DOP-C02 · Exam Prep · Know It Cold

Know It Cold

This is not a lesson. Every domain page on this site teaches why a deployment strategy or a DR pattern works the way it does — this page skips the why and drills the numbers themselves, the ones a multiple-choice question drops on you cold with no context and expects back in under thirty seconds: the six domain weights, the 75/180/750 format numbers, the name and one-line tradeoff of every deployment strategy including the exact CodeDeploy config identifiers, and RTO/RPO defined precisely enough to survive a trick question. If you can recite this whole page from memory with the tab closed, that part of the exam is no longer a knowledge problem — it's just reading comprehension.

☺ Explain it like I'm 10

There's a difference between knowing your times tables and being able to work them out with a pencil. Both get you to "7 × 8 = 56" eventually, but only one of them is fast enough for a timed test where you've got maybe ninety seconds a question. This page is the times-table version of six DevOps facts you'll otherwise be working out by hand, under pressure, at minute forty of a three-hour exam.

🐰🐘Your hosts for this topic: Remy the Rabbit & Ellie the Elephant — Remy fires the facts at you rapid-round, no context, just the answer; Ellie won't let a number go by rounded, renamed, or half-remembered, because she's the one who never drops a metric.
⚠ Verify before exam day

Every number on this page — question counts, timing, passing score, the six domain weights, DR pattern RTO/RPO figures, and CodeDeploy config names — was checked against AWS's own DOP-C02 exam guide and product documentation in August 2026. AWS revises exam guides, deployment-config option lists, and pricing without much notice. Treat this page as your drill deck, not your source of truth, and confirm anything you're about to bet a registration fee on against AWS's official DOP-C02 page first. Full logistics and the reasoning behind every number here live in the DOP-C02 exam guide.

The format numbers — say them without thinking

☺ Like you're 10: Seventy-five questions, three hours, and you need a made-up score of 750 out of a possible 1000 to pass — and ten of those questions secretly don't even count.

These six numbers are the shape of the exam itself. Get them so automatic that reading a question never has to compete with wondering how much time you have left.

FactNumber
Total questions on screen75
Scored / unscored split65 scored, 10 unscored pretest — indistinguishable, answer all 75 like they count
Time limit180 minutes (3 hours)
Score range100–1000, scaled — not a raw percentage
Passing score750
Cost per attemptUS$300 — no discount on a retake
Retake wait if you fail14 days
Certification validity3 years from pass date
◆ The trap in these numbers

750/1000 is not "75% of questions right." AWS never publishes the raw-to-scaled conversion, and it can shift slightly between exam forms — so don't try to budget "how many can I miss." Answer every question, including the ten you'll never identify as unscored, and let the scaling take care of itself.

The six domain weights, in order

☺ Like you're 10: One domain is worth almost a quarter of the test on its own, three domains tie for a close second, and only one domain — the smallest — is worth less than a seventh of your score.

Six domains, six percentages, and they should come back to you in order without hesitating. Notice the tie: D2 and D6 are both 17%, and D3 and D4 are both 15% — a detail multiple-choice questions like to probe ("which is heavier weighted, Config Management or Security?" — trick question, they're identical).

DomainWeightOne-line scope
D1SDLC Automation22%CodePipeline/CodeBuild/CodeDeploy, artifact repos, deployment-automation strategies
D2Configuration Management & IaC17%CloudFormation, CDK, StackSets, Systems Manager fleet config, Organizations/Control Tower
D3Resilient Cloud Solutions15%Multi-AZ/multi-Region, Auto Scaling, ELB health checks, Route 53 failover, DR patterns
D4Monitoring & Logging15%CloudWatch metrics/alarms/Logs Insights, X-Ray, CloudTrail, EventBridge-driven remediation
D5Incident & Event Response14%SSM Automation runbooks, Incident Manager escalation, SNS/Chatbot, post-incident analysis
D6Security & Compliance17%IAM least privilege, KMS/Secrets Manager, AWS Config compliance, securing the pipeline

Collapse it into a study-time mnemonic: D1 alone (22%) beats D4+D5 combined (29% vs. 22%... barely) — more precisely, D1+D2+D6 = 56%, over half the exam sitting in three domains, which is why a study plan that splits time evenly across all six is already wrong before it starts. See the DOP-C02 study plan for the week-by-week version of that math.

⚠ The D4/D5 gotcha

Both D4 (Monitoring & Logging) and D5 (Incident & Event Response) touch EventBridge-driven automated remediation — a rule that fires an SSM Automation document when a CloudWatch alarm trips lives conceptually in both. If a question's scenario is about detecting and alarming on a condition, think D4. If it's about what happens after — the runbook, the escalation path, the postmortem — think D5. The exam usually signals which half of that lifecycle the scenario is in; don't assume "EventBridge" alone points to one specific domain.

Every deployment strategy — name and the one-line tradeoff

☺ Like you're 10: Seven names, and each one trades speed of rollback against how much of production is exposed to a bad build at once — memorize the trade, not just the name.

Full explanations live in deployment strategies; this table is the compressed version for recall under pressure.

StrategyWhat movesRollbackCostOne-line tradeoff
RecreateKill 100% old, then start 100% newRedeploy old version — slow$Guaranteed downtime window; only choice when old and new truly can't coexist (breaking schema, singleton process)
RollingOld + new coexist, swapped a batch at a time, one environmentAnother rolling deploy, reversed — slow$Cheapest — never pays for double capacity — but the mixed-version window must be tolerated by both app and schema
Blue-greenTwo full environments; router flips 100% at onceFlip router back — seconds$$$Fastest rollback of any infra-level strategy; costs a full second environment, and a missed bug hits 100% of users instantly
CanarySmall % of real traffic first, expanded in metric-gated stepsRevert the step, or hold at 0% — fast$$Bounded blast radius; needs live monitoring (or automated analysis) to gate every step, and is slower to reach 100% than blue-green
A/B testing (not a deployment strategy)Traffic split, same mechanism as canaryN/A — the split is the pointMeasures business/conversion metrics, run by product, kept running for a fixed sample window — don't abort it because "the canary looks worse"
Feature flag / dark launchNew code ships to 100% of instances, gated off at runtimeFlip the flag — milliseconds, no redeploy$Fastest "rollback" that exists; the cost is code complexity — every live flag is a conditional someone has to remove later
Shadow deploymentNew code runs on a copy of real traffic; output discarded or diffed, never servedN/A — nothing is user-facing yet$$Load-tests real production shape and volume before a single real user is exposed to the output

Two pairs the exam likes to blur: canary vs. A/B testing both split traffic by percentage, but a canary is a reliability signal torn down once verified, while an A/B test is a business experiment kept running on purpose. And rolling vs. recreate both use one environment, but only rolling keeps old and new serving traffic side by side — recreate accepts a downtime window specifically to avoid that.

The CodeDeploy configs, by exact name

☺ Like you're 10: AWS gives each rollout speed a literal name, and multiple-choice answers are picky about the exact spelling — "AllAtOnce" is not "OneAtATime" and the exam wants you to notice the difference on sight.

Vendor-neutral strategy names above map to CodeDeploy's own vocabulary differently depending on the compute target. Know both halves cold — this is the part of D1 (SDLC Automation) that's pure memorization, not reasoning.

TargetDeployment typeConfig names, slowest/safest → fastest/riskiest
EC2 / on-premisesIn-place (CodeDeploy's word for rolling)OneAtATimeHalfAtATimeAllAtOnce → custom min-healthy-host %
EC2 / on-premisesBlue/greenFresh instances provisioned, LB rerouted all-at-once or over a wait window, originals terminated immediately or after a delay
Lambda / ECSAlways blue/green under the hood — traffic shifts between two versions behind one weighted aliasAllAtOnce · Linear (fixed % every fixed interval, e.g. Linear10PercentEvery1Minute) · Canary (one jump, one hold, then the rest, e.g. Canary10Percent5Minutes)
# deployment group config — literal identifiers, exam-testable as strings
# EC2 / on-premises, in-place:
DeploymentConfigName: CodeDeployDefault.OneAtATime     # most fault-tolerant, slowest
# DeploymentConfigName: CodeDeployDefault.HalfAtATime
# DeploymentConfigName: CodeDeployDefault.AllAtOnce    # zero fault tolerance, fastest

# Lambda / ECS, traffic-shifting:
DeploymentConfigName: CodeDeployDefault.LambdaCanary10Percent5Minutes
# DeploymentConfigName: CodeDeployDefault.LambdaLinear10PercentEvery1Minute
# DeploymentConfigName: CodeDeployDefault.LambdaAllAtOnce

Three facts worth their own flashcard: Lambda traffic always shifts between two versions behind one weighted alias — never against raw version numbers, never against $LATEST. Linear keeps adding a fixed percentage forever until 100% — it has no permanent hold. Canary jumps once, holds once, then sends the rest — don't swap those two descriptions on a question. Automatic rollback on either EC2 or Lambda/ECS fires only when a CloudWatch alarm is explicitly attached to that specific deployment group — an alarm that exists elsewhere in the account, unattached, does nothing. Full walkthrough in SDLC Automation and the AWS Developer Tools reference.

RTO vs. RPO, and the four DR patterns cold

☺ Like you're 10: RTO is the clock counting forward from the crash until you're back up; RPO is the clock counting backward from the crash to your last good copy of the data — and the four DR patterns are just four price tags for shrinking both clocks.

Two definitions, memorized so precisely you could recite them half-asleep:

TermMeasuresDirection from the incident
RTO — Recovery Time ObjectiveMaximum acceptable downtimeForward — how long until serving traffic again
RPO — Recovery Point ObjectiveMaximum acceptable data lossBackward — how old your last good copy of the data is allowed to be

And the four canonical DR patterns, cost and speed rising together in one fixed order — B-P-W-M: Backup & restore, Pilot light, Warm standby, Multi-site active/active.

PatternRunning in the DR RegionTypical RTOTypical RPOCost
Backup & restoreNothing — just backups shipped overHoursHours$
Pilot lightCore only (e.g. a replicated DB) — rest is defined, not runningTens of minutesMinutes$$
Warm standbyFull stack, scaled down, always runningMinutesSeconds–minutes$$$
Multi-site active/activeFull capacity, live in 2+ Regions, both serving real trafficNear-zeroNear-zero$$$$

One more cold fact that rides along with DR questions: lowering a Route 53 record's TTL does not make failover instant. Route 53 answers differently the moment it observes a failed health check, but resolvers and clients holding a cached answer honor it until that cache expires — a low TTL (60 seconds or less, set well before the incident) shrinks the failover window, nothing shrinks it to zero. Full derivation in Resilient Cloud Solutions.

The rest of the numbers worth having cold

☺ Like you're 10: A handful of other numbers show up again and again — the "best" delivery speed and failure rate a team can hit, and a couple of AWS port/behavior facts that questions love to test in passing.

Not the four headline topics above, but frequent enough on this platform's mock exams to earn a place on the same crib sheet:

FactNumber
Elite-tier deployment frequency (DORA)On-demand — multiple deploys per day
Elite-tier lead time for changesLess than 1 hour
Elite-tier change failure rate0–15%
Elite-tier time to restore serviceLess than 1 hour
CodeDeploy rollback trigger conditionOnly an alarm explicitly attached to that deployment group — never an ambient account-level alarm
Recommended low DNS TTL for faster Route 53 failover60 seconds or less — set in advance, not during the incident

Drill it — cover the page, write it blind

☺ Like you're 10: Reading this page again feels productive and mostly isn't — the version of studying that actually works is closing it and writing the numbers from nothing.

Recognizing a number when you see it and producing it from nothing are different skills, and only the second one is tested at minute forty under a countdown clock.

🐰 Remy's drill · 15 minutes, no scrolling back

Close this page. On a blank sheet or empty file, write: the six domain weights next to their domain names, in D1→D6 order; the five format numbers (question count, scored/unscored split, time limit, score range, passing score); all seven deployment strategy names with one distinguishing fact each; the three named CodeDeploy config identifiers for EC2 in-place, slowest to fastest; the two Lambda traffic-shifting shape names with one example identifier each; RTO and RPO defined in one sentence each, correctly assigning forward vs. backward; and the four DR patterns in cost order with a typical RTO for each. Then check every line against this page. Anything wrong twice goes on an actual flashcard in the flashcards deck, not a mental note to "review it again later."

Run it more than once across your last week. The first pass tells you what's missing; the second tells you what didn't actually stick the first time. By the third pass these numbers should come out before you've finished reading the question — which is the only speed that's actually useful with a 180-minute clock and 75 questions splitting it 2.4 minutes apiece.

🎬 At the Ship-It Guild
🐰

Remy: Rapid round. D3's weight. Go.

👺

Gizmo: Uh... seventeen? It's tied with something, right? 🤑

🐘

Ellie the Elephant: Fifteen, Gizmo. You're thinking of D2 or D6 — those are the two tied at seventeen. D3 ties with D4, at fifteen. Two different ties, don't merge them.

🦊

Foxy: Does it actually matter which fifteen or seventeen is which, as long as I know the big one's D1?

🐘

Ellie: It matters the moment a question asks which of two domains is weighted heavier and the honest answer is "neither, they're equal." Half-remembered numbers cost marks a fully-forgotten number never would — at least then you'd know to guess.

🐢

Timmy the Turtle: Same discipline as a deployment strategy, if you ask me. "Roughly canary-shaped" isn't verified. Exactly which config name, exactly which percentage — or it doesn't count as known.

🐰

Remy: Which is why we drill it blind, not read it one more time feeling smart. Blank page. RTO — which direction does the clock run?

👺

Gizmo: Forward! ...I think. Or is that RPO.

🐘

Ellie: RTO forward, RPO backward. Say it until it's boring, Gizmo — boring is what "cold" feels like from the inside.

That's the crib sheet — format numbers, domain weights, every deployment strategy and its CodeDeploy name, RTO/RPO, and the stray facts that ride along with them. Pair it with No Docs Map — Closed Book for the reminder that none of this is available to look up mid-question, the AWS Service & Command Reference when you need the surrounding detail these tables deliberately strip out, and Answer Triage & Elimination for what to do when a question doesn't match anything on this page cleanly. Then take it into Mock Exam · Set 1 under a real 180-minute clock and see how much of this page you didn't actually need to stop and think about.

🐰 Remy's checkpoint

1. State all six domain weights in D1→D6 order — no peeking at the tie between D2/D6 or D3/D4. 2. Give the five core format numbers: question count, scored/unscored split, time limit, score range, and passing score. 3. Name a deployment strategy whose rollback is measured in milliseconds, and explain what it costs instead of infrastructure. 4. Define RTO and RPO in one sentence each, stating which direction in time each one measures — then put the four DR patterns in order from cheapest to most expensive. 5. What is the exact name of the CodeDeploy config that shifts Lambda traffic in one jump, holds, then sends the rest — and what has to be true for that deployment to automatically roll back?

Check your answers
  1. D1 SDLC Automation 22%, D2 Configuration Management & IaC 17%, D3 Resilient Cloud Solutions 15%, D4 Monitoring & Logging 15%, D5 Incident & Event Response 14%, D6 Security & Compliance 17%.
  2. 75 total questions (65 scored, 10 unscored pretest, indistinguishable), 180 minutes, a 100–1000 scaled score, and 750 to pass.
  3. Feature flag / dark launch — a flag flip is not a deployment at all, just a runtime config lookup, so it's faster than any infrastructure-level rollback. The cost is code complexity: every live flag is a conditional both states of the code must support, and it has to be removed once the rollout completes.
  4. RTO (Recovery Time Objective) is the maximum acceptable downtime, measured forward from the incident to recovery. RPO (Recovery Point Objective) is the maximum acceptable data loss, measured backward from the incident to the last good copy of the data. Cheapest to most expensive: backup & restore → pilot light → warm standby → multi-site active/active.
  5. CodeDeployDefault.LambdaCanary10Percent5Minutes (10% immediately, hold 5 minutes, then the remaining 90%). It only rolls back automatically if a CloudWatch alarm has been explicitly attached to that specific deployment group — an alarm existing elsewhere in the account, unattached, does nothing for it.