AWS Certified DevOps Engineer — Professional (DOP-C02) practice questions and exam guide

A CodeBuild project compiles a Java app and runs a 12-minute test suite. The team wants to share a 4 GB Gradle dependency cache across builds and concurrent runs to cut build time. Which cache configuration BEST fits?

1. S3 cache with paths pointing at the Gradle cache directory
2. It fails closed when any dependent AWS service is degraded
3. It cannot integrate with AWS Systems Manager runbooks here
4. It is a container-only feature not supported on serverless

Answer: A — S3 cache with paths pointing at the Gradle cache directory

Local cache is per-host and lost when the host recycles. S3 cache persists and is shared across concurrent builds. DOCKER_LAYER_CACHE is for Docker layers. CUSTOM_CACHE is local-host only.

A CodePipeline deploys CloudFormation. A change to a NAT Gateway subnet inadvertently replaces the NAT and drops production traffic for 4 minutes. The team wants to catch replacements BEFORE they happen. Which change BEST prevents recurrence?

1. Switch the deploy action to use a change set with replacement detection and require manual approval before execution when a replacement is detected
2. Enable CloudTrail data events on the NAT Gateway to log the change after it happens
3. Add an S3 lifecycle rule that prevents accidental object deletion
4. Configure the pipeline to run entirely on Fargate to avoid EC2-related NAT issues

Answer: A — Switch the deploy action to use a change set with replacement detection and require manual approval before execution when a replacement is detected

Change sets surface resource replacements before execute. Pairing with manual approval blocks the destructive change. B detects post-incident. C prevents stack delete, not resource replacement. D doesn't change replacement semantics.

A CDK app needs to generate an IAM policy whose actions depend on a config file processed at synth time. Which construct/pattern is MOST appropriate?

1. It only functions when all resources are in a single AZ zone
2. It writes findings to S3 only and cannot notify EventBridge for th
3. Read the config in TypeScript and pass values into PolicyStatement
4. It runs exclusively on Fargate and cannot target EC2 fleets for th

Answer: C — Read the config in TypeScript and pass values into PolicyStatement

CDK is code — synth-time config is just programmatic input. B is for cross-cutting concerns (e.g., tag enforcement). A introduces a macro for no reason. D runs at deploy, not synth.

A team's SAM template defines an API Gateway + Lambda. Local testing with 'sam local invoke' works, but deploy fails with 'Transform AWS::Serverless-2016-10-31 not supported'. What is the FIX?

1. Run 'sam build' then 'sam deploy --guided', which packages the template (resolving the Transform) before invoking CloudFormation
2. Switch the API Gateway resource to a plain CloudFormation resource instead of SAM
3. Add a Transform override flag to 'aws cloudformation deploy' to skip packaging
4. Deploy directly with 'aws cloudformation create-stack' using the unpackaged SAM template

Answer: A — Run 'sam build' then 'sam deploy --guided', which packages the template (resolving the Transform) before invoking CloudFormation

SAM templates require the Transform header; sam deploy handles it. Direct 'aws cloudformation deploy' on a SAM template without packaging will fail. B/C/D miss the point.

A team wants RTO of 5 minutes and RPO of 1 minute for a transactional Postgres workload across two regions. Which architecture is BEST?

1. Standard RDS Multi-AZ within a single region with automated backups
2. Aurora Global Database with managed cross-region replication (typically sub-second replica lag) and managed failover for fast RTO
3. Nightly cross-region snapshot copies with manual restore on failure
4. A read replica in a second region promoted manually after an outage is confirmed

Answer: B — Aurora Global Database with managed cross-region replication (typically sub-second replica lag) and managed failover for fast RTO

Aurora Global Database provides sub-second RPO and managed RTO. B is slower. C misses RPO. D is single-region.

PREDICTIVE SCALING (ASG):

1. It only functions when all resources are in a single AZ zone
2. It writes findings to S3 only and cannot notify EventBridge
3. Uses ML to FORECAST capacity needs based on historical patterns
4. It runs exclusively on Fargate and cannot target EC2 fleets

Answer: C — Uses ML to FORECAST capacity needs based on historical patterns

Predictive scaling: ML-based proactive scaling. Analyzes 14+ days of metrics. Generates daily forecast. Works alongside dynamic scaling (target tracking) as additional layer. Best for cyclical/predictable workloads (e-commerce, content sites). DOP advanced scaling.

Which is the BEST observability stack for AWS applications?

1. It only functions when all resources are in a single AZ zone
2. CloudWatch Logs/Metrics/Logs Insights/Alarms + X-Ray distributed
3. It writes findings to S3 only and cannot notify EventBridge for th
4. It runs exclusively on Fargate and cannot target EC2 fleets for th

Answer: B — CloudWatch Logs/Metrics/Logs Insights/Alarms + X-Ray distributed

AWS observability: CloudWatch (logs, metrics, alarms, dashboards, Logs Insights for queries), X-Ray (traces), Container Insights (EKS/ECS), Application Insights (SQL/.NET). OpenTelemetry integration. SLA monitoring via CloudWatch Synthetics canaries.

A CloudWatch composite alarm should fire only if BOTH 'high error rate' AND 'low traffic' alarms are active. Which BEST describes composite alarm behavior?

1. It only functions when all resources are in a single AZ zone
2. It writes findings to S3 only and cannot notify EventBridge
3. Composite alarms evaluate boolean expressions over child alarm
4. It runs exclusively on Fargate and cannot target EC2 fleets

Answer: C — Composite alarms evaluate boolean expressions over child alarm

Composite supports AND/OR/NOT over child alarm states. B/C/D wrong.

An on-call escalation should page primary, then secondary after 10 minutes if not acknowledged. Which service BEST implements this?

1. AWS Systems Manager Incident Manager with engagement plans
2. It only functions when all resources are in a single AZ zone
3. It writes findings to S3 only and cannot notify EventBridge
4. It runs exclusively on Fargate and cannot target EC2 fleets

Answer: A — AWS Systems Manager Incident Manager with engagement plans

Incident Manager engagement plans handle escalation with ack windows. SNS fan-outs to everyone immediately.

An EventBridge rule fires on every CloudTrail RootAccountUsage event but the SSM Automation target receives no events. The rule shows InvokeTargetsFailures > 0. What is the MOST LIKELY cause?

1. It only functions when all resources are in a single AZ zone
2. It writes findings to S3 only and cannot notify EventBridge
3. The EventBridge rule's IAM role lacks ssm:StartAutomationExecutio
4. It runs exclusively on Fargate and cannot target EC2 fleets

Answer: C — The EventBridge rule's IAM role lacks ssm:StartAutomationExecutio

InvokeTargetsFailures plus 'no events received' is classic missing target IAM. B/C/D wrong.

A team needs all CloudTrail logs to be immutable and queryable via SQL for 7 years. Which BEST combination meets the requirement?

1. It only functions when all resources are in a single AZ zone
2. It writes findings to S3 only and cannot notify EventBridge for th
3. CloudTrail Lake event data store with extended retention up to 7
4. It runs exclusively on Fargate and cannot target EC2 fleets for th

Answer: C — CloudTrail Lake event data store with extended retention up to 7

CloudTrail Lake supports up to 7-year retention + SQL. Object Lock for immutability. B is short retention. C lacks immutability. D wrong.

Which is the BEST way to enforce security policies in IaC?

1. Manually reviewing templates in pull requests with no automated tooling
2. cfn-lint / cfn-nag (CloudFormation linting) and CDK Aspects for pre-deployment policy checks, backed by AWS Config rules post-deployment
3. Relying solely on IAM permissions to block insecure resource creation
4. Running security scans only after resources are already deployed to production

Answer: B — cfn-lint / cfn-nag (CloudFormation linting) and CDK Aspects for pre-deployment policy checks, backed by AWS Config rules post-deployment

Policy-as-code for IaC: pre-deployment linting (cfn-nag, cfn-lint, Checkov, tfsec). CDK Aspects programmatic enforcement. Post-deployment AWS Config rules + remediation. Defense in depth.

ECS rolling update?

MinimumHealthyPercent + MaximumPercent control rate. Default 100/200.

Image Builder?

Automated AMI creation pipeline. Apply patches, run tests, distribute.

Change calendar?

AWS Systems Manager. Block automation during freeze windows.

GitHub integration with CodePipeline?

Source action via GitHub OAuth or CodeStar Connections. Webhook triggers.

CloudWatch RUM?

Real User Monitoring. Browser-side performance metrics.

AWS SAM?

Serverless Application Model. CloudFormation extension for serverless.