rotate database credentials used by applications automatically. Applications run on Lambda and retrieve credentials at runtime. How should they implement this?

A. Store credentials in environment variables and redeploy Lambda when rotating B. Use Secrets Manager with automatic rotation and Lambda retrieves credentials using the SDK C. Store credentials in Parameter Store SecureString and rotate manually D. Use IAM database authentication

Question 40¶

Scenario: A company must ensure their AWS environment meets PCI DSS compliance. They need continuous compliance monitoring with evidence collection for auditors.

A. Use AWS Config with PCI DSS conformance pack B. Hire auditors to manually check compliance quarterly C. Use AWS Artifact for compliance reports only D. Implement all controls manually and document

Answer Key¶