AWS DevOps Engineer Professional
The AWS Certified DevOps Engineer – Professional — exam code DOP-C02 — is Amazon's hardest operations-flavored credential, and the one AWS exam that most closely resembles the day job this course teaches: ship changes safely through a pipeline, keep the account structure underneath governed, watch the system closely enough to know when it's degrading, respond when an event fires, and design for the failure you didn't get to prevent. This course's certifications hub already covers AWS Certified CloudOps Engineer – Associate (SOA-C03) — the exam for running an AWS workload day to day. This is the step up: automating that operation at scale across a whole organization, not just executing it inside one account. As with any certification, treat the specifics below — price, question count, exact wording — as a snapshot; verify them on AWS's own certification page before you book anything.
Imagine two different badges for looking after a whole street of houses. One badge — the one this course already covers — proves you can walk into any single house, notice the boiler's making a weird noise, and fix it before it floods the kitchen. The other badge, this one, proves something bigger: that you can set up the system that watches every house on the street automatically, decide the rules that apply to all of them at once so nobody's boiler gets installed wrong in the first place, and build the delivery truck that safely brings a new part to any house without ever shutting off everyone's water at the same time. Same street. Very different job.
What it actually tests, and where it sits
☺ Like you're 10: It's Amazon's own test of "can you run continuous delivery, keep it observable, and fix it fast" — but only inside Amazon's own cloud.
AWS describes the target candidate as someone who can provision, operate, and manage distributed systems and services on AWS, with five headline abilities named directly in the exam guide: run continuous delivery systems, automate security controls and compliance validation, define monitoring and logging strategies, build systems that are highly available and self-healing, and maintain tooling that automates operational work. It sits at AWS's Professional tier — above the Foundational and Associate credentials — and unlike the Associate-level CloudOps exam this course already profiles, it isn't primarily about executing day-to-day operational tasks inside a single account. It's about building the automation, the pipelines, and the account-wide guardrails that make day-to-day operations possible at scale in the first place.
This exam does not test SLIs, SLOs, or error-budget policy, blameless postmortem facilitation, or any of the SRE-practice vocabulary this course is built around — that territory is entirely vendor-neutral and AWS doesn't claim it. What it tests is the AWS-specific plumbing underneath reliability work: the pipeline that ships the fix, the account structure that governs who can touch what, and the automated response that fires before a human ever opens a laptop. Pass this exam and you've proven you can build that plumbing on AWS specifically — not that you know when to spend the error budget it protects.
The step up from CloudOps Engineer Associate
☺ Like you're 10: The Associate exam proves you can drive the truck. This one proves you can design the whole delivery route, the traffic rules, and the alarm system for every truck on every street at once.
It's worth being precise about the difference, because the exams sound similar from a distance and are not similar up close. CloudOps Engineer Associate tests whether you can operate and troubleshoot AWS workloads that already exist — read a CloudWatch alarm, restore a snapshot, follow a runbook, keep a single account's resources healthy. DevOps Engineer Professional assumes you can already do something like that and tests a different, harder question: can you build the systems — the pipeline, the infrastructure-as-code, the cross-account guardrails, the automated remediation — that make operating reliable at scale possible for an entire organization instead of one account at a time. AWS's own guidance recommends two or more years of hands-on AWS experience before attempting the Professional exam, precisely because its scenario questions treat Associate-level service knowledge as background you're assumed to already have while it asks you to reason about something harder on top of it.
The six domains and weights
☺ Like you're 10: Six topics, and delivery is nearly a quarter of the whole test on its own — add the infrastructure-as-code domain and it's almost two-fifths.
The DOP-C02 exam guide publishes six content domains that sum to exactly 100%. These are transcribed faithfully from AWS's own guide — its names, its percentages, not a summary reordered by what seems important:
| Domain | What sits inside it |
|---|---|
| SDLC Automation · 22% | Implementing CI/CD pipelines; wiring automated testing into them; managing build artifacts; choosing deployment strategies — rolling, blue/green, canary — for instance, container, and serverless targets |
| Configuration Management & IaC · 17% | Defining reusable infrastructure as code; automating account creation, onboarding, and security across multiple accounts and Regions; automating large-scale operational tasks |
| Security & Compliance · 17% | Identity and access management at scale; automating security controls and data protection; continuous security monitoring and auditing |
| Resilient Cloud Solutions · 15% | Designing highly available architectures; designing for scalability; automating recovery to meet stated RTO and RPO targets |
| Monitoring & Logging · 15% | Collecting, aggregating, and storing logs and metrics; auditing and analyzing them to detect issues; automating monitoring and event management |
| Incident & Event Response · 14% | Managing event sources so they notify and trigger action; making configuration changes in response to events; troubleshooting system and application failures |
Two things follow from that shape. First, the exam is compensatory — AWS states you need to pass the exam overall, not each domain individually, so a real weakness in one area doesn't disqualify you the way it might in a domain-gated exam. Second, notice how much of this maps onto reliability work directly rather than raw AWS service trivia: Resilient Cloud Solutions is this course's reliability patterns filtered through RTO and RPO language, and Monitoring and Logging plus Incident and Event Response together are almost thirty percent of the exam and map close to one-for-one onto monitoring and observability and incident management and on-call.
What the domains look like in practice
☺ Like you're 10: A real example: an alarm that only pages a human once two signals agree, and an automatic response that fires the moment it can.
Domain 4 and Domain 5 are where this exam overlaps most directly with SRE practice, because they're testing the same instinct this course drills: alert on symptoms, not on every noisy signal, and automate the response you'd otherwise do by hand under pressure. A composite alarm in CloudWatch only fires when multiple underlying alarms agree, which is the same reasoning behind combining SLI signals before paging anyone — see alert design and alert fatigue for the general version of this idea. And EventBridge turning a raw AWS event into an automated Systems Manager runbook is this exam's version of closing the loop without a page at all:
# Domain 5 — an Auto Scaling group's health check fails; instead of waiting
# for a human to notice, EventBridge routes the raw event straight to an
# SSM Automation runbook that attempts the fix unattended.
aws events put-rule --name asg-unhealthy-instance \
--event-pattern '{"source":["aws.autoscaling"],
"detail-type":["EC2 Instance Terminate Unsuccessful"]}'
aws events put-targets --rule asg-unhealthy-instance \
--targets 'Id=1,Arn=arn:aws:ssm:eu-west-1:111122223333:automation-definition/Restart-Unhealthy-Instance:$DEFAULT,RoleArn=arn:aws:iam::111122223333:role/EventBridge-SSM-Automation'
# Domain 4 — a composite alarm pages only when latency AND the error rate
# both agree something is wrong, instead of paging on either one alone.
aws cloudwatch put-composite-alarm --alarm-name checkout-degraded \
--alarm-rule "ALARM(checkout-latency-p99) AND ALARM(checkout-5xx-rate)" \
--actions-enabled --alarm-actions arn:aws:sns:eu-west-1:111122223333:platform-alertsDomains 1, 2, and 6 are AWS's own delivery and governance stack sitting a layer beneath that: CodePipeline orchestrating stages, CodeBuild running a buildspec.yml, and CodeDeploy shifting traffic blue/green with a lifecycle hook that can abort the release before production traffic ever moves; CloudFormation, the CDK, and StackSets for infrastructure as code that spans accounts and Regions, with Organizations, Control Tower, and service control policies as the guardrails that constrain what any one account is allowed to do regardless of its own IAM. Working through a full pipeline and a full SCP hands-on is exactly what this site's Platform Engineering course covers in depth for this same exam — go there for the buildspecs, the appspecs, and a lab that builds a real pipeline before you decide whether to book.
How the domains map onto this course
☺ Like you're 10: Nearly every domain here has a matching lesson on this site — the AWS exam just teaches Amazon's specific version of an idea you can also learn without a cloud console open.
| DOP-C02 domain | The portable idea | Read here |
|---|---|---|
| SDLC Automation | Pipelines, artifacts, progressive rollout, automatic rollback | Release engineering & progressive delivery, SRE tools & automation |
| Configuration Management & IaC | Declarative infrastructure, guardrails that only subtract permission | Production readiness reviews, toil & automation |
| Security & Compliance | Least privilege, continuous auditing, security as a reliability input | Security's overlap with reliability |
| Resilient Cloud Solutions | Failure domains, RTO/RPO, redundancy that actually fails over | Multi-region & multi-AZ architecture, Disaster recovery & business continuity, Reliability patterns |
| Monitoring & Logging | Metrics, logs, alerting on symptoms rather than every signal | Monitoring & observability, Alert design & alert fatigue, Datadog |
| Incident & Event Response | Event-driven remediation, structured triage under pressure | Incident management & on-call, Incident command for large-scale incidents, PagerDuty |
Read that table right to left when you're deciding whether to study for this exam at all: if the right-hand column already looks familiar from the rest of this course, you're closer to exam-ready on the ideas than the AWS-specific vocabulary suggests — you'd mostly be learning where Amazon put the buttons.
Exam logistics — verify before you book
☺ Like you're 10: Here's roughly what it costs and how it's graded, but these numbers move, so check AWS's own page before you pay anyone.
The details below are what AWS generally publishes and what candidates consistently report as of this writing, August 2026. Certification logistics — price, question count, and the recertification path in particular — move without much announcement, so treat this table as a planning aid, not a source of truth.
| Item | What's generally published |
|---|---|
| Format | Multiple choice and multiple response — no live terminal, unlike the CNCF-style performance-based exams |
| Question count | 75 total — around 65 scored, the remainder unscored trial questions not identified on the exam |
| Duration | 180 minutes |
| Passing score | Scaled score out of 1,000; minimum passing score generally cited around 750; compensatory model — the exam overall must pass, not each domain |
| Validity | 3 years from the pass date, with a renewal or higher-level-exam path to extend it |
| Price | Around USD $300 list; regional pricing and taxes vary |
| Prerequisites | None formally required — AWS removed formal prerequisites platform-wide at the end of 2018 — but AWS's own target-candidate description recommends two or more years of hands-on experience provisioning, operating, and managing AWS environments plus real SDLC and scripting experience |
| Delivery | Pearson VUE testing center, or online proctored |
Question counts, pricing, the passing score, and especially the in-scope AWS service list all change. This is an independent, unofficial snapshot. Amazon's certification catalogue moves quickly enough that individual services named in a given exam guide have been retired mid-cycle before — always cross-check what you're studying against the official AWS certification page and the current DOP-C02 exam guide before you commit study time, and re-verify again before you pay for the exam itself.
Who should sit it, and who should skip it
☺ Like you're 10: If you're the one designing the pipeline and the account rules for a whole AWS organization, this is your badge. If you just need to prove you can keep one AWS workload healthy, you already have the right exam.
Sit it if you're an SRE, platform engineer, or DevOps engineer who owns — or wants to own — the delivery pipeline and the account-wide guardrails for production running on AWS, not just the day-to-day operation of a single workload inside it. It's the right credential if your actual job includes designing multi-account governance, building the CI/CD system other teams deploy through, or being accountable for RTO and RPO targets on paper, not just responding when something breaks. For many employers with AWS-heavy platforms it also functions as a hiring filter independent of what it personally teaches you.
Skip it, or at least deprioritize it, if any of these describe you. You just need day-to-day operational competence on AWS — the Associate-level CloudOps Engineer credential this course already covers is the right-sized exam, and this Professional exam would mostly be studying material you don't touch. You're multi-cloud, or your platform's whole value proposition is cloud independence — very little of what you'd memorize here transfers to Google Cloud, Azure, or a Kubernetes-native stack; the vendor-neutral SRE Foundation covered on this course's certifications hub is the more durable investment. You want a hands-on, performance-based signal of what you can actually do — this exam is entirely multiple choice; if demonstrating live-cluster craft matters more to you, this course's own CKA profile points at the stronger alternative. And if you're new to AWS entirely, sitting this cold is a well-documented way to spend $300 studying vocabulary instead of reasoning — build Associate-level fluency first, on this exam or the AWS Solutions Architect Associate, before attempting the Professional tier.
Benny the Beaver: I want to sit the DevOps Engineer Professional. Half our incidents last quarter traced back to someone hand-editing a CloudFormation stack instead of going through the pipeline.
Foxy: Hold on — didn't we already cover an AWS certification on the hub? Why do we need a second one?
Timmy the Turtle: Different job. CloudOps Associate proves you can operate one account well. This one proves you can build the pipeline and the guardrails that keep every account in shape while it ships changes.
Pip the Hummingbird: And the part I care about — Domain 5 is event and incident response. If an EventBridge rule can fire an automated fix before I have to page anyone, that's a page I never have to send.
Benny the Beaver: Exactly. Though I'll admit half of what I'd be memorizing is CodePipeline stage syntax that means nothing outside AWS.
Professor Owl: Which is fine, as long as you know that going in. Learn the shape — pipelines with guardrails, alarms that only page when they agree, automated recovery to a stated RTO — and the AWS vocabulary is just this quarter's implementation of it.
1. What's the exam code for this credential, and what tier does it sit at in AWS's certification ladder? 2. Which single domain carries the largest weight, and what's the combined weight of that domain plus Configuration Management and IaC? 3. What's the concrete difference between what CloudOps Engineer Associate tests and what this exam tests? 4. Name two things this exam does not test that are core to this course's own SRE practice. 5. Give one reason an SRE running a multi-cloud platform should generally skip this exam in favor of the SRE Foundation.
Check your answers
- The exam code is DOP-C02, and it sits at AWS's Professional tier — above the Foundational and Associate credentials.
- SDLC Automation at 22% is the largest single domain; combined with Configuration Management and IaC at 17%, the two together account for 39% of the exam — nearly two-fifths devoted to how software and infrastructure move into production.
- CloudOps Engineer Associate tests whether you can operate and troubleshoot an AWS workload that already exists, day to day, inside one account. This exam tests whether you can build the pipeline, the infrastructure-as-code, and the cross-account guardrails that make that day-to-day operation possible at scale across an entire organization.
- Any two of: SLIs, SLOs, and error-budget policy; blameless postmortem facilitation; toil measurement; or any other vendor-neutral SRE-practice mechanism this course teaches — this exam is entirely about AWS-specific automation and governance, not reliability practice as a discipline.
- Very little of the AWS-specific knowledge — CodePipeline stage syntax, service control policy structure, CloudFormation StackSets — transfers to another cloud or to a cloud-agnostic platform; the vendor-neutral SRE Foundation tests the practice itself and stays useful regardless of which cloud an employer runs.