Exam Prep · DOP-C02 · Mock Exams · Set 1

Mock Exam · Set 1

This is the first of five full-length DOP-C02 practice papers on this course, built to answer one question: is the vocabulary from all six exam domains actually in your head, under a real clock, before anything harder gets thrown at you? Seventy-five questions — 65 scored and 10 unscored, exactly like the real AWS Certified DevOps Engineer – Professional exam — weighted to the official domain percentages (22/17/15/15/14/17%), sat in one unbroken 180-minute block, with a worked explanation directly under every question. Set 1 skews toward straightforward recall on purpose: "which service does this," "which config option does that" — the kind of question a careful read of the six domain pages already prepared you for, rather than the layered, multi-service scenario traps later sets will add once this baseline is solid.

☺ Explain it like I'm 10

Imagine you've been studying six chapters about running a delivery fleet — how to build a truck, how to keep it running, how to fix it when it breaks. This is the pop quiz that covers all six chapters at once, with the clock running and seventy-five questions in a row. Ten of those questions are secretly ones the test-makers are trying out for a future quiz — they don't count toward your grade, but you're never told which ten, so the only sane strategy is answering every single one like it counts. That's not a trick. That's exactly how the real test works too.

🐢🐰Your hosts for this topic: Timmy the Turtle & Remy the Rabbit — Timmy holds the stopwatch for all 180 minutes and won't stop it for anything, and Remy is this course's quick-recall specialist, which makes him the right host for a first paper that's deliberately built to reward instant, correct recall over slow deliberation.

Where Set 1 sits in your DOP-C02 prep

☺ Like you're 10: This is the warm-up concert — you've practiced each of the six chapters on its own, and now you play all six back to back, for the first time, with no pausing to reread.

The natural sequence on this course is: read the six domain pages — SDLC Automation, Configuration Management & IaC, Resilient Cloud Solutions, Monitoring & Logging, Incident & Event Response, and Security & Compliance — drill each one until its checkpoint is automatic, then sit this paper as your first honest measurement of the whole syllabus at once. This paper deliberately assigns questions to each domain in the same proportion AWS uses for the real exam — 22% SDLC Automation, 17% Configuration Management & IaC, 15% Resilient Cloud Solutions, 15% Monitoring & Logging, 14% Incident & Event Response, and 17% Security & Compliance — so a low score in one domain here is unusually actionable: it's telling you precisely which page to reread, not just that you "did badly" in some vague sense.

This is Set 1 of five, and the five are not identical in difficulty. This paper is the recall baseline — mostly "which AWS service or config option does this" questions in the shape the domain pages already showed you being answered. Later sets in the sequence lean harder into layered, multi-service scenarios and near-miss distractors, the way the real exam's harder half tends to. Sit them in order — see the DOP-C02 study plan for how to sequence all five against your remaining prep time — and treat a strong Set 1 score as permission to move on, not as proof you're exam-ready outright.

Sit it like the real thing

☺ Like you're 10: Real quiz rules: no notes, no open tabs, no calculator except your own head, one sitting, go — and if you're not sure, guess anyway, because a blank answer is graded exactly the same as a wrong one.

The DOP-C02 exam is fully closed-book — unlike a performance-based exam that permits official vendor documentation during the sitting, AWS's own certification exams permit nothing at all once the clock starts: no notes, no browser tab, no this course, no colleague, no AI assistant. Sit this practice paper under the same restriction rather than quietly loosening it "just this once." Close every other tab and treat the seventy-five questions below exactly as you'd treat them in a locked-down, proctored environment — see the closed-book map for exactly what that discipline means in practice.

AWS's own exam guidance states plainly that an unanswered question is scored as incorrect — there is no separate penalty for a wrong guess beyond simply not earning the point. That makes the correct strategy unambiguous: never leave a question blank. Eliminate what you can using answer triage & elimination, then commit to your best remaining option — a considered guess costs you nothing a blank answer wouldn't have cost you anyway, and it has a real chance of being right.

⚠ Format specifics can change — verify before you book

The 75-question count, the 65/10 scored/unscored split, the 180-minute duration, the 750/1000 scaled passing score, and the six domain weights all reflect AWS's own DOP-C02 exam guide at a point in time. AWS revises exam formats, question counts, and passing scores without much notice — this exam has already been revised once, from DOP-C01 to DOP-C02. Confirm the current specifics on AWS's own DOP-C02 exam page before you register for the real thing — treat this paper as calibrated to that format, not as a substitute for checking it yourself.

Your 180-minute budget

☺ Like you're 10: Seventy-five questions, one hundred eighty minutes — that's under two and a half minutes each, but some will take fifteen seconds and some will take four minutes, so budget by block, not by question.

Seventy-five questions in 180 minutes averages 2.4 minutes each, but no real exam distributes difficulty evenly across its own numbering, and this paper doesn't pretend to either. The table below splits the sitting into five 33-minute blocks of fifteen questions apiece, so you can check your pace against a clean checkpoint roughly every half hour instead of discovering with ten minutes left that you're only on question 40 — plus a 15-minute sweep at the end for anything you flagged.

180 minutes · 75 questions · 750/1000 to pass Block 1 Q1–15 · 33m Block 2 Q16–30 · 33m Block 3 Q31–45 · 33m Block 4 Q46–60 · 33m Block 5 Q61–75 · 33m Review 15m 0 165 180 Weighted to the six real DOP-C02 domains SDLC 22% IaC 17% Resil. 15% Monitor 15% Incident 14% Security 17% Every block mixes all six domains No block leans on one topic — and AWS scores a blank answer as wrong, so a guess always beats a blank. 10 of the 75 are unscored pretest items; you're never told which, so answer every one the same way.

If a question runs past about two and a half minutes without you being confident, don't stall: eliminate the options you can rule out, commit to your best remaining guess, and move on rather than spending a large share of a block's budget on one stubborn item. There's no folded solution to peek at mid-paper the way a hands-on lab bank might tempt you with — each question's explanation sits directly underneath it, so the only discipline required is not opening it before you've committed to an answer.

The paper — 75 questions in exam order

☺ Like you're 10: Seventy-five questions, five blocks of fifteen, every domain mixed into every block — read the stem, pick one answer (or two, when it says so), then check yourself before moving on.

Read each stem once, pick your answer, and only then open the explanation underneath it — treating it as a spoiler you peek at mid-question defeats the entire point of a timed sitting. Each question is tagged with its domain in parentheses so you can total your score by domain afterward; on the real exam you won't get that label, so once you've sat this paper for the first time, consider re-reading the stems with the tags covered to see how many you can still place correctly on content alone. A handful of questions below are marked (Select TWO), matching the real exam's multiple-response format — full credit there requires both correct letters, exactly as AWS scores it.

Block 1 — Q1–15 (minutes 0–33)

Q1 (Domain 1 — SDLC Automation). In a CodePipeline stage, which configuration makes two actions execute in parallel instead of one after the other?

Check the answer

B. Actions that share a runOrder number inside the same stage run in parallel; distinct runOrder values force ascending sequential execution. Separate stages (A) always run sequentially regardless of runOrder.

Q2 (Domain 2 — Configuration Management & IaC). Before applying a CloudFormation template update to a production stack, an engineer wants to preview exactly which resources will be modified, replaced, or deleted, without changing anything yet. Which feature should they use?

Check the answer

C. A change set computes and displays the proposed modifications — including any resource replacements — before you execute it. Drift detection instead compares a stack's actual resources against its template after the fact; it doesn't preview future changes.

Q3 (Domain 6 — Security & Compliance). A CodePipeline in Account A needs to deploy CloudFormation resources into Account B. What is the AWS-recommended mechanism for granting that cross-account access?

Check the answer

B. Cross-account deployment uses an IAM role in the target account with a trust policy naming the source account's role, assumed via sts:AssumeRole — no long-lived credentials cross the account boundary. Sharing keys (A, D) violates least privilege and is explicitly against AWS guidance.

Q4 (Domain 1 — SDLC Automation). In a CodeBuild buildspec.yml, in which phase should commands that install language runtimes and dependencies (e.g., npm install) normally run?

Check the answer

A. The install phase is meant for runtime versions and dependency installation; pre_build handles last steps before building (like an ECR login), build runs the actual compile/test commands, and post_build handles steps like pushing artifacts after a successful build.

Q5 (Domain 3 — Resilient Cloud Solutions). A team needs their RDS database to automatically fail over to a standby with no data loss if the primary AZ becomes unavailable. Which RDS feature provides this?

Check the answer

B. Multi-AZ maintains a synchronous standby in a different AZ and fails over automatically. Read replicas (A) replicate asynchronously for read scaling and don't automatically become the write endpoint without manual promotion.

Q6 (Domain 4 — Monitoring & Logging). A team wants a single alarm that only fires when both high CPU utilization AND high request latency are true at the same time, to avoid paging on either symptom alone. Which CloudWatch feature fits?

Check the answer

B. Composite alarms combine the ALARM/OK states of multiple existing alarms using AND/OR/NOT logic, letting you page only when a specific combination of conditions holds at once — reducing noise from either signal alone.

Q7 (Domain 2 — Configuration Management & IaC). A CloudFormation stack's security group was manually edited in the console after the stack was deployed. Which feature would reveal that the live resource no longer matches the template?

Check the answer

B. Drift detection compares the current, actual configuration of stack resources against what the template expects and flags any manual out-of-band change — exactly this scenario.

Q8 (Domain 5 — Incident & Event Response). A team wants an EC2 instance automatically rebooted the moment a specific CloudWatch alarm transitions into ALARM state, with no human involved. Which combination implements this?

Check the answer

B. CloudWatch alarms can trigger actions directly, or emit a state-change event EventBridge routes to Lambda or Systems Manager — the standard event-driven auto-remediation pattern. An SNS email alone (A) still requires a human to act.

Q9 (Domain 1 — SDLC Automation). In a CodeDeploy AppSpec file for an EC2/on-premises deployment, which hook runs after the new application revision's files have been copied to the instance but before the application is started?

Check the answer

B. The EC2/on-premises hook order is ApplicationStop → DownloadBundle → BeforeInstall → Install → AfterInstall → ApplicationStart → ValidateService. AfterInstall runs once files are in place but before the application process starts — commonly used for configuration steps.

Q10 (Domain 6 — Security & Compliance). A platform team wants to let application developers create their own IAM roles for their Lambda functions, but must guarantee none of those self-created roles can ever exceed a fixed maximum set of permissions. Which IAM feature enforces that ceiling?

Check the answer

A. A permissions boundary is a managed policy setting the maximum permissions an identity-based policy can grant — the effective permissions are the intersection of the boundary and the attached policy, so even a developer-authored role can never exceed it.

Q11 (Domain 3 — Resilient Cloud Solutions, Select TWO). An Auto Scaling group is configured with only EC2 status checks, and instances that pass EC2 status checks but are failing application-level health checks behind the load balancer are never replaced. Which TWO changes would fix this?

Check the answer

A and D. By default, an ASG only considers EC2 status checks. Switching HealthCheckType to ELB (A) makes the ASG also honor the target group's health results (D), so an instance that's running but failing app-level checks gets replaced. Grace period (B) and lifecycle hooks (C) don't address which check type is authoritative.

Q12 (Domain 4 — Monitoring & Logging). A team wants a CloudWatch alarm that adapts its threshold automatically based on a metric's historical hourly and daily pattern, rather than firing on one fixed static number. Which feature should they configure?

Check the answer

B. Anomaly detection uses machine learning on a metric's history to build an expected band accounting for trend and seasonality, and alarms when the metric falls outside that adaptive band — suited to workloads with a predictable but non-constant pattern.

Q13 (Domain 2 — Configuration Management & IaC). A platform team needs to deploy the same baseline CloudFormation template — a logging bucket and a set of IAM roles — into 40 AWS accounts across 3 Regions, from one central place, and keep them all in sync going forward. Which feature is purpose-built for this?

Check the answer

B. StackSets extend stacks across multiple accounts and Regions from a single administrator template, and can target an Organizations OU for automatic deployment as new accounts join. Nested stacks (A) compose one stack from reusable child templates within a single account/Region instead.

Q14 (Domain 1 — SDLC Automation). A team deploying a new Lambda version wants traffic shifted gradually — 10% immediately, the remaining 90% five minutes later — and wants CodeDeploy to automatically roll back if a CloudWatch alarm fires during that window. Which deployment configuration type achieves this?

Check the answer

B. CodeDeploy's canary configurations for Lambda shift a percentage immediately, wait the specified interval, then shift the rest — and if the associated alarm goes into ALARM during that window, CodeDeploy automatically rolls the alias back. HalfAtATime and AllAtOnce are EC2/on-premises configs, not Lambda traffic-shifting options.

Q15 (Domain 5 — Incident & Event Response). A team wants an unhealthy EC2 instance automatically rebooted via a documented, auditable, repeatable procedure — rather than an ad hoc script — whenever a specific EventBridge event pattern matches. Which AWS service is designed for exactly this kind of self-healing runbook execution?

Check the answer

B. Systems Manager Automation runs predefined or custom Automation documents that codify multi-step operational procedures — like restarting an instance — triggerable by EventBridge, invoked manually, or chained into a larger workflow, with a full execution history for audit.

Block 2 — Q16–30 (minutes 33–66)

Q16 (Domain 2 — Configuration Management & IaC). A CloudFormation template needs to perform an action CloudFormation has no native resource type for — say, looking up a value from a third-party API during stack creation. Which CloudFormation feature supports this?

Check the answer

B. A custom resource invokes a Lambda function (or SNS topic) during create/update/delete, letting the template extend into arbitrary logic CloudFormation doesn't natively support.

Q17 (Domain 1 — SDLC Automation). A team needs a managed, private repository to store versioned npm and Python packages consumed by multiple internal CodeBuild projects, with upstream fallback to the public npm registry. Which AWS service is purpose-built for this?

Check the answer

B. CodeArtifact is a managed package repository for formats like npm, PyPI, Maven, and NuGet, and supports an upstream repository — including the public npm registry — so uncached packages are fetched and cached automatically. ECR is specifically for container images.

Q18 (Domain 4 — Monitoring & Logging). An engineer needs to run an ad hoc query across several CloudWatch Log groups to find the slowest 20 requests logged in the last hour, sorted by a duration field embedded in each log line. Which tool is designed for this?

Check the answer

A. Logs Insights provides a purpose-built query language for interactively searching and analyzing log data across multiple log groups — including parsing fields out of unstructured lines, filtering, and sorting.

Q19 (Domain 6 — Security & Compliance). An organization wants to prevent every account in a specific Organizational Unit from ever disabling CloudTrail, even for an account administrator with full IAM permissions in that account. Which mechanism enforces this above any single account's own IAM policies?

Check the answer

B. SCPs are Organizations-level guardrails setting the maximum available permissions for accounts in an OU — SCPs never grant permissions, they only restrict what IAM policies within the account can allow, so even that account's own admin can't exceed it.

Q20 (Domain 3 — Resilient Cloud Solutions). A team wants Route 53 to send all traffic to a primary Region's endpoint under normal conditions, and automatically switch all traffic to a secondary Region's endpoint only if the primary endpoint's health check fails. Which routing policy fits?

Check the answer

B. Failover routing is built for active-passive configurations: it associates a health check with the primary record and routes to the secondary only when the primary is unhealthy. Weighted routing splits traffic by a fixed proportion regardless of health.

Q21 (Domain 2 — Configuration Management & IaC). A team wants to define their infrastructure using a general-purpose programming language, get IDE autocomplete and type checking on resource properties, and still have it deployed as CloudFormation underneath. Which tool fits?

Check the answer

A. The CDK lets you define infrastructure in a general-purpose language using higher-level constructs, then runs cdk synth to generate a standard CloudFormation template deployed the normal way.

Q22 (Domain 1 — SDLC Automation). A CodePipeline in a tooling account deploys into a separate production account. The pipeline's artifact bucket is encrypted with a customer-managed KMS key in the tooling account. What must additionally be true for the production account's CodeDeploy role to decrypt those artifacts?

Check the answer

B. A customer-managed KMS key's key policy is the actual source of truth for access — even if an IAM policy allows kms:Decrypt, the key's own policy must also grant that principal access, since KMS key policies don't extend automatically across account boundaries.

Q23 (Domain 5 — Incident & Event Response). A team wants any S3 bucket that becomes non-compliant with a "block public access" Config rule to be automatically fixed within minutes, without a human running a script. Which AWS Config feature supports this directly?

Check the answer

B. AWS Config lets you attach a remediation action — typically an SSM Automation document — directly to a rule, so a non-compliant resource is automatically remediated (and can retry) without manual intervention.

Q24 (Domain 4 — Monitoring & Logging). A request touches four microservices, and the team needs to see exactly how much time was spent in each downstream call for one specific slow request, as a visual timeline. Which service provides this?

Check the answer

A. X-Ray captures a trace per request as it moves across instrumented services, breaking it into timed segments and subsegments, and renders both an individual trace timeline and an aggregate service map — built specifically to answer "where did the time go."

Q25 (Domain 6 — Security & Compliance). An engineer attaches an IAM policy granting a role kms:Decrypt on a specific KMS key, but the role still cannot decrypt data with that key. What is the most likely cause?

Check the answer

B. For a KMS key, both the key policy and any IAM policy must permit the action — the key policy determines whether IAM policies are even allowed to grant access, via the common "Enable IAM User Permissions" default statement. Removing or restricting that statement can silently block an otherwise-correct IAM policy.

Q26 (Domain 2 — Configuration Management & IaC, Select TWO). An Elastic Beanstalk environment currently uses the "All at once" policy, causing a full outage on every deploy. Which TWO deployment policies keep 100% of the original capacity running and serving traffic for the entire deployment, with no reduction in serving capacity at any point?

Check the answer

A and C. "Rolling with additional batch" launches replacement capacity before removing any existing instances, so total serving capacity never drops. "Immutable" goes further, building an entirely separate environment and only cutting traffic over once every instance passes health checks. Plain "Rolling" (B) does briefly reduce capacity because it takes a batch out of service before replacing it — the exact trap this question tests.

Q27 (Domain 3 — Resilient Cloud Solutions). An application needs a DynamoDB table that accepts writes in multiple AWS Regions simultaneously, with changes automatically propagated and conflicts resolved via last-writer-wins, for active-active multi-Region resilience. Which feature provides this?

Check the answer

B. Global Tables replicate a table across chosen Regions and support writes in any replica Region, propagating changes and resolving concurrent writes via last-writer-wins-based conflict resolution — purpose-built for active-active multi-Region resilience.

Q28 (Domain 1 — SDLC Automation, Select TWO). A CodeBuild project's Docker image builds take 12 minutes, mostly spent re-downloading the same base layers and re-installing unchanged dependencies on every run. Which TWO changes would most directly reduce that repeated work?

Check the answer

A and C. CodeBuild cache modes persist dependency caches and Docker layers between builds, and ordering a Dockerfile so stable layers come first means Docker only rebuilds what actually changed. A larger compute type (B) speeds up computation but doesn't eliminate redundant downloads; source provider (D) and approval gates (E) are unrelated.

Q29 (Domain 4 — Monitoring & Logging). A security team needs to record every read-only API call (like every s3:GetObject) made against a specific highly sensitive S3 bucket, beyond the write/management events CloudTrail records by default. What must they configure?

Check the answer

B. CloudTrail logs management (control plane) events by default, but data events — high-volume operations like S3 object-level API calls — aren't recorded unless explicitly configured via a data event selector, because of their volume and cost implications.

Q30 (Domain 5 — Incident & Event Response). After an outage, the team knows a specific IAM role's permissions changed shortly before the incident began, but not who made the change or exactly when. Which service holds the authoritative record needed to answer that?

Check the answer

B. CloudTrail records the who, what, and when of every management API call — including IAM policy changes — with the calling principal's identity, making it authoritative for exactly this "who changed what, and when" question. See incident management for the broader response process this evidence feeds into.

Block 3 — Q31–45 (minutes 66–99)

Q31 (Domain 6 — Security & Compliance). A team needs a database credential that rotates automatically every 30 days via a Lambda function, with the new credential immediately usable by the application with no manual redeployment. Which service is purpose-built for this?

Check the answer

B. Secrets Manager natively supports scheduled automatic rotation via a rotation Lambda function, and for supported database types understands the single-user or alternating-user rotation strategy so credentials rotate with no application downtime. See secrets & credential management for the full pattern.

Q32 (Domain 1 — SDLC Automation). A CodePipeline should pause after the staging deploy and wait for a specific engineer to review and click "Approve" in the console before proceeding to the production deploy stage. Which CodePipeline feature implements this?

Check the answer

B. A manual approval action pauses execution at that point until an authorized principal approves or rejects it in the console or API, and can be configured to publish an SNS notification so the right person knows a decision is waiting.

Q33 (Domain 2 — Configuration Management & IaC). A team maintaining a legacy fleet already has an extensive library of existing Chef cookbooks they want to reuse directly on AWS-managed EC2 instances, rather than rewriting them in another tool. Which AWS service is designed to run existing Chef or Puppet configurations?

Check the answer

A. OpsWorks provides managed Chef and Puppet configuration management, letting teams run existing Chef cookbooks or Puppet manifests against AWS-managed instances. AWS has been sunsetting parts of OpsWorks in recent years, so treat it as legacy exam knowledge — verify current availability before relying on it operationally.

Q34 (Domain 6 — Security & Compliance). GuardDuty raises a finding indicating an EC2 instance is querying a domain generation algorithm (DGA) domain associated with known command-and-control infrastructure. Which GuardDuty data source most directly enabled detecting this?

Check the answer

B. GuardDuty continuously analyzes VPC Flow Logs, DNS query logs, and CloudTrail events against threat intelligence and machine learning models; DGA-domain and C2-communication findings specifically come from the network/DNS traffic analysis path.

Q35 (Domain 3 — Resilient Cloud Solutions). A team needs a load balancer that preserves a fixed, static IP address per Availability Zone and can handle millions of requests per second at ultra-low latency for a TCP-based protocol, with routing decisions made at the connection level rather than by inspecting HTTP headers. Which should they choose?

Check the answer

B. NLB operates at Layer 4, supports a static IP per zone, and is built for extreme performance and low latency for TCP/UDP traffic. ALB operates at Layer 7 and routes based on HTTP(S) content, the better fit only when content-based routing is actually needed.

Q36 (Domain 1 — SDLC Automation). A CodeDeploy deployment to an EC2 Auto Scaling group is configured with CodeDeployDefault.HalfAtATime. What does this configuration guarantee during the deployment?

Check the answer

B. HalfAtATime deploys to up to half the fleet at a time, keeping at least 50% of instances in service throughout — a middle ground between OneAtATime and AllAtOnce. It doesn't by itself guarantee automatic rollback unless that's configured separately.

Q37 (Domain 4 — Monitoring & Logging). A compliance team wants to bundle a set of AWS Config rules — like "S3 buckets must have encryption enabled" and "EBS volumes must be encrypted" — into a single reusable, deployable package applied consistently across many accounts, with an aggregated compliance score. Which feature fits?

Check the answer

B. A conformance pack is a collection of Config rules and remediation actions packaged as a single deployable template, deployable across an organization and reporting a consolidated compliance score. See compliance as code & policy enforcement.

Q38 (Domain 6 — Security & Compliance). A security team wants one aggregated dashboard showing findings from GuardDuty, Inspector, and Config, normalized into a common format, with an overall compliance score against the CIS AWS Foundations Benchmark. Which service provides this?

Check the answer

B. Security Hub aggregates and normalizes findings from GuardDuty, Inspector, Config, Macie, and other sources into the AWS Security Finding Format, and continuously evaluates resources against standards like the CIS AWS Foundations Benchmark, producing a consolidated score.

Q39 (Domain 5 — Incident & Event Response). A team wants a CloudWatch alarm's state change to post an automatic, formatted message into a specific Slack channel, without a custom Lambda function to format and send it. Which AWS service is purpose-built for this integration?

Check the answer

A. AWS Chatbot integrates directly with Slack and Chime and can subscribe to an SNS topic; when an alarm action publishes to that topic, Chatbot formats and posts the notification — no custom formatting code required.

Q40 (Domain 2 — Configuration Management & IaC). A team needs to store roughly 8,000 plain, non-secret configuration values (like feature-flag booleans) referenced by many services, and cost is a primary concern. Which is the more appropriate store, compared to Secrets Manager?

Check the answer

A. Parameter Store's standard tier is free up to a parameter count limit and well suited to plain configuration values, while Secrets Manager charges per secret per month and per API call and targets secrets needing rotation — the wrong, needlessly expensive tool for thousands of non-secret values.

Q41 (Domain 1 — SDLC Automation). A team's source code lives in a third-party GitHub repository, and they want a CodePipeline execution to start automatically the moment a commit is pushed to the main branch — without polling GitHub on an interval. Which mechanism achieves event-driven, not polling-based, triggering?

Check the answer

B. The CodeStar Connections-based GitHub source action registers a webhook with the repository, so a push triggers execution almost immediately, rather than the older, less efficient polling-based integration. See GitHub Actions for the source-side half of this trigger.

Q42 (Domain 6 — Security & Compliance). A security team wants to be automatically notified whenever an S3 bucket policy or IAM role trust policy is changed in a way that grants access to a principal outside their AWS account or Organization. Which service is designed to find this?

Check the answer

B. Access Analyzer uses automated reasoning to analyze resource policies and specifically identifies findings where a policy grants access to a principal outside its defined zone of trust — exactly the unintended-external-access use case described.

Q43 (Domain 3 — Resilient Cloud Solutions). A company wants a disaster recovery strategy with a recovery time objective (RTO) of minutes, is willing to pay for a scaled-down but always-running copy of its production environment in a second Region, and wants to scale that copy up only when a failover is declared. Which DR strategy best matches this?

Check the answer

C. Warm standby keeps a scaled-down but fully functional copy continuously running in the DR Region, scaled up to full capacity on failover — faster RTO than pilot light (only core/data components running) at lower cost than full multi-site active-active. See Resilient Cloud Solutions for all four strategies side by side.

Q44 (Domain 4 — Monitoring & Logging). A team wants to emit custom, high-cardinality business metrics (like per-customer order counts) directly from their application logs, without making a separate PutMetricData API call for every data point. Which CloudWatch capability supports this?

Check the answer

B. EMF lets you write structured JSON log entries that CloudWatch automatically parses to extract one or more custom metrics — avoiding a dedicated API call per data point while still producing queryable, graphable metrics.

Q45 (Domain 5 — Incident & Event Response). During a multi-account incident response workflow, events from a source account's SQS queue need to be filtered, enriched by calling a Lambda function, and delivered to a target EventBridge bus in a different account — wired as a single point-to-point integration rather than several separate glue functions. Which service is designed for this?

Check the answer

B. EventBridge Pipes connects a source directly to a target with built-in filtering and an optional enrichment step in between — replacing what would otherwise be custom glue Lambda functions with a single managed integration.

Block 4 — Q46–60 (minutes 99–132)

Q46 (Domain 4 — Monitoring & Logging). A team wants CloudWatch Logs from 30 different Lambda functions streamed in near real time into a centralized OpenSearch domain for cross-service search, rather than checking each log group individually. Which combination achieves this?

Check the answer

B. A subscription filter streams matching log events in near real time to a destination like Data Firehose, which can then deliver into an OpenSearch domain — the standard centralized-logging pattern for aggregating many log groups.

Q47 (Domain 2 — Configuration Management & IaC). A team wants to continuously enforce that a specific security agent is installed and running on every EC2 instance tagged Environment=prod, automatically reinstalling it if it's ever found missing — not just checking once at launch. Which Systems Manager capability fits?

Check the answer

B. State Manager associates a document with managed instances and can enforce that state on a recurring schedule, automatically re-applying the desired configuration rather than being a one-time, manually triggered action like Run Command.

Q48 (Domain 1 — SDLC Automation). A team wants their deployment pipeline itself defined as code, automatically updating its own stages whenever the pipeline definition changes in source control — without a manual pipeline-editing step. Which CDK feature is designed for this "self-mutating" behavior?

Check the answer

B. CDK Pipelines is self-mutating — the first thing the pipeline does on each run is check whether its own definition changed, and if so, updates itself before continuing, keeping the pipeline's structure in sync with code automatically.

Q49 (Domain 6 — Security & Compliance). A team runs their CI/CD builds in GitHub Actions and wants those workflows to deploy to AWS without storing any long-lived AWS access keys as GitHub secrets. Which approach is the current AWS-recommended pattern?

Check the answer

B. AWS supports configuring GitHub's OIDC provider as a trusted IAM identity provider; the workflow presents a short-lived OIDC token exchanged for temporary, scoped role credentials per run — eliminating any long-lived AWS secret stored in GitHub. See supply-chain security & SBOM.

Q50 (Domain 3 — Resilient Cloud Solutions). A team wants to run a controlled experiment that terminates a percentage of EC2 instances in a target Auto Scaling group, observe how the system responds, and have the blast radius and stop conditions defined in advance. Which AWS service is purpose-built for this?

Check the answer

B. FIS runs experiment templates defining specific actions, target resources, and stop conditions — CloudWatch alarms that automatically halt the experiment if things go worse than expected — for safely testing resilience under controlled failure injection. See chaos engineering & game days.

Q51 (Domain 4 — Monitoring & Logging, Select TWO). A CloudWatch alarm needs to both notify the on-call engineer AND automatically launch a replacement instance if the underlying EC2 instance status check fails. Which TWO alarm action types support this directly, without custom glue code?

Check the answer

A and B. CloudWatch alarm actions natively support publishing to SNS and EC2 actions like Stop, Terminate, Reboot, or Recover — both configurable directly on the alarm. DynamoDB writes, IAM changes, and Route 53 updates aren't native alarm action types.

Q52 (Domain 2 — Configuration Management & IaC). An operations team wants to codify a repeatable, multi-step "safely patch and reboot an instance" procedure — including pre-checks, the patch step, and post-patch validation — as a reusable, versioned artifact invokable on demand or on a schedule. Which Systems Manager feature is this?

Check the answer

B. Automation documents codify a multi-step procedure as a versioned, reusable artifact with defined steps, inputs, and outputs — suited to a repeatable workflow invoked manually, on a schedule, or by an event.

Q53 (Domain 1 — SDLC Automation). A CodeDeploy blue/green deployment to Amazon ECS needs to run an automated smoke test against the new task set before it receives any production traffic, and roll back automatically if the test fails. Which AppSpec hook is designed for validation before traffic shifts?

Check the answer

B. For ECS blue/green deployments, AppSpec supports Lambda validation hooks around the traffic shift — BeforeAllowTraffic (before any production traffic reaches the new task set) and AfterAllowTraffic (once it fully receives traffic) — letting a Lambda function run smoke tests and fail the hook to trigger automatic rollback. BeforeInstall, ApplicationStart, and DownloadBundle are EC2/on-premises-style hooks.

Q54 (Domain 5 — Incident & Event Response). An EC2 instance in an Auto Scaling group fails its EC2 status checks and becomes unreachable. With no additional configuration beyond the default Auto Scaling group setup, what happens?

Check the answer

B. Auto Scaling groups perform basic EC2 status-check-based health monitoring by default, independent of any custom alarm or ELB configuration, and automatically replace an instance that fails those checks to keep the group at desired capacity — the baseline self-healing behavior of an ASG.

Q55 (Domain 4 — Monitoring & Logging). A team's dashboard shows average API latency looking healthy at 80ms, but a growing number of customers are complaining about slow requests. Which CloudWatch statistic would most likely reveal the problem the average is hiding?

Check the answer

B. An average can look fine even while a meaningful tail of requests is very slow, because a small number of very slow outliers get diluted by many fast ones. A high percentile like p99 specifically surfaces that tail.

Q56 (Domain 6 — Security & Compliance, Select TWO). A CodeBuild project's service role currently has the AdministratorAccess managed policy attached, "to avoid permission errors during builds." Which TWO changes best align this with least privilege, while keeping the pipeline functional?

Check the answer

A and C. The actual fix is replacing over-broad permissions with a policy scoped to what's genuinely needed (A), and Access Analyzer's policy generation can bootstrap that scoped policy directly from the role's observed CloudTrail activity (C). Monitoring usage (B) and rotating credentials (D) don't reduce blast radius, and a permissive fallback (E) defeats the purpose entirely.

Q57 (Domain 2 — Configuration Management & IaC). A platform team wants to let application teams self-service provision only a pre-approved, pre-configured set of resources (e.g., "standard VPC," "standard RDS instance") from a catalog, without giving them broad IAM permissions to create arbitrary infrastructure. Which AWS service is designed for this?

Check the answer

A. Service Catalog lets a central team define portfolios of approved products that end users launch self-service, with launch constraints controlling exactly what IAM role provisions them — self-service access to only pre-approved infrastructure, with no broad standing permissions granted to end users.

Q58 (Domain 1 — SDLC Automation). A CodeBuild buildspec.yml needs a database password at build time to run integration tests, and the team wants to avoid ever storing that password as plaintext in the buildspec file or in a CodeBuild plaintext environment variable. Which approach is recommended?

Check the answer

B. CodeBuild environment variables support a type of SECRETS_MANAGER or PARAMETER_STORE, resolving the actual value at build time and never persisting the plaintext secret in the buildspec, project configuration, or build logs.

Q59 (Domain 3 — Resilient Cloud Solutions). A team wants their Auto Scaling group to maintain average CPU utilization at roughly 50% by adding or removing instances as needed, without manually defining specific scale-out and scale-in thresholds or step adjustments. Which Auto Scaling policy type is designed for this?

Check the answer

C. Target tracking lets you specify a target value for a chosen metric, and Auto Scaling automatically calculates and applies the scale-out/scale-in adjustments needed to hold that target — removing the need to hand-tune step adjustments.

Q60 (Domain 5 — Incident & Event Response). A team wants a GuardDuty finding indicating an EC2 instance is likely compromised to automatically trigger network isolation of that instance within seconds, with no human approval step. Which TWO components are required to build this automated response?

Check the answer

A and B. GuardDuty findings are published as EventBridge events; a rule filtering on the relevant finding type or severity, targeting a Lambda function (or SSM Automation document) that performs the security-group change, is the standard fully-automated remediation pattern. A manual approval action (E) would defeat the "no human approval" requirement by design.

Block 5 — Q61–75 (minutes 132–165)

Q61 (Domain 6 — Security & Compliance). A compliance team wants their security baseline — a set of AWS Config rules — version-controlled in Git, code-reviewed like any other change, and deployed identically across every account in the organization via CI/CD. Which combination best supports this "compliance as code" workflow?

Check the answer

B. Because a conformance pack is itself a template, it can live in Git, be reviewed via pull request, and be deployed consistently to every account through StackSets in a pipeline — turning manual, per-account clicking into an auditable, code-reviewed process.

Q62 (Domain 1 — SDLC Automation). A container registry has accumulated thousands of old, untagged image layers from repeated builds, driving up storage cost with no operational value. Which ECR feature automatically expires images matching a defined rule (e.g., "untagged images older than 14 days")?

Check the answer

B. A lifecycle policy defines rules that automatically expire images matching specified criteria — like untagged images past a certain age, or keeping only the most recent N tagged images — cleaning up storage with no manual deletion process.

Q63 (Domain 3 — Resilient Cloud Solutions). A team wants objects written to an S3 bucket in one Region automatically and asynchronously copied to a bucket in a second Region, to support a DR strategy for that data. Which S3 feature provides this?

Check the answer

B. Cross-Region Replication asynchronously copies new (and optionally existing, via batch replication) objects from a source bucket to a destination bucket in a different Region — the standard S3-native building block for a data-layer DR strategy.

Q64 (Domain 2 — Configuration Management & IaC). A team wants a repeatable, automated pipeline that builds a hardened, patched "golden" AMI on a schedule, runs automated tests against it, and distributes it to multiple Regions — replacing a manual process of hand-configuring an instance and taking a snapshot. Which service is designed for this?

Check the answer

B. Image Builder automates AMI (or container image) creation, testing, and distribution through a defined pipeline — a build component, a test component, and multi-Region distribution settings — replacing ad hoc golden-image creation. See immutable infrastructure & golden images.

Q65 (Domain 6 — Security & Compliance). A platform team wants to automatically reject a CloudFormation template in a pull request if it defines an S3 bucket without encryption enabled — before the template is ever deployed — using rules written and version-controlled as code. Which tool is designed for this pre-deployment policy check?

Check the answer

B. CloudFormation Guard evaluates a template against custom rules before deployment, making it suitable for a CI pipeline gate that rejects non-compliant templates pre-deploy — unlike Config, which evaluates resources only after they already exist.

Q66 (Domain 4 — Monitoring & Logging). A team investigating a suspected data exfiltration incident needs a record of source/destination IP, port, and byte counts for all network traffic in and out of a specific VPC subnet over the last week. Which service captures this?

Check the answer

B. VPC Flow Logs capture IP traffic metadata — source/destination IP and port, protocol, packet and byte counts, and accept/reject decisions — exactly the network-level evidence needed. CloudTrail records API calls, not raw network flow data.

Q67 (Domain 1 — SDLC Automation). A team wants every container image pushed to ECR to be traceable back to the exact CodePipeline execution and source commit that produced it, so a production incident can be root-caused to a specific build. Which practice most directly supports this?

Check the answer

B. Tagging with a value tied to the actual build — a commit SHA or execution ID — creates a durable, queryable link from a running container back to the exact source and pipeline run that produced it. Always overwriting :latest (A) destroys that traceability.

Q68 (Domain 3 — Resilient Cloud Solutions). A service making calls to a downstream API starts receiving ThrottlingException errors under load, and its naive fixed-interval retry logic makes the problem worse by causing many clients to retry in lockstep. Which retry strategy is the AWS-recommended fix?

Check the answer

B. Exponential backoff increases the wait between successive retries, and jitter prevents many clients from retrying at the exact same moment and re-triggering the same throttling — the standard, SDK-supported pattern for handling throttling gracefully.

Q69 (Domain 5 — Incident & Event Response). After a production incident, a team's postmortem document names the specific engineer who wrote the faulty configuration and recommends "additional training" as the primary corrective action. What does this violate?

Check the answer

B. Blameless postmortem practice deliberately avoids naming and blaming an individual, because doing so teaches everyone else that honest, detailed incident reporting carries personal risk. See culture & collaboration for the full mechanics of running one.

Q70 (Domain 2 — Configuration Management & IaC). A team wants to prevent a specific critical CloudFormation-managed RDS instance from ever being accidentally replaced or deleted by a future stack update, even if someone changes a property that would normally force a replacement. Which native CloudFormation feature directly protects against that within the stack itself?

Check the answer

A. A stack policy controls which update actions are allowed on specific resources within a stack; denying Update:Replace and Update:Delete on a resource's logical ID blocks exactly that kind of unintended replace-or-delete during a future update, even for an otherwise-authorized user.

Q71 (Domain 6 — Security & Compliance). A CodePipeline's artifact store is an S3 bucket. Which combination ensures pipeline artifacts are encrypted at rest with keys the security team controls, rather than Amazon S3-managed keys, and that access is auditable per key usage?

Check the answer

B. A customer-managed KMS (SSE-KMS) key gives the security team control over the key's policy and rotation, and because every use of a KMS key is logged to CloudTrail, an audit trail of exactly who decrypted artifacts and when. SSE-S3 (A) encrypts data but uses Amazon-managed keys with no equivalent per-use audit trail.

Q72 (Domain 4 — Monitoring & Logging). A team wants to proactively detect that their public login page is broken — before a real customer reports it — by running a scripted browser check against the live URL every 5 minutes from outside their infrastructure. Which service is designed for this?

Check the answer

B. Synthetics canaries are configurable scripts that run on a schedule to simulate user actions from outside the application, and raise an alarm if the check fails — proactive, outside-in availability checking that internal metrics alone can't provide.

Q73 (Domain 1 — SDLC Automation). A CodeDeploy deployment to an EC2 fleet is configured with an associated CloudWatch alarm and automatic rollback enabled. If that alarm enters ALARM state partway through the deployment, what happens by default?

Check the answer

B. With automatic rollback on alarm enabled, a triggered alarm makes CodeDeploy stop the in-progress deployment and initiate a new deployment of the previous, last-known-good revision — no human needs to notice the failure and manually trigger a rollback.

Q74 (Domain 3 — Resilient Cloud Solutions). An ECS service update is failing to reach a steady state because new tasks keep crashing, and without intervention the service would keep cycling failed tasks indefinitely, consuming capacity. Which ECS feature automatically detects this and rolls the service back to the previous task definition?

Check the answer

B. The deployment circuit breaker monitors a rolling deployment's health and, if it determines the service cannot reach a steady state, automatically stops the deployment and rolls back to the previous, stable task definition — no human needs to notice and intervene.

Q75 (Domain 5 — Incident & Event Response). An event-processing Lambda function occasionally fails on a specific malformed message, and that message is redelivered and reprocessed — and re-fails — repeatedly, consuming capacity without ever succeeding. Which pattern isolates that message so processing of other messages can continue?

Check the answer

B. A dead-letter queue is a separate queue a source redirects a message to after it fails processing a configured maximum number of times, removing that poison-pill message from the main loop while preserving it for later inspection rather than silently dropping it.

Score yourself

☺ Like you're 10: Count your correct answers out of 65, turn it into a rough percentage against the real pass mark, then look at which domain cost you the most points — that second part is the useful part.

AWS scores DOP-C02 on a scaled range of 100–1000, with 750 needed to pass. That scaled score is not a simple percentage of correct answers — it's computed using item response theory that weighs questions by difficulty, and AWS doesn't publish the exact conversion formula, so no practice paper, including this one, can compute your real scaled score. As a widely used rule of thumb among test-prep resources, treat answering roughly 75% of the 65 scored questions (about 49/65) as a reasonable target to clear comfortably, not as a guaranteed pass/fail line — verify current guidance on AWS's own exam page before you rely on any number here.

Before you total anything, here's the reveal AWS never gives you on exam day: questions 9, 15, 21, 24, 34, 43, 49, 53, 70, and 72 were this paper's stand-ins for the exam's unidentified, unscored pretest items. Real DOP-C02 sittings mix 10 of these among the 75, and you're never told which — so don't count them below, but don't feel behind if you missed one, either; on the real exam you'd have spent time on it the same way, because there was no way to know.

DomainScored questions in this paperYour scoreIf under two-thirds, go here
1 · SDLC AutomationQ1, 4, 14, 17, 22, 28, 32, 36, 41, 48, 58, 62, 67, 73/14SDLC Automation
2 · Configuration Management & IaCQ2, 7, 13, 16, 26, 33, 40, 47, 52, 57, 64/11Configuration Management & IaC
3 · Resilient Cloud SolutionsQ5, 11, 20, 27, 35, 50, 59, 63, 68, 74/10Resilient Cloud Solutions
4 · Monitoring & LoggingQ6, 12, 18, 29, 37, 44, 46, 51, 55, 66/10Monitoring & Logging
5 · Incident & Event ResponseQ8, 23, 30, 39, 45, 54, 60, 69, 75/9Incident & Event Response
6 · Security & ComplianceQ3, 10, 19, 25, 31, 38, 42, 56, 61, 65, 71/11Security & Compliance
Total65 scored questions/65~75% (≈49/65) as a rough target
◆ Key idea

A 49/65 built from six solid domains and a 49/65 built from five near-perfect domains plus a near-zero on one are very different results — the second is one unlucky task draw away from failing the real exam, even though both score the same total here. Always do the per-domain arithmetic, not just the headline number.

Beyond the domain breakdown, sort your misses into two piles, because on a recall-focused paper like this one they mean different things. A question you got wrong because you genuinely didn't know the service or the option is a real content gap — reread the linked domain page and redo the exact question cold in a couple of days, and lean on Know It Cold for the facts worth memorizing outright. A question you got wrong despite roughly knowing the material — you second-guessed yourself, confused two similarly named services, or ran out of time and guessed under pressure — is a speed or confidence problem, not a knowledge gap, and the fix is the AWS service & command reference plus more timed papers, not rereading content you already have.

🎬 At the Ship-It Guild
🐰

Remy the Rabbit: Fifty-two out of sixty-five! CodeDeploy hooks, Route 53 failover, KMS key policies — done, done, done, next!

🐢

Timmy the Turtle: Which domain hid your misses, Remy? Fifty-two sounds great until one domain swallowed six of them.

🐰

Remy the Rabbit: ...Resilient Cloud Solutions. I kept mixing up pilot light and warm standby.

🦉

Professor Owl: That's not a speed problem, then. You answered fast and confidently — you were just confidently wrong on one specific distinction. Reread that one table slowly before you sit anything else.

🦫

Benny the Beaver: Same thing happened to me on the CodeDeploy hook order last month. Once I actually drew the seven hooks out on paper, it stuck.

🐢

Timmy the Turtle: Fix that one gap, then sit Set 2 once it's actually fixed — not before, or you'll just confirm the same gap twice.

✓ Checkpoint

1. Why does this paper assign questions to each domain in the same proportion as the real exam's official weights, rather than spreading them evenly? 2. What's the safe assumption about guessing penalties on DOP-C02, and what strategy follows from it? 3. Why can't this page — or any practice paper — compute your real 100–1000 scaled score? 4. You score 49/65 overall but 2/10 on one specific domain — why is that more actionable than a flat 75% average would suggest? 5. What happens to the 10 unscored questions in this paper, and why are you only told which ones they were after you finish?

Check your answers
  1. Because that's exactly how AWS builds the real 65 scored questions — 22% SDLC Automation, 17% Configuration Management & IaC, 15% Resilient Cloud Solutions, 15% Monitoring & Logging, 14% Incident & Event Response, 17% Security & Compliance — so practicing (and scoring) in that same proportion is the closest a study paper can get to the real thing.
  2. AWS scores an unanswered question as incorrect, with no extra penalty for a wrong guess beyond not earning the point. The strategy that follows: never leave a question blank — eliminate what you can, then commit to your best remaining guess.
  3. Because AWS's scaled score uses item response theory, weighting each question by its measured difficulty, and doesn't publish the conversion formula — so a raw count of correct answers can only ever approximate, never exactly reproduce, the real 100–1000 scale.
  4. Because a flat 75% hides where the gap actually is. A domain score of 2/10 is a concentrated, specific content gap fixable by rereading one page, while an evenly-spread 75% wouldn't tell you where to focus at all — the per-domain breakdown converts an average into a diagnosis.
  5. They're scattered through the paper exactly like the real exam's pretest items, unidentified while you're taking it, and don't count toward your score — you only learn which ten they were in the "Score yourself" section, because on the real exam you're never told at all, and treating every question as if it counts is the only sound strategy either way.

That's the full sitting. Reset the timer, close every tab except this one, and let the seventy-five questions above show you exactly which of the six domains is still soft — then go fix precisely that, and nothing else, before you move on to Set 2.

📝 The five sets

Set 1 (you are here) · Set 2 · Set 3 · Set 4 · Set 5. All five are 75 questions — 65 scored, 10 unscored — weighted to the same official domain percentages and scored against the same 750/1000 pass mark; later sets lean progressively further from straightforward recall toward layered, multi-service scenario questions. See the DOP-C02 study plan for how to sequence all five against your remaining prep time, and the DOP-C02 exam for the real thing's day-of logistics.