AWS-CERTIFIED-DEVOPS-ENGINEER-PROFESSIONAL-DOP-C02Updated 8d ago · Aug 28, 2026

AWS Certified DevOps Engineer - Professional DOP-C02

460 questions across 1 topics, with suggested answers, explanations where available, and imported community discussion. The first 46 questions are free to preview.

Browse questions Practice mode

Topics

#	Topic	Questions	Free
1	Security and Compliance	29	29

Preview

29 of 29 accessible

Question 1 · Security and Compliance Open

A company mandates that all employees access secrets and parameters by using AWS Systems Manager Parameter Store. Every secret must rotate automatically every 60 days. A DevOps engineer needs to add a new secret that allows an application to access an Amazon ElastiCache (Redis OSS) cluster. Which solution satisfies these requirements with the **LEAST** operational overhead?

Answer: D AWS Systems Manager Parameter Store does not automatically rotate stored secrets, but it can retrieve AWS Secrets Manager secrets through the reserved `/aws/reference/secretsmanager/` path. AWS Secrets Manager supports Amazon ElastiCache credential rotation by invoking a Lambda rotation function, and provides the `SecretsManagerElasticacheUserRotation` template to reduce implementation effort. A 60-day Secrets Manager rotation schedule therefore fulfills the automatic-rotation requirement while preserving Parameter Store access. **Learn more:** [Use AWS Secrets Manager secrets in Parameter Store](https://docs.aws.amazon.com/secretsmanager/latest/userguide/integrating_parameterstore.html) · [AWS Secrets Manager rotation function templates](https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_available-rotation-templates.html)

Question 2 · SDLC Automation Open

A development team manually creates a local artifact. The team transfers the artifact to an Amazon S3 bucket to support an application. The application uses a local cache that must be cleared when the team deploys the application to Amazon EC2 instances. For every deployment, the team runs a command to clear the cache, download the artifact from the S3 bucket, and unzip the artifact to finish the deployment. The development team wants to migrate the deployment process to CI/CD and track the progress of every deployment. Which combination of actions meets these requirements with the **MOST** operational efficiency? (Choose three.)

Answer: B, D, E AWS CodePipeline provides a source-to-deployment workflow and exposes execution, stage, and action status so deployment progress can be tracked. AWS CodeBuild can create the deployable artifact, and AWS CodeDeploy deploys that artifact to Amazon EC2 instances. In an EC2/On-Premises CodeDeploy deployment, an AppSpec `BeforeInstall` lifecycle hook can run a script before the new revision is installed, making it suitable for clearing the local cache. **Learn more:** [View executions in CodePipeline](https://docs.aws.amazon.com/codepipeline/latest/userguide/executions-view.html) · [AWS CodeDeploy deploy action reference](https://docs.aws.amazon.com/codepipeline/latest/userguide/action-reference-CodeDeploy.html)

Question 3 · Monitoring and Logging Open

A DevOps engineer is designing a solution to centrally ingest and process a large volume of Amazon CloudWatch logs produced by multiple applications. The solution must gather all CloudWatch logs from multiple AWS accounts, process the logs in real time, and store the processed logs in an Amazon S3 bucket. Which solution meets these requirements with the **LEAST** implementation effort?

Answer: D An account-level CloudWatch Logs subscription filter automatically applies to the log groups in an account, eliminating the need to configure a subscription filter on every log group. CloudWatch Logs can deliver the real-time subscription stream to Amazon Data Firehose, and Firehose can deliver the processed data to Amazon S3. A centralized multi-account implementation uses a shared CloudWatch Logs destination for the Firehose delivery stream and account-level subscription policies in the sending accounts. **Learn more:** [Account-level subscription filters - Amazon CloudWatch Logs](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/SubscriptionFilters-AccountLevel.html) · [Cross-account cross-Region account-level subscriptions using Firehose - Amazon CloudWatch Logs](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CrossAccountSubscriptions-Firehose-Account.html)