AWS DOP-C02: AWS Certified DevOps Engineer - Professional

Last checked October 22, 2026 against the official AWS exam page.

1. Question 1SDLC Automation

   A team deploys a Lambda function behind an alias. They want 10% of traffic shifted to the new version for 10 minutes, with automatic rollback if a CloudWatch alarm on errors goes into ALARM state during that window. Which approach meets these requirements with the least custom code?

   1. AUpdate the alias weights with a scheduled script that polls CloudWatch error metrics every minute and shifts traffic
   2. BUse CloudFormation change sets with a manual approval step before each alias update and execute the change set from the AWS console
   3. CUse AWS CodeDeploy with a Lambda canary deployment configuration and attach the CloudWatch alarm to the deployment group
   4. DUse Elastic Beanstalk immutable deployments to shift traffic to the new Lambda version by swapping environment CNAMEs after health checks pass
   Show answer and explanationHide answer

   Correct answer: C

   CodeDeploy supports Lambda canary and linear traffic shifting between versions through an alias, and it rolls back automatically when a linked CloudWatch alarm fires. A custom script or manual approval does not provide automatic alarm-driven rollback, and Elastic Beanstalk does not manage Lambda aliases this way.

2. Question 2Security and Compliance

   A CodeBuild project needs a database password at build time. The password must be rotated automatically every 30 days and must never appear in the buildspec file or in build logs. Which solution satisfies these requirements?

   1. AStore the password as a plaintext environment variable in the CodeBuild project with no rotation schedule
   2. BStore it in a Systems Manager String parameter and echo it in the install phase for debugging, then write it into the build logs
   3. CCommit an encrypted file to the repository and decrypt it in the install phase using a shared KMS key policy
   4. DStore the password in AWS Secrets Manager with rotation enabled and reference it from the CodeBuild environment variables
   Show answer and explanationHide answer

   Correct answer: D

   Secrets Manager stores the credential, rotates it on a schedule, and CodeBuild can reference the secret directly so the value is not hard-coded in the project. Plaintext variables and echoing values into logs expose the secret, and a committed encrypted file still stores the credential in source control.

3. Question 3Configuration Management and IaC

   A CloudFormation stack that creates an RDS instance is updated and a change would force the database to be replaced. The team wants the old database preserved if it is replaced or the stack is deleted. Which resource attributes should be set?

   1. ADeletionPolicy set to Delete and UpdateReplacePolicy set to Delete
   2. BTermination protection enabled on the stack and no resource attributes
   3. CA stack policy that denies all updates and DeletionPolicy set to Delete
   4. DUpdateReplacePolicy set to Retain and DeletionPolicy set to Snapshot
   Show answer and explanationHide answer

   Correct answer: D

   UpdateReplacePolicy controls what happens to the old physical resource when an update forces replacement, and DeletionPolicy controls it on stack deletion. Retain or Snapshot keeps the data, whereas Delete destroys it, and stack-level protections do not change per-resource behaviour.

4. Question 4Resilient Cloud Solutions

   An application runs in an Auto Scaling group across three Availability Zones behind an Application Load Balancer. During a zonal outage, users report slow responses because the remaining instances are saturated before scaling catches up. Which configuration change most directly reduces this impact?

   1. AMove the load balancer to a single Availability Zone to simplify routing and register targets in one subnet behind a shared route table
   2. BAdd a target tracking scaling policy on average CPU or request count per target with a sensible warm-up setting
   3. CReduce the health check grace period to zero seconds so new instances are evaluated immediately and replaced faster during an outage
   4. DDisable cross-zone load balancing so traffic stays in the zone where the request arrived and pin each target to its local zone
   Show answer and explanationHide answer

   Correct answer: B

   Target tracking keeps capacity aligned with load so the surviving zones absorb traffic sooner. Reducing the health check grace period to zero causes instability, and disabling cross-zone load balancing can leave some zones overloaded during an outage.

5. Question 5Monitoring and Logging

   A DevOps engineer needs to alert on p99 latency for an API served through API Gateway. The latency must be shown in a single dashboard widget without exporting logs. Which CloudWatch capability should be used?

   1. AThe Latency metric in the AWS/ApiGateway namespace with the p99 extended statistic
   2. BCloudTrail data events for API Gateway queried with Athena via S3
   3. CAPI Gateway execution logs queried with Logs Insights and exported
   4. DA metric filter on the access log group that counts requests per status code and route
   Show answer and explanationHide answer

   Correct answer: A

   API Gateway publishes a Latency metric to CloudWatch, and CloudWatch can display percentile statistics such as p99 on that metric directly. A metric filter counts log lines rather than computing percentiles from timings, and CloudTrail records API calls rather than request latency.