AWS Certified DevOps Engineer Professional (DOP-C02) – Study Plan
A condensed 8-week plan for DOP-C02. Master CI/CD automation, infrastructure as code, resilient cloud solutions, monitoring, incident response, and security on AWS.
AWSDOP-C02Passing score: 750 / 1000DevOps engineers with 2+ years hands-on AWS experience, familiar with CI/CD, IaC, monitoring, and security best practices18-Jul-2026
1Build in your AWS account. This is a hands-on exam. Passive study is not sufficient. Every week includes activities that require you to create real resources.
2Build your judgment. For every service and pattern you encounter, understand not just how it works but when it is the right choice and what trade-offs it involves.
3Practice with ExamOS. Use the quiz modes in the order specified in this Study Plan.
4Learn to trace the chain. DOP-C02 questions often describe a multi-service scenario: a commit triggers a pipeline, which deploys to an ASG, which triggers a CloudWatch alarm, which fires an EventBridge rule. Train yourself to trace these chains end to end.
Rookie ModeChallenger ModeLegend Mode
Week-by-Week Breakdown
W1
Week 1
Self-Assessment
This week is about mapping your current knowledge against the six exam domains, identifying gaps from SAA-C03, and getting oriented with Systems Manager, which is one of the most heavily tested and most commonly underestimated services on DOP-C02.
Topics
DOP-C02 exam guide and domain mapping
SAA-C03 knowledge gap check
AWS Systems Manager service overview
Professional-level question style
Well-Architected operational excellence pillar
Activities
Read the official DOP-C02 exam guide end to end and rate your confidence for every listed service.
W2
Week 2
SDLC Automation (22%)
This is the heaviest domain and the one most candidates underestimate. It covers CodePipeline, CodeBuild, and CodeDeploy at professional depth: cross-account pipelines, lifecycle hooks, deployment strategies, and rollback behavior. If you have only used these services at a surface level, this week is where you go deeper.
Build a complete pipeline: Source (CodeCommit or GitHub) to Build (CodeBuild) to Deploy (CodeDeploy) with a manual approval stage.
W3
Week 3
Configuration Management and IaC (17%)
Infrastructure as code and configuration management are the backbone of DevOps. This week covers CloudFormation at depth (StackSets, drift detection, change sets), AWS CDK for programmatic infrastructure, and Systems Manager for ongoing configuration management.
Systems Manager: Parameter Store, State Manager, Automation
AppConfig: feature flags, deployment strategies
Activities
Write a CloudFormation template for VPC plus EC2 plus security group. Create a change set and review before applying.
W4
Week 4
Resilient Cloud Solutions (15%)
This domain tests your ability to design and operate systems that survive failures. It covers Auto Scaling, load balancing, chaos engineering with Fault Injection Simulator, multi-region failover, and backup strategies. The exam expects you to map RTO and RPO requirements to specific AWS configurations.
Topics
Auto Scaling: policies, lifecycle hooks, warm pools
ELB integration: health checks, deregistration delay
Fault Injection Simulator: experiments and stop conditions
Multi-region resilience: Route 53, Global Accelerator
AWS Backup and RTO/RPO mapping
Activities
Create an Auto Scaling Group with target tracking scaling and a lifecycle hook. Verify behavior under load.
W5
Week 5
Monitoring, Logging, and Incident Response (29%)
Monitoring (15%) and Incident Response (14%) are studied together because they are the same discipline in practice. You monitor to detect issues, then respond using the same tooling. This week covers CloudWatch, X-Ray, CloudTrail, EventBridge, Systems Manager Incident Manager, and automated response pipelines.
Incident Manager, OpsCenter, and automated runbooks
Activities
Instrument a Lambda function with custom metrics and create a CloudWatch alarm.
W6
Week 6
Security and Compliance (17%)
Security on DOP-C02 is about automation, not just configuration. The exam tests whether you can enforce security at scale using Organizations, SCPs, Control Tower, and automated remediation. It also tests your ability to distinguish between overlapping security services (GuardDuty, Config, Inspector, Security Hub, Macie).
Create an SCP that restricts IAM users from creating access keys and test its effect.
W7
Week 7
Cross-Domain Scenarios and Weak Area Review
DOP-C02 questions frequently span multiple domains. A single question might describe a pipeline that deploys to an ASG, triggers a CloudWatch alarm, fires an EventBridge rule, and runs an SSM Automation runbook. This week practices those combined scenarios and fills in remaining gaps.
Topics
Multi-service pipeline scenarios
End-to-end automation chains
Case study reasoning under time pressure
Targeted weak domain practice
SAA-C03 foundations reinforcement (if needed)
Activities
Build one end-to-end pipeline: commit to CodeBuild to CodeDeploy to CloudWatch to EventBridge to rollback.
W8
Week 8
Exam Simulation and Booking
Your final push. This week is full exam simulation mode: filling in remaining gaps and building the confidence to walk into the testing center ready.
Topics
Full syllabus review across all six domains
Time management (180 minutes for 75 questions)
Multi-service chain reasoning
Distractor elimination for professional-level questions
Activities
Take at least 3 ExamOS Legend mode full quizzes (80% hard questions, 180-minute timer).
Simulate real exam conditions at least once: no phone, no breaks, 180 minutes, same time of day you plan to actually sit the exam.
Daily Study Routine
Suggested 2–3 Hour Day
Time
Activity
15 min
Look over yesterday's wrong answers. For each one, identify the principle you missed.
30 min
Read AWS documentation for this week's topic
30 min
Hands-on lab in your AWS account
15 min
AWS CLI practice for the week's services
30 min
Take an ExamOS quiz (Challenger or Legend mode, depending on the week)
Stay consistent by setting a target date for this certification.
Review the SAA-C03 domains you are least confident in (VPC, IAM, EC2, S3, RDS, Lambda, CloudFormation).
Explore AWS Systems Manager: Parameter Store, State Manager, Automation, Patch Manager, Session Manager.
Take the ExamOS Rookie mode quiz (30 questions). Note any domain below 60%.
Goal:An honest gap assessment. Know which domains need the most work and which Systems Manager capabilities you are unfamiliar with.
Rookie Mode
Rookie Mode
Write a buildspec.yml that runs unit tests and fails the build if tests fail.
Deploy an EC2 application using CodeDeploy with all lifecycle hooks (BeforeInstall through ValidateService). Intentionally fail ValidateService and observe the rollback.
Configure a Lambda canary deployment (Canary10Percent5Minutes).
Set up GitHub Actions OIDC integration for pipeline authentication (no static credentials).
Take the ExamOS Challenger quiz. Repeat until you pass 2 times in a row.
Goal:Configure pipelines, buildspecs, and deployment strategies at professional depth, including cross-account pipelines, lifecycle hooks, rollback triggers, and every deployment strategy.
Challenger Mode
Challenger Mode
Deploy a CloudFormation StackSet across two accounts or regions.
Build an SSM Parameter Store hierarchy for dev/staging/prod with SecureString parameters.
Configure Systems Manager Patch Manager with a maintenance window.
Take the ExamOS Challenger quiz. Repeat until you pass 2 times in a row.
Goal:Master CloudFormation StackSets for multi-account governance and Systems Manager for ongoing configuration management at scale.
Challenger Mode
Challenger Mode
Use Fault Injection Simulator to terminate a random EC2 instance and verify that the ASG replaces it.
Configure multi-region Route 53 failover routing with health checks.
Create an AWS Backup plan with cross-region copy for RDS.
Take the ExamOS Challenger quiz. Repeat until you pass 2 times in a row.
Goal:Map RTO and RPO requirements to specific AWS configurations and validate resilience through chaos engineering.
Challenger Mode
Challenger Mode
Create a CloudWatch Logs metric filter for ERROR entries and connect it to an SNS alarm.
Enable X-Ray tracing on a multi-service application and review the service map.
Create an EventBridge rule for GuardDuty high-severity findings that triggers a Lambda response function.
Configure OpsItem creation from a CloudWatch alarm and attach a runbook.
Take the ExamOS Challenger quiz. Repeat until you pass 2 times in a row.
Goal:Design end-to-end observability and automated incident response pipelines that detect, alert, and remediate without manual intervention.
Challenger Mode
Challenger Mode
Configure Secrets Manager automatic rotation for an RDS instance.
Set up AWS Config with a managed rule and an auto-remediation action.
Enable Security Hub and review aggregated findings from GuardDuty and Config.
Use IAM Access Analyzer to validate a cross-account policy.
Take the ExamOS Challenger quiz. Repeat until you pass 2 times in a row.
Goal:Distinguish between GuardDuty (threat detection), Config (compliance), Inspector (vulnerabilities), Security Hub (aggregation), and Macie (data sensitivity), and automate their response at scale.
Challenger Mode
Challenger Mode
Solve at least 5 cross-domain architecture scenarios (ExamOS case study mode).
Take 3 full-domain ExamOS Challenger quizzes. Review every incorrect answer.
Take targeted Challenger quizzes on your two weakest domains until 3 consecutive passes above 75%.
Repeat full-domain Challenger until 3 consecutive passes above 70%.
Goal:Consistent above 70% on full-domain Challenger with no domain below 60%.
Challenger Mode
Challenger Mode
For every Legend question you miss, review the explanation and write one sentence explaining the operational principle behind the correct answer.
Once you are consistently hitting 80% or above on Legend mode across two or more sessions, book your exam. You are ready.
Goal:Consistent above 80% on Legend mode across two or more sessions. Confidence to schedule the exam.
Legend Mode
Legend Mode
Overview
The AWS Certified DevOps Engineer Professional validates your ability to implement continuous delivery systems, automate security and governance, and operate resilient production infrastructure on AWS. It is a professional-level exam that tests operational judgment: how to design and operate systems that are automated, observable, secure, and recoverable.
This exam goes deeper than SAA-C03. Where SAA-C03 asks you to recommend an architecture, DOP-C02 asks you to operate one. The questions are grounded in real-world operational scenarios: debugging a failed pipeline, choosing a deployment strategy for zero-downtime releases, automating incident response, and enforcing compliance at scale. That is what DevOps engineers deal with daily, and that is what this plan prepares you for.
Domain
Weight
SDLC Automation
22%
Configuration Management and IaC
17%
Resilient Cloud Solutions
15%
Monitoring and Logging
15%
Incident and Event Response
14%
Security and Compliance
17%
SDLC Automation is the heaviest domain at 22%. It covers CodePipeline, CodeBuild, and CodeDeploy at a depth that goes well beyond what SAA-C03 tests. This plan gives it two weeks.
Recommended experience: 2+ years of hands-on experience provisioning, operating, and managing AWS environments. Familiarity with CI/CD pipelines, infrastructure as code, monitoring, and security best practices. SAA-C03 or DVA-C02 is strongly recommended.
A note on prerequisites: There are no formal prerequisites. However, DOP-C02 assumes you know VPC, IAM, EC2, S3, RDS, Lambda, and CloudFormation at operational depth. If you do not have SAA-C03 or equivalent experience, the VPC and IAM questions will be a significant gap.
Frequently Asked Questions
Do I need SAA-C03 before DOP-C02?
There are no formal prerequisites. However, DOP-C02 assumes you know VPC, IAM, EC2, S3, RDS, Lambda, and CloudFormation at operational depth. If you do not have SAA-C03 or equivalent experience, the VPC and IAM questions will be a significant gap. SAA-C03 or DVA-C02 is strongly recommended.
How many practice questions should I aim for?
Aim for at least 600 unique questions across all domains, ensuring you prioritize quality over quantity. ExamOS provides over 3,000 high quality practice questions covering all domains and designed to explain the rationale behind both correct and incorrect answers.
When should I book the exam?
Once you are consistently hitting 80% or above on Legend mode across two or more sessions, and you feel comfortable explaining DevOps patterns for realistic operational scenarios, you are ready. Trust your preparation.
How long is the exam?
180 minutes (3 hours) for 75 questions (65 scored, 15 unscored). That averages to roughly 2 minutes and 24 seconds per question. Scenario-heavy questions with multi-service chains may take longer, so keep an eye on the clock. Answer every question; the unscored ones are indistinguishable from scored ones.
What is the passing score?
750 out of 1000. AWS uses scaled scoring. The raw number of correct answers needed varies slightly between exam versions. Do not try to calculate how many questions you can afford to miss.
I am a non-native English speaker. Can I get extra time?
Yes, under certain conditions. AWS offers an additional 30 minutes for candidates whose primary language is not the language of the exam. If you are taking the exam in English but English is not your primary language, you can request this accommodation:
When scheduling your exam through Pearson VUE, select the option for additional time for non-native English speakers.
This is available for exams delivered in English, Japanese, Korean, Simplified Chinese, Traditional Chinese, Spanish, French, German, Italian, Portuguese, and Indonesian.
If the exam is available in your primary language, you can still take it in English with the extra time, as long as you meet the non-native speaker criteria.
Request this accommodation when scheduling. It is a straightforward process through the registration system.
Can I use reference materials during the exam?
No. The DOP-C02 exam is closed-book. You cannot access documentation, websites, or any external resources during the test. All questions are designed to be answerable from your knowledge of AWS services, architecture patterns, and operational best practices.
What is the most important domain to study?
SDLC Automation (22%) is the heaviest domain and the one that goes deepest beyond SAA-C03 knowledge. But Security and Compliance (17%) and Configuration Management (17%) are also significant. The biggest trap is over-studying the domains you deal with daily at work (often monitoring and resilience) and under-studying the ones you rarely touch (often security automation and cross-account governance).
How does DOP-C02 differ from SAA-C03?
SAA-C03 tests architecture design: which service to choose and why. DOP-C02 tests operational engineering: how to automate, deploy, monitor, and recover systems in production. The questions assume you know the services already and focus on how to operate them at scale: cross-account pipelines, automated remediation, deployment strategies, chaos engineering, and incident response.
What are the most common ways people fail?
Underestimating Systems Manager. It appears in questions across every domain: Parameter Store for secrets, Automation for remediation, State Manager for compliance, Patch Manager for updates. If you do not know SSM well, you will lose marks across multiple domains.
Confusing deployment strategies. AllAtOnce, HalfAtATime, OneAtATime, Canary, and Linear each have different risk profiles and rollback behaviors. The exam tests whether you can match a business requirement (zero downtime, gradual rollout) to the right strategy.
Not understanding SCPs. SCPs set the maximum permissions for an account. They do not grant permissions. If an SCP denies an action, no IAM policy in the account can override it. This is tested frequently.
Confusing GuardDuty, Config, Inspector, and Macie. GuardDuty detects threats. Config checks compliance. Inspector finds vulnerabilities. Macie discovers sensitive data. Security Hub aggregates findings from all of them. Know which one to use for each scenario.
Ignoring cross-account patterns. DOP-C02 tests cross-account pipelines, cross-account log aggregation, cross-account backup, and cross-account IAM roles at a depth that SAA-C03 does not.
Not tracing multi-service chains. A single question might describe a commit triggering a pipeline that deploys to an ASG, which triggers a CloudWatch alarm, which fires an EventBridge rule. If you lose the chain, you lose the question.
What are the three biggest preparation mistakes?
Studying services without studying operational patterns. DOP-C02 tests how services work together in production, not in isolation. If you know CodeDeploy but cannot explain how it integrates with CodePipeline, CloudWatch alarms, and EventBridge for automated rollback, you will struggle.
Not building in a real AWS account. This is a hands-on exam. Reading documentation about StackSets is different from actually deploying one across two accounts. The experience sticks in a way that reading never does.
Treating DOP-C02 like a harder SAA-C03. The question style is different. SAA-C03 asks "which service should you use?" DOP-C02 asks "how should you operate this system?" If you are answering DOP-C02 questions by picking services instead of describing operational approaches, you are answering the wrong question.
Is there a renewal option?
Yes. DOP-C02 is valid for 3 years. To renew, you retake the current version of the exam or earn a higher-level certification. AWS also offers recertification pathways through their certification portal. Check the AWS Certification portal for the most current renewal options.
What if I fail?
AWS allows retakes after 14 days. Use the score report to focus on weak domains, then return to targeted Challenger practice on those domains before rescheduling.