The DOP-C02 Study Plan

Six domains, but not six equal boxes. SDLC Automation is worth 22% of the DOP-C02 — more than Monitoring & Logging and Incident & Event Response combined — while Incident & Event Response, the lightest domain, is still worth 14%: roughly one question in every seven. Study every domain for the same number of hours anyway and you'll have spent exactly as much time on the smallest slice of the exam as the biggest, which feels fair and quietly costs you real score. This page takes the six weights from the DOP-C02 exam guide — 22 / 17 / 15 / 15 / 14 / 17 — and turns them into an actual hours budget, then wires every week of that budget to its matching blueprint lesson, a capstone stage that puts the idea into a running pipeline, and the tool pages worth reading along the way. Eleven weeks, ending the way a study plan for a closed-book exam should: a readiness checkpoint you actually have to pass, not just read, before you sit the first of five full-length mock exams under a real 180-minute clock.

The arithmetic — hours by weight, not by domain count

☺ Like you're 10: Six domains, one hundred study hours, and the split isn't one-sixth each — it's however big each domain's real slice of the test actually is.

Pick a total number of hours you'll spend on domain study — reading the blueprint lesson, working the matching capstone stage, reading the tool pages — separate from the foundation week, the integration week, and the five mock sittings, which get their own budget below. Then apply one rule everywhere: no domain gets a head start because it's more interesting, and none gets shortchanged because it's less fun. The exam guide already decided how much each domain is worth; your only real decision is the total.

hours for a domain = total domain-study hours × that domain's weight.

This plan uses a round 100 hours of domain study, which has a convenient side effect: at 100 hours, a domain's hours and its weight number are the same figure, so the table below doubles as a sanity check you can do in your head.

The gap looks small domain-to-domain — a few hours here, a couple there — but it isn't small in aggregate. SDLC Automation alone picks up 5.3 more hours than an even split would give it, funded entirely by trimming the three lightest domains. Put another way: the exam guide already noted that SDLC Automation, Configuration Management & IaC, and Security & Compliance together make up 56% of the real exam — over half your score sitting in three domains — which is exactly why this plan opens with four straight weeks on those three and only turns to the remaining 44% afterward.

python3 - 100 <<'PY'
import sys
budget = float(sys.argv[1])          # total DOMAIN-STUDY hours — foundations/integration/mocks are separate
domains = [
    ("SDLC Automation",                  22),
    ("Configuration Management & IaC",   17),
    ("Security & Compliance",            17),
    ("Resilient Cloud Solutions",        15),
    ("Monitoring & Logging",             15),
    ("Incident & Event Response",        14),
]
even = budget / len(domains)
print(f"{'domain':34}{'wt':>5}{'by weight':>12}{'even':>9}{'delta':>9}")
for name, w in domains:
    hrs = budget * w / 100
    print(f"{name:34}{w:4}%{hrs:11.1f}h{even:8.1f}h{hrs-even:+8.1f}h")
PY

The domain map — lesson, capstone stage, and tools per domain

☺ Like you're 10: One row per part of the test — how long to spend, which lesson explains it, which capstone stage makes you build it, and which tool pages are worth a look.

This table is the plan's reference; every week below is just a calendar wrapped around one row of it. Read the lesson for the AWS-specific shape of the idea, work the matching stage of the capstone so it's not just something you recognize on a slide, and treat the tool pages as background — DOP-C02 tests AWS's own services almost exclusively, but knowing where Jenkins ends and CodePipeline begins is exactly the kind of confusable pair this exam likes to test.

One skill has no weighted row of its own and still shows up inside almost every question on the paper: telling two AWS constructs that sound alike apart under a clock. Mock Exam Set 3 is built entirely around that skill — CodeDeploy's in-place vs. rolling vs. blue/green, IAM's trust vs. permissions vs. boundary vs. SCP, CloudWatch vs. X-Ray vs. CloudTrail — and is worth a look mid-plan, not only in Week 10, precisely because those pairs live inside every domain above, not off to the side of it.

Before Week 1 — pick your lane

☺ Like you're 10: Eleven weeks is a guess about a specific kind of person — someone who already runs things on AWS for a living. If that's not you yet, the plan is still right, the number of weeks just isn't.

"Eleven weeks" is not a fact about DOP-C02; it's a fact about a candidate who already has real, hands-on AWS operations experience — which lines up with AWS's own recommendation of two-plus years running production workloads on the platform before you sit this exam. Score yourself honestly against the three lanes below before you commit a calendar to this plan.

Week 1 — orientation: the exam's own shape, then a cold baseline

☺ Like you're 10: Before you study anything, read the rulebook once and find out — honestly, without studying first — what you already know.

Read the DOP-C02 exam guide in full before opening a single domain page: 75 questions (65 scored, 10 unidentified pretest questions mixed in), 180 minutes, a scaled score out of 1000 with 750 to pass, Pearson VUE registration either at a testing center or online-proctored. None of that changes what you study, but it changes how you sit every mock exam from here on — treat all 75 questions on a real sitting as if they count, because you can never tell which ten don't. Skim Certifications for how DOP-C02 compares to the CKA and Terraform Associate if you haven't already decided this is your next exam.

Then take a genuine cold baseline: sit Mock Exam Set 3 untimed, before you've studied a single domain page, and mark it honestly. This is not a real attempt and the score means nothing on its own — its only job is to tell you which of the six domains you can already half-answer from general cloud experience and which ones are a blank page. Log every miss in a plain mistake log now, in the shape you'll keep adding to all plan long:

mkdir -p ~/dop-c02-prep && cd ~/dop-c02-prep
printf '%s\n' 'date,set,domain,question_gist,what_i_picked,why_wrong,rule' > mistakes.csv
: > rules.md

printf '%s\n' \
  '2026-08-17,baseline,security-compliance,"trust vs permissions policy symptom",B,"assumed AccessDenied means trust policy",R1' \
  >> mistakes.csv

cat >> rules.md <<'MD'
## R1 — "never got credentials" vs "got credentials, then denied"
If a role can never be assumed at all, suspect the TRUST policy.
If it's assumed fine and one specific API call gets AccessDenied,
suspect the PERMISSIONS (identity) policy. Two different symptoms,
two different documents — don't reach for the same fix for both.
MD

Every later week's "where this domain's traps live" reading and every subsequent mock sitting adds rows to this file the same way. By Week 9 it's the single most useful document in this whole plan — see Know It Cold for the companion list of facts worth memorizing outright rather than re-deriving from a rule each time.

Weeks 2–5 — the 56%: SDLC Automation, Configuration Management & IaC, and Security & Compliance

☺ Like you're 10: Four straight weeks on the three domains that, added together, are worth more than half the whole test.

These three domains alone are 56% of the real exam — over half your score — so they go first, while your attention and your calendar are both freshest. If your weeks run short later in the plan, protect these four before you protect anything downstream.

Weeks 2–3 — SDLC Automation (22h, the single biggest domain)

Read SDLC Automation in full: CodePipeline as the orchestrator stitching source, build, and deploy stages together; source-control triggers carrying a push into a running pipeline; CodeBuild for build-and-test automation; CodeArtifact and ECR for artifact management; and CodeDeploy's own deployment-automation vocabulary — in-place, rolling, blue/green, and Lambda traffic shifting through a weighted alias. That last section is where this domain's exam traps concentrate hardest; drill it against Mock Exam Set 3's Section A (Q1–Q5) once you've read it, not before.

Then build Capstone Part 1 — Pipeline Foundation: a real pipeline from a source push to a deployed artifact, not a diagram of one. If a broken build is the fastest way anything sticks for you, run Drill — Fix a Broken Pipeline the same week. Background reading, time permitting: Testing in the Pipeline, Feature Flags & Progressive Delivery, and Scaling CI/CD Across Teams.

Week 4 — Configuration Management & IaC (17h)

Read Configuration Management & IaC: CloudFormation templates, change sets, and drift detection — and the sharp line between what a change set previews (a future template update) and what drift detection catches (an out-of-band change with no template update involved); StackSets for fanning one template out across many accounts and regions, which is a different tool solving a different problem than nested stacks; the CDK compiling real code down to CloudFormation; fleet configuration through Systems Manager; and governing many accounts with Organizations and Control Tower.

Build Capstone Part 2 — Infrastructure as Code, then Drill — Write a Reusable IaC Module if module boundaries haven't clicked yet. Background: Immutable Infrastructure & Golden Images and Database Change Management — and if cost keeps creeping into your IaC reviews, FinOps for Delivery Pipelines.

Week 5 — Security & Compliance (17h)

Read Security & Compliance: the shared responsibility model underneath everything else in this domain; IAM least privilege, roles, and — the single most exam-tested distinction in the whole blueprint — trust policy vs. permissions policy vs. permissions boundary vs. service control policy; encrypting everything with KMS and Secrets Manager; continuous compliance through AWS Config and conformance packs; threat detection with GuardDuty and Security Hub; and securing the pipeline itself.

Build Capstone Part 6 — Security Hardening, then Drill — Secure a Vulnerable Pipeline. Background: Secrets & Credential Management, Shift-Left Security for DevOps, Supply-Chain Security & SBOM, and Compliance as Code & Policy Enforcement.

Weeks 6–8 — the remaining 44%: Resilient Cloud Solutions, Monitoring & Logging, and Incident & Event Response

☺ Like you're 10: Three more weeks, three more domains — smaller slices of the score each, but "smaller" still isn't "skippable."

Nothing on the DOP-C02 blueprint is small enough to ignore — the lightest domain here is still worth one question in roughly every seven — but each of these three earns one focused week rather than two, in direct proportion to what it's worth.

Week 6 — Resilient Cloud Solutions (15h)

Read Resilient Cloud Solutions: why this domain exists as its own line item under the Well-Architected Reliability pillar; multi-AZ and multi-region architecture; Auto Scaling policies, including instance refresh as the ASG-native rollout mechanism with no CodeDeploy involved at all; ELB health checks and the ASG health-check-type trap (EC2 vs. ELB); Route 53 failover and health-check routing; and disaster-recovery patterns trading cost against RTO and RPO.

Build Capstone Part 3 — Deployment Strategy, then Drill — Roll Back a Bad Deploy. Background: this course's own vendor-neutral deployment strategies page, plus Chaos Engineering & Game Days for proving resilience rather than assuming it.

Week 7 — Monitoring & Logging (15h)

Read Monitoring & Logging: CloudWatch metrics, alarms, and dashboards; CloudWatch Logs and Logs Insights; X-Ray's per-request distributed tracing; CloudTrail as the audit trail, including the management-vs-data-event split that governs whether an S3 GetObject is actually being logged; aggregating logs across accounts and services; and automated remediation wiring EventBridge rules to Lambda and SSM Automation. The fastest triage question for this whole domain: is the scenario asking "who did it" (CloudTrail), "where did one request's time go" (X-Ray), or "is this number bad" (CloudWatch)?

Build Capstone Part 4 — Observability, then Drill — Set Up Meaningful Alerts. Background: Distributed Tracing & Telemetry and SLOs, Error Budgets & Toil for what those dashboards are actually supposed to be watching for.

Week 8 — Incident & Event Response (14h)

Read Incident & Event Response: detecting trouble with CloudWatch Alarms vs. EventBridge rules — and specifically the alarm's own short, fixed native-action list (EC2 action, Auto Scaling action, SNS, OpsItem, start an Incident Manager incident) versus everything else, which has to route through EventBridge instead; automated remediation with Systems Manager Automation runbooks, including aws:branch and aws:approve for multi-step, conditional, approval-gated workflows that plain Run Command can't do; escalating to a human through Incident Manager, SNS, and AWS Chatbot; and post-incident analysis workflows.

Build Capstone Part 5 — Incident Response, then both Drill — Diagnose a Production Incident and Drill — Run a Blameless Postmortem. Background: On-Call Culture & Sustainable Operations.

Week 9 — integration: wire six domains into one story

☺ Like you're 10: Now stop studying six separate subjects and notice they were always one story — a change moving from a laptop to production, staying up, and getting fixed fast when it doesn't.

Finish the capstone track end to end if any stage is still open — the six parts you built across Weeks 2–8 are deliberately sequential, each one assuming the state the previous part left behind. Then step back from AWS specifics for a week and read the practices and history that explain why the six domains are shaped the way they are: DevOps Anti-Patterns & Pitfalls and Best Practices & the Operating Model for the operating model DOP-C02's scenarios assume you already work inside, and a couple of the case studies for how it plays out at real scale — Amazon & "You Build It, You Run It" (the same ownership model behind why the exam expects one team to own a service's pipeline, its infrastructure, and its pager) and Google & the Birth of Error Budgets (the reasoning underneath the Monitoring & Logging and Incident & Event Response domains). If your organization's next step after DevOps maturity is platform engineering, From DevOps to Platform Engineering is worth an hour here too.

Spend the rest of the week re-reading your own mistakes.csv from Week 1 onward and re-drilling anything you've gotten wrong twice. That's the real integration work — not new content, but proof the earlier seven weeks actually stuck.

The readiness checkpoint — the gate before Set 1

☺ Like you're 10: Before anyone lets you sit a real 180-minute paper, six quick honesty checks — one per domain — plus two that look at the whole exam at once.

This is the gate the plan's own title promises: don't open Mock Exam Set 1 until every item below is genuinely true, not "true if I squint." A knowledge exam makes it easy to mistake recognizing a correct answer for actually knowing the material — the checklist below is written to catch that gap while it's still cheap to close.

• ① The three 56% domains
• I can explain, without looking anything up, why CodeDeploy's in-place strategy rolls back slower than blue/green — and what specifically has to still be true for blue/green's speed advantage to hold
• I can state the difference between what a CloudFormation change set previews and what drift detection catches, in one sentence each
• Given a one-paragraph IAM symptom, I can say in under ten seconds whether it points at a trust policy or a permissions policy
• ② The remaining 44%
• I know why an RDS Multi-AZ standby can't also serve as a read replica, and what two separate resources the job actually needs
• I can name, from memory, which of CloudWatch, X-Ray, and CloudTrail answers "who did it," which answers "where did the time go," and which answers "is this number bad"
• I know which five actions live on a CloudWatch alarm's own native action list, and that anything else needs an EventBridge rule
• ③ The whole exam
• I built all six capstone stages, not just read about them, and could redo the trickiest one from a blank slate
• My Week 1 cold baseline on Set 3 and a fresh, untimed re-read of the same paper now show a real gap — most of my original misses no longer happen

Six or more checked, across both categories, is a reasonable green light for Week 10. Fewer than that, don't force the calendar — go back to the specific domain week above, not to a general re-read of everything, and re-check in a few days.

Weeks 10–11 — five mock papers, spaced properly, then book the exam

☺ Like you're 10: Five practice tests, in a specific order, with rest days between them — not five copies of the same test taken back to back.

Once the readiness checkpoint is genuinely clear, sit the five mock papers in the order they were built for, spacing real review days between sittings rather than stacking two 180-minute papers into one day — a paper you haven't reviewed yet can't teach you anything the next one needs.

After each sitting, add every miss to the mistake log from Week 1 and re-drill only what that specific paper exposed — not everything. For the exact reasoning behind why an answer was right, work through the AWS Service & Command Reference; for the process of eliminating a wrong-sounding option under a clock rather than just recognizing the right one, see Answer Triage & Elimination.

Once Set 5 is behind you and the gate items above are still true, move on to Timmy's registration checklist and book the exam — not before. There is no rule against sitting Set 5 twice if the first pass exposed something real, but give the repair a few days to land before you do; a second sitting taken the next morning mostly measures how well you remember yesterday's paper, not how ready you actually are.

That's the plan: eleven weeks, hours funded by the real weights, every domain paired with its lesson, its capstone stage, and its tools, a checkpoint that has to actually pass, and five mock papers sat in the order they were built for. Pair it with the exam guide for the format and registration details, No Docs Map — Closed Book for why nothing here assumes you can look anything up on the day, the service & command reference and Know It Cold for the facts worth drilling outright, and Answer Triage & Elimination for the technique that turns a genuine fifty-fifty guess into a confident one.