How I Passed the AWS Certified DevOps Engineer – Professional (DOP-C02) Exam

Before preparing for DOP-C02, I earned the AWS Certified Developer – Associate (DVA-C02) and AWS Certified CloudOps Engineer – Associate (SOA-C03) certifications. DVA-C02 strengthened my foundation in application development, serverless services, deployment tools, SDKs, and application security. SOA-C03 strengthened my knowledge of observability, systems management, reliability, disaster recovery, and network troubleshooting. Together, they gave me the preparation needed to work through DOP-C02 topics such as pipeline delegation, StackSet deployments, cross-account log streaming, and automated event response.

I organized these study notes around the official DOP-C02 domains, highlighting core architectural patterns, multi-account design decisions, high-yield exam rules, and domain scenario practice questions.

Exam Overview and Domain Breakdown

The AWS Certified DevOps Engineer – Professional (DOP-C02) exam validates technical expertise in provisioning, operating, and managing distributed systems and automated infrastructure on AWS.

The exam covers six primary domains:

The exam consists of 75 questions (65 scored questions and 10 unscored pretest questions) with a 180-minute time limit and a scaled passing score of 750 / 1000.

Here is the study sequence I followed:

Domain 1: SDLC Automation (22% Weighting)

Domain 1 focuses on designing, implementing, and maintaining automated continuous integration and continuous delivery (CI/CD) pipelines across single-account and multi-account AWS environments.

1. Centralized Multi-Account CI/CD Pipelines & Secrets Management

In enterprise architectures, AWS CodePipeline resides in a central Tooling / DevOps Account and deploys applications into separate Target Accounts (e.g., Development, Staging, Production).

• Central S3 Artifact Bucket: Located in the Tooling Account. The bucket policy must grant s3:GetObject and s3:PutObject permissions to cross-account target execution roles.
• KMS Key Requirement (CRITICAL EXAM RULE): Default AWS-managed S3 keys (aws/s3) cannot be shared across AWS accounts. You must create a Customer Managed Key (CMK) with a key policy allowing target account IAM roles to perform kms:Decrypt and kms:GenerateDataKey.
• Cross-Account IAM Roles: Target accounts maintain deployment roles with trust relationships allowing the Tooling account pipeline role to assume them (sts:AssumeRole).
• CodePipeline Execution Modes:
  • QUEUED (Default): Runs executions sequentially in order.
  • SUPERSEDED: Replaces waiting executions with the newest incoming commit, skipping stale build backlogs.
  • PARALLEL: Executes multiple pipeline runs concurrently in isolated environments.
• Secrets Management in Build Pipelines:
  • AWS Secrets Manager: Supports dynamic, scheduled credential rotation (e.g., RDS passwords) and resource-based policies directly attached to secrets.
  • AWS Systems Manager Parameter Store: Stores configuration parameters and SecureString values using identity-based IAM policies.
  • CodeBuild Integration: Reference parameters inside buildspec.yml under env.secrets-manager or env.parameter-store. Pulled values are automatically masked in CloudWatch build logs.

+-----------------------------------------------------------------------------------+
|                               TOOLING ACCOUNT                                     |
|                                                                                   |
|  [ CodeCommit / GitHub ] ──► [ AWS CodePipeline ] ──► [ AWS CodeBuild ]           |
|                                                               │                   |
|  [ Central S3 Artifact Bucket ] <── Encrypted with KMS CMK ───┘                   |
+--------------------------------------+--------------------------------------------+
                                       | Assume Cross-Account Role (sts:AssumeRole)
                         +-------------+-------------+
                         |                           |
                         v                           v
         +-------------------------------+   +-------------------------------+
         |    STAGING TARGET ACCOUNT     |   |   PRODUCTION TARGET ACCOUNT   |
         |  [ Execution IAM Role ]       |   |  [ Execution IAM Role ]       |
         |  [ CodeDeploy / ECS / Lambda ]|   |  [ CodeDeploy / ECS / Lambda ]|
         +-------------------------------+   +-------------------------------+

2. Integrating Automated Testing into CI/CD

• Pre-Build / Source Stage: Static Application Security Testing (SAST), linting, and syntax checks (e.g., SonarQube, Amazon CodeGuru).
• Build Stage: Unit testing and code coverage reporting inside AWS CodeBuild. Configure CodeBuild to fail execution if test exit codes are non-zero (exit 1).
• Post-Build / Staging Stage: Integration tests, API acceptance testing, and load/stress testing executed before promoting artifacts to Production.

3. Artifact Lifecycle & Container Image Management

• AWS CodeArtifact: Centralized package management for software dependencies (npm, PyPI, Maven, NuGet). Configured with upstream connections to public registries to cache packages internally. Requires dynamic retrieval of a 12-hour bearer authorization token via aws codeartifact get-authorization-token inside build pipelines.
• Amazon Elastic Container Registry (ECR):
  • Supports Basic (ClamAV) and Enhanced (Amazon Inspector integration) image vulnerability scanning on push.
  • Uses cross-Region and cross-account image replication for multi-Region container deployments.
• EC2 Image Builder: Automates Golden AMI creation pipelines using recipes (Base OS + Components), infrastructure configurations, and distribution settings across Regions/Accounts.

4. Advanced Deployment Strategies & CodeDeploy Mechanics

• CodeDeploy Lifecycle Hooks:
  • EC2 / On-Premises: ApplicationStop ──► DownloadBundle ──► BeforeInstall ──► Install ──► AfterInstall ──► ApplicationStart ──► ValidateService. (Failure in ValidateService triggers automated rollback).
  • Amazon ECS: BeforeInstall ──► AfterInstall ──► AfterAllowTestTraffic ──► BeforeAllowTraffic ──► AfterAllowTraffic.
  • AWS Lambda: BeforeAllowTraffic ──► AfterAllowTraffic.

Domain 1 Practice Questions

Question 1

A DevOps engineer needs to deploy a microservice to Amazon ECS on AWS Fargate using a canary strategy. The deployment must route 10% of traffic to the new task definition, wait 15 minutes, and then shift the remaining 90%. If HTTP 5xx errors increase on the Application Load Balancer target group, CodeDeploy must automatically roll back. Which combination of configurations fulfills this requirement? (Select TWO)

• A. Create an AppSpec file in CodePipeline specifying CodeDeployDefault.ECSCanary10Percent15Minutes
• B. Configure a CloudWatch Alarm monitoring the target group’s HTTPCode_Target_5XX_Count metric and attach it to the CodeDeploy Deployment Group
• C. Set up an AWS Step Functions state machine to query ALB metrics every minute
• D. Set the ECS Service deployment type to IN_PLACE with rolling updates
• E. Configure Route 53 Weighted DNS routing records manually to split traffic

Question 2

A CodeBuild project runs integration tests that call external APIs. Only the DevOps team and the CodeBuild service role should access the credentials. Which solution is most secure?

• A. Store the credentials as plaintext environment variables in the CodeBuild project
• B. Store them in an SSM Parameter Store SecureString parameter
• C. Encrypt the credentials with KMS and commit them to the source repository
• D. Store them in Secrets Manager and reference the secret under env.secrets-manager in buildspec.yml

Question 3

A central tooling account publishes packages to CodeArtifact for every account in an AWS Organization. Which solution provides the lowest operational overhead?

• A. Create a CodeArtifact domain policy that permits principals with the organization ID, then publish packages from CodeBuild
• B. Replicate package archives to an S3 bucket in every member account
• C. Create a separate CodeArtifact repository in every member account and replicate packages with Lambda
• D. Store the packages in an ECR repository

Domain 2: Configuration Management and IaC (17% Weighting)

Domain 2 covers defining cloud infrastructure using declarative frameworks, managing multi-account landing zones at scale, and automating configuration state across server fleets.

1. Infrastructure as Code Frameworks & Safeguards

• IaC Framework Comparison:
  • AWS CloudFormation: Declarative JSON/YAML templates managing native AWS resources.
  • AWS CDK: Expresses infrastructure using imperative code (TypeScript, Python, Java, Go) that synthesizes into standard CloudFormation templates.
  • AWS SAM: Serverless extension of CloudFormation simplified for defining Lambda functions, API Gateways, and DynamoDB tables.
• Governance and Protection Mechanisms:
  • CloudFormation Stack Policies: Prevent accidental modifications or deletion of specific critical resources during stack updates. (Exam Rule: Stack policies do NOT prevent deletion if the entire stack is deleted; use IAM permissions, termination protection, or DeletionPolicy: Retain for stack deletion protection).
  • DeletionPolicy Attribute: Set to Retain or Snapshot to prevent resource deletion during stack deletion.
  • Drift Detection: Identifies unmanaged configuration changes made outside CloudFormation templates. (Note: Drift detection flags deviations, but does not automatically revert resources).
  • AWS Service Catalog: Publishes pre-approved CloudFormation templates as “Products” inside “Portfolios” for self-service deployment via Launch Roles without granting raw admin rights.

{
  "Statement": [
    {
      "Effect": "Deny",
      "Action": "Update:Delete",
      "Principal": "*",
      "Resource": "LogicalResourceId/ProductionDatabase"
    },
    {
      "Effect": "Allow",
      "Action": "Update:*",
      "Principal": "*",
      "Resource": "*"
    }
  ]
}

2. Multi-Account Onboarding & Guardrails

• AWS Control Tower & AWS Organizations: Establish multi-account landing zones using structured Organizational Units (OUs).
• Service Control Policies (SCPs): Applied at Root, OU, or Account levels. SCPs define maximum permission boundaries for entities inside target accounts. An explicit Deny in an SCP overrides all IAM permissions, including Account Root Users.
• CloudFormation StackSets: Deploys stack instances across multiple accounts and Regions from a single management project. Service-Managed StackSets automatically deploy stack instances to any new account provisioned in a targeted OU.

3. Automated Fleet Management & Patch Baselines

• AWS Systems Manager (SSM):
  • Patch Manager: Automates OS and software patch application using customizable Patch Baselines and Maintenance Windows.
  • State Manager: Enforces continuous software configurations, agent updates, and security settings on managed EC2 instances.
  • Automation: Runs operational runbooks (e.g., instance resizing, snapshot management, automated security remediation).
  • AppConfig: Manages dynamic application feature flags and runtime configurations independently of code deployments.

Domain 2 Practice Questions

Question 1

An enterprise requires that every newly created account in the Workloads OU in AWS Organizations automatically receives a baseline VPC and core IAM roles. Furthermore, developers in those target accounts must not be able to delete these baseline resources. Which combination of steps fulfills this requirement? (Select TWO)

• A. Deploy an AWS CloudFormation StackSet with Service-Managed permissions targeting the Workloads OU with AutoDeployment enabled
• B. Attach a Service Control Policy (SCP) to the Workloads OU that explicitly denies cloudformation:DeleteStack and cloudformation:UpdateStack on resources with tag Baseline=True
• C. Create a local cron script on an EC2 instance that runs AWS CLI stack updates hourly
• D. Use AWS Config rules to terminate accounts that modify baseline resources
• E. Define stack policies in target accounts and set "Effect": "Deny" for all actions

Question 2

A SAM-deployed Lambda function requires pre-traffic validation, a gradual traffic shift over 20 minutes, and post-traffic validation. Which configuration meets these requirements?

• A. Use a SAM deployment preference of Linear10PercentEvery2Minutes with PreTraffic and PostTraffic hooks
• B. Configure an in-place CodeDeploy deployment group
• C. Update the production alias directly from CodePipeline
• D. Use Step Functions to update API Gateway stages in increments

Question 3

A company manages IAM roles exclusively through CloudFormation and needs to detect manual changes made in the console. What should the engineer configure?

• A. Schedule DetectStackDrift and use EventBridge to alert on drift status changes
• B. Attach an SCP denying every iam:UpdateRole request
• C. Create a permissions boundary that revokes access after an update
• D. Enable CloudTrail Insights to block unauthorized API calls

Domain 3: Resilient Cloud Solutions (15% Weighting)

Domain 3 focuses on architecting highly available, scalable, and self-healing multi-AZ and multi-Region architectures with defined Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO).

1. High Availability Across Architectural Layers

To eliminate single points of failure (SPOFs), resilience must be embedded across compute, networking, and data tiers:

                                [ GLOBAL LAYER ]
                     Amazon CloudFront + Route 53 ARC
                                       │
                    ┌──────────────────┴──────────────────┐
                    ▼                                     ▼
        [ REGIONAL LAYER 1 ]                  [ REGIONAL LAYER 2 ]
   Application Load Balancer (ALB)       Application Load Balancer (ALB)
        │                 │                   │                 │
        ▼                 ▼                   ▼                 ▼
   [ Compute AZ1 ]   [ Compute AZ2 ]     [ Compute AZ1 ]   [ Compute AZ2 ]
        │                 │                   │                 │
        └────────┬────────┘                   └────────┬────────┘
                 │                                     │
                 v                                     v
   [ Primary Aurora Cluster ] ──Storage Rep──► [ Secondary Aurora Cluster ]

• Data Tier Resiliency:
  • Amazon Aurora Global Database: Dedicated storage-level replication across primary and up to 5 secondary Regions with latency under 1 second.
    • RPO: < 1 minute (typically sub-second).
    • RTO: < 1 minute for planned failover; < 5 minutes for unplanned failover / detachment.
  • Amazon DynamoDB Global Tables: Fully managed, active-active multi-Region database replication with “Last-Writer-Wins” conflict resolution based on internal system timestamps.
• Routing Controls & Health Checks:
  • Route 53 Application Recovery Controller (ARC): Manages readiness checks and routing control failovers during regional outages using Safety Rules to prevent cascading failures.

2. Scalable Compute & Auto Scaling Engines

• EC2 Auto Scaling: Supports Target Tracking, Step Scaling, and Predictive Scaling (leveraging ML models to schedule capacity ahead of predicted load spikes).
• ECS Capacity Providers & Fargate: Automates compute infrastructure provisioning to match container task scaling requirements using CapacityProviderReservation metrics.
• EKS Autoscalers: Cluster Autoscaler and Karpenter for dynamic Kubernetes node and pod scaling.

3. Disaster Recovery Strategies & Target Metrics

• AWS Elastic Disaster Recovery (DRS): Block-level continuous data replication from physical, virtual, or cloud servers into a low-cost staging area in AWS for rapid recovery.
• AWS Backup Vault Lock: Compliance mode locks backup policies permanently; no user or root account can delete or shorten retention periods.

Domain 3 Practice Questions

Question 1

An application using Amazon Aurora PostgreSQL requires a cross-Region DR strategy between us-east-1 and us-west-2 with an RPO of less than 1 minute and an RTO of less than 5 minutes. Which solution meets these metrics?

• A. Use AWS Backup to copy daily DB snapshots from us-east-1 to us-west-2
• B. Deploy an Amazon Aurora Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2
• C. Set up an AWS DMS task to perform continuous logical replication between two standalone Aurora instances
• D. Write a custom Lambda script to export database transaction logs to S3 every 10 minutes

Question 2

An API-backed Lambda function requires AWS WAF protection with minimal operational overhead. Which front door supports a direct WAF association?

• A. An Application Load Balancer targeting Lambda
• B. An API Gateway REST API integrated with Lambda
• C. An API Gateway HTTP API integrated with Lambda
• D. A Network Load Balancer targeting Lambda

Question 3

A three-tier application needs an RTO under 30 minutes, an RPO under 4 hours, and minimal idle compute cost in the recovery Region. Which DR strategy fits?

• A. Pilot Light with continuously replicated data and compute started during failover
• B. Backup and Restore using daily snapshots
• C. Multi-site active-active with full capacity in both Regions
• D. Warm Standby with full-capacity resources running continuously

Domain 4: Monitoring and Logging (15% Weighting)

Domain 4 focuses on centralizing metric and log ingestion, constructing operational dashboards, conducting root-cause log analysis, and configuring automated event responses.

1. Metric Collection & CloudWatch Agent

Hypervisors only monitor host-level metrics (e.g., CPU utilization, network I/O, disk read/write ops). Memory (RAM) consumption, swap usage, and local disk space utilization require installing and configuring the Amazon CloudWatch Agent on the guest OS.

[ Guest Operating System / EC2 Instance ]
├── System Metrics Engine ──► RAM Memory Usage, Swap Usage, Free Disk Space
└── Log Collection Engine ──► /var/log/syslog, /var/log/nginx/access.log
                      │
                      v Pushed via IAM Role Credentials
[ AMAZON CLOUDWATCH LOGS & METRICS ]

2. Centralized Cross-Account Logging Engine

To aggregate logs across 50+ accounts into a central Security Account:

[ Source Account A / B ] ──► (CloudWatch Logs Subscription Filter) ──► [ Central Compliance Account ]
                                                                             │
                                                                             v
                                                               [ Kinesis Data Stream ]
                                                                             │
                                                                             v
                                                                   [ AWS Lambda / Firehose ]
                                                                             │
                                                                             v
                                                                 [ OpenSearch / KMS S3 ]

• Cross-Account Streaming Target: Amazon Kinesis Data Streams or Kinesis Data Firehose is the required destination for cross-account CloudWatch Logs Subscription Filters.
• KMS Encryption Rule: S3 buckets and Firehose streams receiving cross-account logs must use an AWS KMS Customer Managed Key (CMK). Default AWS-managed keys (aws/s3) fail across account boundaries.

3. Analytics & Query Engine Selection Matrix

4. Distributed Tracing: AWS X-Ray

• Active Instrumentation: The AWS service samples incoming requests, injects tracing headers, and adds separate nodes to the X-Ray Service Map (Supported: AWS Lambda, Amazon API Gateway).
• Passive Instrumentation: The service passes upstream tracing headers through without sampling, preserving the Trace ID across asynchronous steps (Supported: EventBridge, SQS, SNS).
• Annotations vs. Metadata:
  • Annotations: Indexed key-value pairs used to search and filter traces in the X-Ray console.
  • Metadata: Non-indexed arbitrary key-value pairs (e.g., entire JSON payloads) stored for context.

Domain 4 Practice Questions

Question 1

A DevOps engineer needs to stream OS logs from 200 EC2 instances across 10 accounts into a single centralized S3 bucket in a Security account in near-real-time. The logs must be encrypted at rest with AWS KMS. Which approach meets these demands with minimal maintenance?

• A. Configure CloudWatch Logs Subscription Filters in source accounts to stream to an Amazon Kinesis Data Firehose delivery stream in the central account targeting the KMS-encrypted S3 bucket
• B. Install a cron job on instances to copy logs directly using aws s3 cp
• C. Use AWS CloudTrail to log EC2 internal OS files directly
• D. Push OS log output directly into Systems Manager Session Manager

Question 2

An organization operates many EKS clusters and needs low-maintenance detection of abnormal CPU, memory, and disk usage. Which solution is appropriate?

• A. Deploy CloudWatch Container Insights using IAM Roles for Service Accounts and apply CloudWatch Anomaly Detection
• B. Query node logs with CloudWatch Logs Insights only
• C. Enable GuardDuty EKS Protection for performance metrics
• D. Write a custom Prometheus scraper that exports metrics to S3

Question 3

An application team needs real-time email alerts when a critical error appears in EC2 application logs. Which design requires the least operational effort?

• A. Stream logs with the CloudWatch Agent, create a metric filter, and alarm through SNS
• B. Send logs directly to OpenSearch with custom shippers
• C. Archive logs to S3 and query them with Athena every hour
• D. Match EC2 console output with EventBridge

Domain 5: Incident and Event Response (14% Weighting)

Domain 5 evaluates technical expertise in processing operational events, automating configuration changes in response to incidents, and performing root-cause analysis on system failures.

1. Event Ingestion & Architectural Routing

AWS generates event telemetry across management, data, and health planes:

[ Event Source: AWS Health / CloudTrail / S3 ]
                       │
                       v
            [ Amazon EventBridge ]
       (Matches JSON Event Patterns)
                       │
       ┌───────────────┼───────────────┐
       ▼               ▼               ▼
 [ AWS Lambda ]  [ Amazon SNS ]  [ Systems Manager ]
 (Remediation)   (Notifications)    (Automation)

• AWS Health: Emits AWS_EC2_PERSISTENCE_INSTANCE_LOST or AWS_RISK_CREDENTIALS_EXPOSED events directly to Amazon EventBridge.
• The Fan-Out Pattern: Amazon EventBridge or Amazon SNS publishing to multiple Amazon SQS queues or Lambda functions for parallel asynchronous processing.
• Orchestration Workflows: AWS Step Functions state machines orchestrating multi-step operational recovery processes with built-in retry and catch handling.

2. High-Yield Automated Remediation Scenarios

• Exposed IAM Access Keys (AWS_RISK_CREDENTIALS_EXPOSED):
  1. AWS Health emits exposure notification to Amazon EventBridge.
  2. EventBridge rule triggers AWS Step Functions state machine.
  3. Step Functions revokes/deletes the exposed IAM key immediately.
  4. Lambda queries CloudTrail logs to compile a summary of recent API calls performed by that key.
  5. Step Functions publishes the activity report to an Amazon SNS topic for SecOps review.
• Non-Compliant Security Group Ingress: AWS Config Rule (or CloudTrail AuthorizeSecurityGroupIngress) ──► EventBridge Rule ──► SSM Automation Document (e.g., AWS-RevokeSecurityGroupIngress) to revert unauthorized open ports (e.g., 0.0.0.0/0 on port 22).

3. Troubleshooting & Failure Diagnostics

• Auto Scaling Diagnostic Log Collection: EC2 Auto Scaling default termination removes unhealthy instances immediately, causing loss of local log files. Solution: Implement an EC2_INSTANCE_TERMINATING Lifecycle Hook to hold the instance in a Terminating:Wait state while an SSM Run Command script uploads diagnostic memory/log dumps to S3 prior to final termination.
• ECS vs. EKS Container Diagnostics:
  • ECS Fargate: Uses awslogs driver in Task Definition to send stdout/stderr to CloudWatch Logs. Inspect ECS Service Event Log for task placement failures.
  • EKS Container Insights: Uses Embedded Metric Format (EMF) to monitor container crashes (CrashLoopBackOff, OOMKilled).
• CloudWatch Synthetics: Runs canary scripts continuously with Visual Monitoring blueprints (0% variance threshold) to detect frontend layout regressions or broken API endpoints.

Domain 5 Practice Questions

Question 1

A company’s security team receives a notification that an IAM access key was committed to a public code repository. A DevOps engineer must automate the key revocation, query CloudTrail for recent actions taken by that key, and alert the team. Which combination of services provides this solution with the LEAST operational overhead?

• A. Configure AWS Config to trigger a custom Python script on an EC2 instance
• B. Create an EventBridge rule for the AWS Health AWS_RISK_CREDENTIALS_EXPOSED event that targets an AWS Step Functions state machine to delete the key, invoke a Lambda function to query CloudTrail, and publish an SNS notification
• C. Use Amazon Macie to scan GitHub repositories continuously
• D. Write a cron job on a local server to poll IAM credential report APIs every 5 minutes

Question 2

AWS Health reports scheduled EC2 hardware maintenance. The team wants to restart affected instances before the maintenance date with minimal development effort. Which solution should be used?

• A. Route the AWS Health scheduledChange event through EventBridge to the AWS-RestartEC2Instance Systems Manager Automation runbook
• B. Poll the AWS Health API with a Python script on EC2
• C. Use an AWS Config rule to terminate the instances
• D. Ignore the event until AWS retires the host

Question 3

An engineer manually changes the capacity settings of a production Auto Scaling group. The approved values must be restored automatically when drift is detected. Which solution meets the requirement?

• A. Use the autoscaling-group-capacity-check AWS Config rule with an SSM Automation remediation action
• B. Run an EC2 cron job that updates the group every minute
• C. Attach an SCP denying all Auto Scaling operations
• D. Create a CPU utilization alarm

Domain 6: Security and Compliance (17% Weighting)

Domain 6 validates expertise in enterprise identity management, automated security controls, data protection at rest and in transit, and continuous compliance auditing.

1. Identity & Access Management at Scale

• Human vs. Machine Workload Access:
  • Human Users: Use AWS IAM Identity Center (formerly AWS SSO) federated with SAML 2.0 / SCIM (Okta, Azure AD). Never issue long-term IAM access keys for human users.
  • AWS Machine Workloads (EC2/ECS/Lambda): Use IAM Roles attached directly as Instance Profiles or Task Execution Roles.
  • On-Premises Workloads: Use AWS IAM Roles Anywhere to obtain temporary STS credentials using X.509 digital certificates.
• IAM Permissions Boundaries (iam:PermissionsBoundary):
  • Defines the maximum permissions ceiling an IAM entity can receive.
  • Use Case: Delegating IAM role creation to developer teams without allowing privilege escalation.
• Service Control Policies (SCPs): Preventive guardrails set at Root, OU, or Account level in AWS Organizations. Explicit Deny in an SCP overrides all IAM permissions (including local account root users).

2. Automated Security Controls & Network Defense

[ Non-Compliant Event Detected ]
(AWS Config / Security Hub)
             │
             v Emits Event
   [ Amazon EventBridge ]
             │
             v Triggers Target
 [ Systems Manager Automation Runbook ] ──► Remediates State (e.g., Closes Public S3)
             │
             v Sends Alert
     [ Amazon SNS Topic ]

• AWS Firewall Manager: Centrally deploys and enforces network security policies (AWS WAF, Shield Advanced, VPC Security Groups, Network Firewall) automatically across all accounts in an AWS Organization.
• Amazon Macie: Uses machine learning and pattern matching to discover, classify, and alert on sensitive data (PII, credit card numbers, secret keys) in Amazon S3 buckets.
• AWS Secrets Manager: Automates credential rotation out-of-the-box for database passwords (RDS, Aurora) using pre-built Lambda functions inside private VPC subnets with Interface VPC Endpoints.

3. Security Monitoring & Auditing Matrix

Domain 6 Practice Questions

Question 1

A DevOps engineer must enforce encryption on all new objects uploaded to an S3 bucket in a multi-account environment. Additionally, cross-account target accounts must be able to read and decrypt the objects. Which solution satisfies these requirements?

• A. Enable S3 default encryption using the default AWS-managed key aws/s3
• B. Configure an S3 bucket policy requiring s3:x-amz-server-side-encryption: "aws:kms" and specify a KMS Customer Managed Key (CMK) with a key policy granting kms:Decrypt permissions to the target account roles
• C. Use AWS Secrets Manager to store the S3 encryption password
• D. Attach an IAM permissions boundary to all user roles in the target account

Question 2

A compliance team requires all Lambda code to be signed by a trusted authority before deployment. Which solution meets this requirement?

• A. Create an AWS Signer profile and Lambda Code-Signing Configuration, then deploy signed packages with SAM
• B. Store Lambda code in ECR with image scanning enabled
• C. Encrypt the deployment ZIP with a KMS key
• D. Download an RSA private key from KMS and sign packages locally

Question 3

An organization wants to share a central Transit Gateway with all current and future member accounts. Which solution requires the least administration?

• A. Enable trusted access for AWS RAM and share the Transit Gateway using the organization ID
• B. Create VPC peering connections between every member VPC
• C. Share the Transit Gateway manually with every account ID
• D. Deploy a separate Transit Gateway in every account and connect them with VPN

Five Scenario Questions for Final Review

Scenario 1: Elastic Beanstalk Post-Deployment Hook

A company deploys a web application with Elastic Beanstalk and needs to run a Bash script on each EC2 instance immediately after deployment completes. Which approach should be used?

• A. Place the script in .ebextensions under commands
• B. Place an executable script in .platform/hooks/postdeploy/
• C. Trigger Systems Manager Run Command from an EC2 launch event
• D. Place the script in .ebextensions under container_commands

Scenario 2: Active-Passive DynamoDB Recovery

An application uses a single-Region DynamoDB table and requires automated active-passive regional recovery with minimal migration work. Which solution is appropriate?

• A. Add a secondary Region to convert the existing table to a DynamoDB Global Table and use Route 53 failover routing between ALBs
• B. Create a new Global Table and use latency-based routing
• C. Use weighted routing at 50/50 across two Regions
• D. Replicate DynamoDB snapshots to S3 and use simple Route 53 routing

Scenario 3: Predictable Elastic Beanstalk Traffic Spike

An Elastic Beanstalk application receives a predictable traffic surge every morning. The team wants capacity ready before the surge begins. Which scaling method should be configured?

• A. Use scheduled scaling to raise the Auto Scaling group capacity before the expected spike
• B. Use target tracking on CPU utilization only
• C. Resize the instances manually each morning
• D. Enable ALB cross-zone load balancing

Scenario 4: ECS Anywhere Cloud Bursting

On-premises ECS Anywhere workers process an SQS queue, but the company needs cloud capacity during outages or backlog spikes. Which design provides automatic bursting?

• A. Run a parallel ECS service on AWS Fargate and scale its tasks from the SQS ApproximateNumberOfMessagesVisible metric
• B. Increase the SQS visibility timeout to 24 hours
• C. Migrate all processing permanently to EC2
• D. Configure Auto Scaling on the on-premises hardware only

Scenario 5: Per-Application S3 Data Transformation

Three analytics applications read the same S3 objects, but each requires a different redaction format. The company wants to avoid storing duplicate copies. Which architecture should be used?

• A. Create an S3 Object Lambda access point for each application with a dedicated transformation Lambda function
• B. Maintain three synchronized S3 buckets
• C. Use S3 replication rules to transform objects during replication
• D. Require each client application to redact the data after download

Final Thoughts

Preparing for the DOP-C02 exam requires combining software delivery, infrastructure automation, resilience, observability, incident response, and security governance at enterprise scale.