AWS Certified DevOps Engineer — Professional (DOP-C02)

CodePipeline is the orchestrator and the single most tested service on DOP-C02. Know stages, actions, and artifacts cold; manual approval actions; cross-region and cross-account actions (artifact bucket + KMS key + role in each target); EventBridge-based triggers vs polling; and Lambda invoke actions for custom steps. Multi-account pipeline patterns (tooling account deploys to workload accounts by assuming roles) come up repeatedly. Expect 5-8 questions directly on CodePipeline mechanics.

CodeBuild runs builds and tests. Know buildspec.yml structure (phases, artifacts, reports, cache), environment variable sources (plaintext vs Parameter Store vs Secrets Manager — the exam loves "how do I keep this secret out of the buildspec"), VPC connectivity for private resources, batch builds, and local caching modes. Understand how CodeBuild assumes its service role and how to grant it ECR/S3 access. Expect 3-5 questions.

Pipelines start from a source. Know CodeConnections (formerly CodeStar Connections) for GitHub/GitLab/Bitbucket sources, S3 as a source (versioning required), and legacy CodeCommit (closed to new customers since July 2024 but still in the exam pool). Understand triggering builds from pull requests and branch filters, and cross-account access to repositories. Expect 1-3 questions, usually embedded in a pipeline scenario.

Know which test belongs at which stage: unit tests and static analysis in the build stage, integration tests after deploy to a test environment, load tests before production, canary/synthetic tests after production deploy. Understand exit-code-based health (a non-zero exit code fails the CodeBuild phase and stops the pipeline), test reports in CodeBuild, and invoking Step Functions or Lambda from a pipeline for custom validation. Expect 2-3 questions.

CodeGuru Reviewer does automated code review (security findings, resource leaks) on pull requests; CodeGuru Profiler finds runtime performance hotspots. On the exam it is the answer when a scenario asks for machine-learning-driven code quality or security scanning inside the development workflow. Usually one question or a distractor.

CodeArtifact hosts private package repositories (npm, pip, Maven, NuGet, generic). Know domains vs repositories, upstream repositories with external connections to public registries (cache and control open-source dependencies), and cross-account sharing via domain resource policies. It is the answer when a scenario wants approved/curated dependencies for builds. Expect 1-2 questions.

ECR stores container images. Know image scanning (basic on-push vs enhanced continuous scanning via Inspector), lifecycle policies to expire old/untagged images, cross-region and cross-account replication, immutable tags, and pull-through cache. Repository policies for cross-account pulls appear in multi-account pipeline questions. Expect 2-3 questions.

Image Builder automates golden AMI and container image pipelines: recipes (components + base image), build/test phases, distribution to multiple regions and accounts, and scheduled rebuilds when the base image updates. It is the answer when a scenario wants automated, tested, patched AMIs shared across an organization — replacing hand-rolled Packer/Lambda pipelines. Expect 1-2 questions.

CodeDeploy is tested as heavily as CodePipeline. Know all three compute platforms (EC2/on-premises, Lambda, ECS), deployment configurations (AllAtOnce, HalfAtATime, OneAtATime, Canary10Percent5Minutes, Linear10PercentEvery1Minute and how to build custom ones), appspec.yml per platform, lifecycle hooks in order, automatic rollback on failure or CloudWatch alarm, and the CodeDeploy agent (required on EC2, log location for troubleshooting). In-place vs blue/green on EC2 is a classic question. Expect 4-6 questions.

The exam constantly asks you to pick the right deployment pattern for a constraint set: zero downtime, instant rollback, cost, DNS caching risk, database schema compatibility. Know the trade-offs: in-place/rolling (mutable, cheap, slow rollback), immutable/blue-green (new fleet, instant rollback by re-pointing, double cost during deploy), canary (small traffic slice first, needs alarms to be useful), and where the traffic shift happens (Route 53 weighted records, ALB listener/target groups, Lambda alias weights, ECS task sets). Expect 3-5 questions.

Serverless deployment questions center on Lambda versions and aliases: publish an immutable version, point an alias at it, and shift traffic gradually with alias weights. CodeDeploy drives canary/linear shifts with pre/post traffic hooks and alarm-based rollback; SAM wraps this with AutoPublishAlias and DeploymentPreference. Know API Gateway stage variables and canary settings for the API layer. Expect 2-3 questions.

Container deployment scenarios are frequent. For ECS know the three deployment types: rolling update (minimumHealthyPercent/maximumPercent), blue/green via CodeDeploy (two target groups, test listener, ValidateService hooks, alarm rollback), and external. For EKS know that CodeDeploy does not deploy to EKS — answers involve rolling updates via Kubernetes deployments, Helm, or a CodeBuild step running kubectl with an IAM-mapped role. Expect 3-4 questions.

Beanstalk still earns questions at the Professional level. Know the five deployment policies and their trade-offs (all at once, rolling, rolling with additional batch, immutable, traffic splitting), CNAME swap for blue/green, .ebextensions for configuration, and worker environments. The classic question: which policy gives zero downtime at least cost vs fastest rollback. Expect 2-3 questions.

CloudFormation is the most tested Domain 2 service. Know template anatomy, intrinsic functions, change sets (preview before update), stack policies and DeletionPolicy/UpdateReplacePolicy (protect stateful resources), drift detection, nested stacks vs cross-stack exports, cfn-init/cfn-signal with creation policies for EC2 bootstrapping, and rollback behavior including alarm-based rollback triggers. Failed-update troubleshooting (UPDATE_ROLLBACK_FAILED, what to do) is a recurring scenario. Expect 4-6 questions.

StackSets deploy one template to many accounts and regions. Know self-managed permissions (AWSCloudFormationStackSetAdministrationRole + ExecutionRole) vs service-managed permissions (Organizations integration, automatic deployment to new accounts in an OU), stack instances, operation preferences (region order, failure tolerance, max concurrent), and drift detection on stack sets. This is the default answer for "roll out X to every account". Expect 2-4 questions.

When CloudFormation can't do something natively, a custom resource (Lambda-backed, responds to Create/Update/Delete with a signed URL callback) fills the gap. Macros transform templates at deploy time (SAM is a macro); modules package reusable resource collections; hooks proactively validate resources against policy before provisioning. Know which to pick for "extend CloudFormation" scenarios. Expect 1-2 questions.

The CDK defines infrastructure in real programming languages and synthesizes CloudFormation. Know constructs (L1/L2/L3), apps and stacks, cdk synth/diff/deploy, bootstrapping (the CDKToolkit stack per account/region), and CDK Pipelines for self-mutating CI/CD. On the exam CDK appears as the reusable-components answer (publish construct libraries) and inside pipeline scenarios. Expect 1-3 questions.

SAM is CloudFormation shorthand for serverless (Transform: AWS::Serverless-2016-10-31). Know the resource types (Function, Api, Table), sam build/deploy/local, and above all the gradual deployment integration with CodeDeploy — AutoPublishAlias plus DeploymentPreference gives canary/linear Lambda releases with alarms and hooks. Expect 1-2 questions.

Service Catalog packages approved CloudFormation templates as products in portfolios, with launch constraints so end users deploy with a role they don't otherwise have — the answer for "let developers self-serve approved infrastructure without broad IAM permissions". Proton does the same for containerized/serverless application templates with platform-team-managed environment and service templates. Expect 1-2 questions.

Organizations is foundational to half the exam's governance scenarios. Know OUs and policy inheritance, service control policies (SCPs are guardrails — they never grant permissions, don't affect the management account, and deny wins), delegated administrator for services, trusted access, tag policies, and consolidated billing. The classic question shape: prevent all accounts in an OU from doing X, or allow only region Y. Expect 3-4 questions.

Control Tower is opinionated multi-account setup: a landing zone with log archive and audit accounts, Account Factory for standardized account vending (including Account Factory for Terraform), and controls (guardrails) that are preventive (SCPs), detective (Config rules), or proactive (CloudFormation hooks). It is the answer when a scenario wants automated, governed account provisioning without building it from raw Organizations + StackSets. Expect 2-3 questions.

Know IAM Identity Center (successor to AWS SSO) for workforce access: permission sets provision roles into accounts, identity source can be the built-in store, Active Directory, or an external SAML IdP. For automation, know the cross-account role-assumption pattern (trust policy + sts:AssumeRole) that underpins multi-account pipelines. Expect 1-2 questions.

Systems Manager is the fleet-management answer across Domains 2, 4, and 5. Know the capabilities by name and use case: Run Command (ad hoc commands, no SSH), State Manager (desired-state associations), Patch Manager (patch baselines + maintenance windows), Automation (runbooks — the remediation building block), Session Manager (auditable shell, no bastions or open ports), Inventory + Compliance, Parameter Store, and the SSM Agent + instance role prerequisites. Hybrid activations manage on-premises servers. Expect 4-5 questions.

Config records resource configuration history and evaluates it against rules. Know managed vs custom rules (Lambda or Guard), evaluation triggers (configuration change vs periodic), automatic remediation via SSM Automation runbooks, conformance packs (rule bundles, deployable org-wide), aggregators for multi-account/multi-region visibility, and the difference from CloudTrail (what changed vs who called what). Expect 3-4 questions.

Custom automation glue: EventBridge rule triggers a Lambda function or Step Functions state machine that calls AWS SDKs. Know when Step Functions beats a single Lambda (long-running, retries per step, human approval via task tokens, direct SDK integrations without code) and Lambda operational limits (15-minute timeout, concurrency). Expect 1-2 questions, usually inside a remediation scenario.

AppConfig deploys application configuration and feature flags gradually with validators and automatic alarm-based rollback — the answer for "change config without redeploying code, safely". OpsWorks (Chef/Puppet) reached end of life in 2024 but still appears in the exam guide; treat it as a legacy distractor and know only that it was AWS-managed Chef/Puppet configuration management. Expect 1 question between them.

Route 53 is the multi-region traffic layer. Know routing policies (failover, weighted, latency, geolocation), health checks (endpoint, calculated, CloudWatch-alarm-based) and how failover routing pairs with them, alias records, and evaluate-target-health. Application Recovery Controller readiness checks and routing controls show up for regional failover with strict control. Expect 2-3 questions.

Know ALB vs NLB selection, cross-zone load balancing (default on for ALB, off for NLB), health checks and how they interact with Auto Scaling replacement, target group deregistration delay, and multi-AZ target distribution. Gateway Load Balancer is a distractor unless the scenario involves third-party appliances. Expect 1-2 questions.

Match each data service to its HA and cross-region mechanism: RDS Multi-AZ (synchronous standby, failover not scaling) vs read replicas (async, cross-region capable, promotable); Aurora replicas and Global Database (sub-second cross-region replication, ~1 minute promotion); DynamoDB global tables (multi-active, last-writer-wins); S3 Cross-Region Replication (new objects only, versioning required, RTC for a 15-minute SLA); ElastiCache Redis Multi-AZ and Global Datastore. Expect 3-4 questions.

Auto Scaling groups appear across every domain. Know scaling policy types (target tracking first choice, step, simple, scheduled, predictive), lifecycle hooks (run actions during launch/terminate — pairs with CodeDeploy and log-draining scenarios), health check types (EC2 vs ELB grace period), instance refresh for rolling AMI updates, warm pools, termination policies, and cooldowns. Expect 3-5 questions.

Application Auto Scaling covers everything that is not an EC2 ASG: DynamoDB provisioned capacity, ECS service desired count, Aurora replicas, Lambda provisioned concurrency, and more. Know that the exam guide explicitly names DynamoDB auto scaling, RDS storage autoscaling, ECS capacity providers, and EKS autoscalers as scaling capabilities to distinguish. Expect 1-2 questions.

Two scaling layers: tasks/pods and the compute under them. For ECS, service auto scaling handles tasks and capacity providers with managed scaling handle the ASG (or use Fargate and skip it). For EKS, know Cluster Autoscaler and Karpenter for nodes, Horizontal Pod Autoscaler for pods, and Fargate profiles. Expect 1-2 questions.

Serverless scales by default but has knobs: Lambda reserved and provisioned concurrency, API Gateway throttling and caching, SQS as a buffer between tiers. CloudFront and ElastiCache are the caching answers for global scalability and database offload respectively. Expect 1-2 questions.

Memorize the four strategies in order of cost and speed: backup and restore (hours RTO), pilot light (data live, compute off — tens of minutes), warm standby (scaled-down copy running — minutes), multi-site active/active (near zero). Every DR question is "cheapest architecture meeting RTO of X and RPO of Y" — anchor each strategy to its rough numbers and the services that implement it. Expect 2-3 questions.

AWS Backup centralizes backups across services (EBS, RDS, DynamoDB, EFS, S3, and more) with backup plans, vaults, cross-region and cross-account copies, and vault lock for immutability. Organizations integration gives org-wide backup policies. It is the answer when a scenario wants centralized, policy-driven, cross-region backup rather than per-service snapshot scripting. Expect 1-2 questions.

DRS continuously replicates servers (on-premises or cloud) at the block level into a low-cost staging area, launching full recovery instances in minutes only when needed. It is the answer for lift-and-shift DR of servers with low RTO/RPO at minimal steady-state cost. Usually one question or a distractor against warm standby.

Know the metric model: namespaces, dimensions, standard (1-minute) vs high-resolution (1-second) metrics, standard vs detailed EC2 monitoring, custom metrics via PutMetricData or embedded metric format, and metric streams to Firehose/S3 for near-real-time export to third-party tools. Metric math and percentiles show up in alarm scenarios. Expect 2-3 questions.

The log pipeline is heavily tested: log groups and retention settings, metric filters (turn log patterns into metrics you can alarm on — a classic exam pattern), subscription filters for real-time processing (Kinesis Data Streams, Firehose, Lambda, cross-account), export to S3 (batch, not real time — know the distinction), Logs Insights query syntax basics, and KMS encryption of log groups. Expect 3-4 questions.

The unified CloudWatch agent collects system-level metrics (memory, disk — not available natively) and logs from EC2 and on-premises servers. Know the prerequisites: agent config (commonly stored in SSM Parameter Store), an instance role with CloudWatchAgentServerPolicy, and installation at scale via SSM Run Command/State Manager. "Why are my memory metrics missing" and "agent installed but no logs" (role missing) are classic questions. Expect 1-2 questions.

Know when each Kinesis service is the right sink: Data Streams for real-time custom processing (shards, consumers, replay within retention), Data Firehose for fully managed delivery to S3/OpenSearch/Redshift with buffering and Lambda transformation (near real time, no replay). CloudWatch Logs subscriptions plus Firehose to a central S3 bucket is the standard multi-account log aggregation pattern. Expect 1-2 questions.

Alarms drive nearly all automation in this exam: states (OK, ALARM, INSUFFICIENT_DATA — know how missing data treatment changes behavior), actions (SNS, Auto Scaling, EC2 recover/stop/terminate, Systems Manager), composite alarms to reduce noise, and anomaly detection alarms (ML band instead of a static threshold — the answer for metrics with cyclical patterns). Alarms also gate deployments via CodeDeploy rollback and CloudFormation rollback monitoring. Expect 3-4 questions.

Know the analysis tool for each shape of question: Logs Insights for interactive queries over CloudWatch log groups, Athena for SQL over logs archived in S3 (CloudTrail, ALB, VPC Flow Logs — partitioning reduces cost), CloudWatch dashboards for cross-region operational views, and QuickSight for business-style visualization of query results. Expect 1-2 questions.

X-Ray traces requests across distributed services. Know how to enable it per compute type: Lambda active tracing (checkbox + IAM), API Gateway stage setting, ECS/EKS via the X-Ray daemon as sidecar container, EC2 via daemon install. Understand segments/subsegments, annotations (indexed, filterable) vs metadata (not indexed), sampling rules, and the service map for finding the failing hop. Expect 2-3 questions.

Inspector continuously scans EC2 instances (via SSM Agent), ECR container images, and Lambda functions for CVEs and network exposure. Findings flow to Security Hub and EventBridge for automated response. It appears in Domain 4 as an assessment tool and again in Domain 6 as a vulnerability scanner — know that it is agentless-by-SSM for EC2 and continuous rather than scheduled in v2. Expect 1-2 questions.

EventBridge is the connective tissue of the whole exam: nearly every "when X happens, do Y" answer routes through an EventBridge rule. Know event patterns (match on source/detail-type/detail fields), targets (Lambda, SNS, SQS, Step Functions, Run Command, CodePipeline, incident tooling), scheduled rules, cross-account event buses, input transformers, archive and replay, and dead-letter queues for failed target invocations. Expect 3-5 questions.

Synthetics canaries run scripted probes (heartbeat, API, broken-link, UI flows) on a schedule and alarm when user journeys break — the answer for "detect the outage before customers do" and for post-deployment validation. Know also CloudWatch RUM (real user monitoring), Container Insights and Lambda Insights (per-platform performance metrics), and Managed Grafana/Managed Service for Prometheus for Kubernetes-native monitoring stacks. Expect 1-2 questions.

Tie the health-check layers together: ALB target group checks mark targets unhealthy (and Auto Scaling replaces them when using ELB health checks), Route 53 health checks fail DNS over, EC2 status-check alarms trigger automatic recovery. For notifications, know S3 Event Notifications (to Lambda/SQS/SNS, prefix and suffix filters) vs EventBridge for S3 (richer filtering, multiple targets), and SNS fan-out to SQS. Expect 2-3 questions.

AWS Health surfaces service events and scheduled changes affecting your resources (for example, EC2 maintenance, certificate expiry). Know the EventBridge integration for automating responses to Health events (the classic scenario: instance scheduled for retirement — automate a restart or migration) and organizational view for org-wide visibility. Expect 1-2 questions.

Know the queue/stream/topic selection logic: SQS to buffer and decouple (visibility timeout, DLQs, FIFO for ordering), SNS for fan-out to many subscribers, Kinesis for ordered streaming with replay, Step Functions when the response is a multi-step workflow. DLQs on Lambda event sources and EventBridge targets are the reliability detail the exam checks. Expect 2-3 questions.

The remediation loop is a signature DOP-C02 pattern: Config rule detects noncompliance, remediation action runs an SSM Automation runbook (directly or via EventBridge and Lambda), resource returns to desired state. Know how to scope rules, pass resource IDs as runbook parameters, set retry behavior, and when to choose an SCP (prevent) instead of remediation (detect and fix). Expect 2-3 questions.

Event-driven fleet changes: EventBridge triggers Run Command or Automation against tagged instances; State Manager reapplies drifting configuration on a schedule; Auto Scaling replaces unhealthy instances automatically (set the instance to unhealthy via the API for forced replacement). Patch Manager plus maintenance windows handles emergent CVE patching at scale. Expect 1-2 questions.

OpsCenter aggregates operational issues as OpsItems (auto-created from EventBridge/CloudWatch alarms) with linked runbooks for investigation. Incident Manager adds paging: response plans, escalation channels, on-call schedules, and automatic incident creation from alarms. Pick OpsCenter for "central place to track and resolve operational issues", Incident Manager for "engage responders automatically". Expect 1-2 questions.

Know where each tool records failure: CodeBuild build logs in CloudWatch Logs (phase that failed, exit code), CodeDeploy agent logs on the instance and lifecycle event failure reasons in the console, CloudFormation stack events and rollback reasons (plus UPDATE_ROLLBACK_FAILED recovery via ContinueUpdateRollback), and pipeline action failure details. Synthetics canaries validate the deployment from the user's perspective. Expect 2-3 questions.

Know the standard diagnoses: Auto Scaling activity history explains why instances launched/terminated or failed to launch (quota, AZ capacity, launch template errors); ECS stopped tasks carry a stoppedReason (image pull failure, health check failure, OOM); EKS troubleshooting goes through pod events and Container Insights. CloudWatch metrics plus X-Ray narrow application-level root cause. Expect 1-2 questions.

FIS runs controlled chaos experiments (terminate instances, inject API errors, stress CPU) with stop conditions tied to CloudWatch alarms. It is the answer when a scenario wants to validate resilience or test failover before a real incident. Usually one question or a distractor.

Professional-level IAM: policy evaluation order (explicit deny always wins; permission must survive SCP, permissions boundary, session policy, and identity/resource policy), identity-based vs resource-based policies (resource policies enable cross-account without role switching), condition keys (aws:PrincipalOrgID for org-scoped access, aws:SourceIp, MFA conditions), and attribute-based access control with tags. Roles for machines, never long-lived keys. Expect 3-4 questions.

Know the federation menu: IAM Identity Center for workforce SSO, SAML/OIDC IAM identity providers for direct federation, and OIDC federation for CI systems (GitHub Actions assuming a role without stored keys — a modern favorite). For machine credentials, instance profiles and ECS task roles beat access keys; Secrets Manager rotates what must remain a secret (database passwords) on a schedule with Lambda rotation functions. Expect 2-3 questions.

The exam repeatedly tests the difference between the permission guardrails: SCPs cap what any principal in an account can do (org-level, affects roles and root of member accounts, grants nothing), permissions boundaries cap what a specific IAM entity can do (delegation tool — let teams create roles that can't exceed the boundary), and session policies scope a single STS session. Know which layer solves which scenario and that an action must be allowed at every layer. Expect 2-3 questions.

Security Hub is the aggregation point: it collects findings from GuardDuty, Inspector, Macie, Config, and partners in a normalized format (ASFF), runs security standards (AWS Foundational Security Best Practices, CIS), and supports org-wide enablement with a delegated administrator account. Automated response is the flagship pattern: findings go to EventBridge, which triggers remediation Lambda/SSM; custom actions let analysts trigger the same from the console. Expect 2-3 questions.

GuardDuty is managed threat detection over CloudTrail, VPC Flow Logs, and DNS logs (no agents, plus protection plans for S3, EKS, RDS, Lambda, and malware). Know org-wide enablement with a delegated administrator, suppression rules, and the EventBridge-driven response pattern (finding triggers isolation/notification). Detective is the follow-on investigation tool that builds a behavior graph for root-causing a finding. Expect 2-3 questions.

Know AWS managed vs customer managed KMS keys, key policies and grants, cross-account key use (key policy + IAM on both sides), automatic rotation, and multi-Region keys. ACM issues and auto-renews public TLS certificates for ELB/CloudFront/API Gateway (renewal is the selling point); Private CA issues internal certs; CloudHSM is the answer only for single-tenant, FIPS 140-2 Level 3, customer-controlled HSM requirements. Expect 2-3 questions.

Layer the controls: security groups (stateful, instance-level, allow rules only), network ACLs (stateless, subnet-level, allow and deny), AWS Network Firewall (managed VPC-level inspection with stateful rule groups), WAF (Layer 7 rules on ALB/CloudFront/API Gateway, rate-based rules), and Shield Standard vs Advanced for DDoS. Firewall Manager pushes WAF/security group/Network Firewall policies org-wide — the automation angle the exam cares about. Expect 1-2 questions.

Macie discovers sensitive data (PII, credentials, financial data) in S3 at scale using machine learning and managed data identifiers, and continuously evaluates bucket security posture (public access, encryption). It is the answer for "find PII across hundreds of buckets automatically". Findings flow to Security Hub and EventBridge. Usually one question.

CloudTrail answers "who did what, when, from where". Know organization trails (one trail, all accounts, delivered to a central bucket), management vs data events (S3 object-level and Lambda invoke logging cost extra and are off by default), log file integrity validation (digest files detect tampering), delivery to CloudWatch Logs for metric-filter alerting (the classic root-login or unauthorized-API alarm), and CloudTrail Lake for SQL over events. Expect 2-3 questions.

Access Analyzer finds resources shared outside your zone of trust (account or organization) — S3 buckets, KMS keys, roles, and more — and validates policies before deployment. Know also the credential hygiene toolkit: credential reports, access advisor (last-accessed data for right-sizing policies), and the standard response runbook for exposed access keys (deactivate, review CloudTrail, rotate). Expect 1-2 questions.

Flow logs capture accepted/rejected IP traffic metadata at the VPC, subnet, or ENI level, delivered to CloudWatch Logs or S3 (analyze with Logs Insights or Athena). They are the answer for "why is this connection failing" (look for REJECT records) and for network forensic evidence. Remember they show metadata, not packet contents. Usually one question.

Trusted Advisor checks accounts against best practices in cost, performance, security, fault tolerance, and service quotas (full checks require Business/Enterprise support; results can feed EventBridge for automation). Pair it mentally with CloudFormation drift detection: Trusted Advisor audits posture, drift detection audits divergence from declared infrastructure. Usually one question between them.