DOP-C02 practice questions

Q: Is this DOP-C02 practice test free?

Yes. All 15 DOP-C02 practice questions on this page are free, with instant scoring and a written explanation for each answer. You do not need an account and there is no time limit.

Q: How much does the real DOP-C02 exam cost?

The official price is $300. Cyber VK sells the same official DOP-C02 voucher for $279.99 — a saving of $20.01. The voucher is identical to one bought direct and is emailed within minutes of payment.

Q: Are these questions the same as the real DOP-C02 exam?

No. These are original practice questions written to match the published exam objectives and difficulty. They are not real exam questions — sharing or reproducing live exam content breaches every certification body's candidate agreement and can void your certification.

Q: How should I use this practice test?

Use it as a readiness check rather than a study tool. Work through the questions without notes, read the explanation for every answer including the ones you got right, and treat any domain where you miss more than a third as the area to revise before booking your exam.

Question 1

A development team uses AWS CodePipeline to deploy a web application. They want the pipeline to start automatically whenever a developer pushes a commit to the main branch of a CodeCommit repository, with the lowest possible latency and no polling costs. Which approach should be used?

Accepted Answer

EventBridge rules on CodeCommit repository state change events trigger the pipeline immediately upon a push, which is the AWS-recommended pattern and avoids the delay and API cost of polling. CodePipeline cannot subscribe directly to an SNS topic as a source trigger.

Question 2

A company wants its AWS CodeBuild project to run unit tests and publish the results so that pass/fail details for individual test cases are visible in the CodeBuild console. What must be added to the buildspec file?

Accepted Answer

CodeBuild test reporting requires a `reports` group in the buildspec that declares the report files and format (such as JUNITXML), which lets the console render per-test-case results. Artifacts and caches only move files and do not produce test reports.

Question 3

A DevOps engineer must deploy a new version of a containerized service on Amazon ECS so that the new version receives production traffic only after automated validation, with the ability to shift back to the previous version within seconds if validation fails. Deployment must be fully managed and integrate with an Application Load Balancer. What is the MOST appropriate solution?

Accepted Answer

CodeDeploy blue/green for ECS provisions a replacement task set behind a test listener, runs AfterAllowTestTraffic lifecycle hooks for validation, and can reroute or roll back traffic at the listener level almost instantly. Rolling updates and in-place deployments replace tasks progressively and cannot restore the prior version in seconds.

Question 4

A company stores its infrastructure in AWS CloudFormation templates. A DevOps engineer needs to see exactly which resources will be modified, replaced, or deleted before applying an update to a production stack. Which CloudFormation feature provides this?

Accepted Answer

A change set generates a preview listing each resource action (Add, Modify, Remove) and whether a modification requires replacement, before the update is executed. Drift detection reports out-of-band changes, and stack policies only block updates to protected resources.

Question 5

An organization must ensure that a set of standardized CloudFormation stacks is deployed into every new AWS account added to a specific organizational unit in AWS Organizations, without any manual action by the DevOps team. What should be configured?

Accepted Answer

Service-managed StackSets integrate with AWS Organizations and, with automatic deployment enabled, deploy stack instances to accounts as they join the target OU and remove them when accounts leave. Self-managed permissions require pre-created IAM roles in each account and no automatic OU enrollment.

Question 6

A CloudFormation stack creates an Amazon RDS DB instance and an Auto Scaling group of application servers. The application servers must not begin their configuration scripts until the database is fully available and seeded by a bootstrap process running on a separate EC2 instance. The seeding process takes an unpredictable amount of time, up to 45 minutes. Which implementation satisfies this requirement MOST reliably?

Accepted Answer

A WaitCondition paused by a WaitConditionHandle lets an arbitrary process signal completion of application-level work with a configurable timeout, and DependsOn then gates the Auto Scaling group on that signal. DependsOn alone only waits for resource CREATE_COMPLETE, and CreationPolicy ResourceSignal is not supported on RDS DB instances.

Question 7

A DevOps engineer needs to collect application log files written to /var/log/app/app.log on a fleet of Amazon EC2 instances and search them centrally in Amazon CloudWatch Logs. What is the standard way to accomplish this?

Accepted Answer

The unified CloudWatch agent is the supported mechanism for tailing on-instance log files and shipping them to CloudWatch Logs log groups. Detailed monitoring only increases EC2 metric frequency, and subscription filters act on logs that already exist in CloudWatch Logs.

Question 8

A company must retain all AWS API activity across every account in its organization in a tamper-resistant central location for seven years, and analysts must be able to query the data with SQL. Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

An organization trail automatically captures all member accounts, S3 Object Lock in compliance mode makes the delivered logs immutable for the retention period, and Athena queries the objects in place with SQL. The other options add per-account setup, ETL, or cluster management without improving durability guarantees.

Question 9

An application emits a structured JSON log line to CloudWatch Logs on every payment failure. The DevOps team must be paged only when payment failures exceed 25 in any 5-minute window, and the alarm must not fire during periods when the application logs nothing at all. Which configuration is correct?

Accepted Answer

A metric filter converts matching log events into a numeric metric, and a Sum-over-5-minutes alarm with a threshold of 25 matches the stated volume condition. Setting TreatMissingData to notBreaching prevents the alarm from triggering during silent periods, whereas breaching would page the team when no logs are published.

Question 10

A DevOps engineer must be notified whenever an Auto Scaling group launches or terminates an instance, and the notification must also be processed by a Lambda function for inventory updates. Which approach is MOST appropriate?

Accepted Answer

EC2 Auto Scaling emits instance launch and terminate events to EventBridge, and a single rule can fan out to multiple targets such as SNS and Lambda. Group metrics and Config only describe aggregate or configuration state rather than delivering per-instance event notifications.

Question 11

A company requires that any security group modified to allow inbound traffic on port 22 from 0.0.0.0/0 be automatically corrected within minutes, with a record of the remediation. Which solution meets this requirement?

Accepted Answer

AWS Config evaluates the restricted-ssh rule on configuration changes and can invoke an SSM Automation remediation runbook automatically, with both the evaluation and remediation recorded. SCPs would block all legitimate rule changes, and a nightly job does not meet the minutes-level requirement.

Question 12

An application running on Amazon EC2 behind an Application Load Balancer intermittently returns HTTP 502 errors. The DevOps team needs to automatically capture memory dumps and application logs from the affected instance at the moment the error rate spikes, without keeping the instance in service. Which solution achieves this with the LEAST manual intervention?

Accepted Answer

A metric alarm on the 502 metric routed through EventBridge to an SSM Automation runbook can deregister the instance, gather artifacts with Run Command, and terminate it as one automated sequence. The other options either only detect the condition or collect data after the instance state is already gone.

Question 13

A stateless web application must remain available if an entire Availability Zone fails. The application runs on EC2 instances in an Auto Scaling group behind an Application Load Balancer in a single Region. What is the MOST cost-effective way to meet this requirement?

Accepted Answer

Spreading the Auto Scaling group and load balancer subnets across multiple Availability Zones lets healthy AZs absorb traffic when one AZ fails, which is the standard and least expensive design for a stateless single-Region workload. Multi-Region duplication meets the requirement but at far greater cost and complexity.

Question 14

A team deploys a Lambda function with AWS CodeDeploy. They need 10% of invocations sent to the new version for 5 minutes while a CloudWatch alarm on function errors is monitored, with automatic rollback if the alarm goes into ALARM state. Which CodeDeploy deployment configuration should they choose?

Accepted Answer

The Canary10Percent5Minutes configuration shifts 10% of traffic, holds for 5 minutes while alarms are evaluated, then shifts the remainder, which matches the described bake period. Linear configurations increase traffic in repeated increments rather than holding a single 10% canary.

Question 15

A payment platform runs on Amazon Aurora MySQL in us-east-1 and must meet an RTO of less than 1 minute and an RPO of under 1 second for a full Regional failure, while serving low-latency reads from eu-west-1. Which architecture meets these requirements?

Accepted Answer

Aurora global databases replicate with typical lag under one second and can promote the secondary Region in well under a minute, while the secondary cluster also serves local low-latency reads. Cross-Region read replicas and snapshot copies both exceed the stated RTO and RPO, and Multi-AZ protects only against AZ-level failure.

DOP-C02 — DOP-C02 AWS Certified DevOps Engineer Professional Exam Voucher | Buy Online Practice Test

Free Practice Test

DOP-C02 practice test — common questions