1
AWS Certified DevOps
Engineer – Professional
(DOP-C02) Practice Exam
v2.0 150 Advanced
Multiple-Choice Questions
with Answers and
Rationales a well
detailed one 2025 /
, 2
2026 written and graded
A+ upgraded
Domain 1: SDLC Automation (22%) — Questions 1–33
Question 1
A company operates a multi-account AWS environment with a centralized DevOps account that
hosts CodePipeline. The pipeline needs to deploy application artifacts to staging and production
accounts. The artifacts are encrypted using a customer-managed KMS key in the DevOps
account. During execution, the deployment stage in the target account fails with an access
denied error on the S3 artifact bucket. What is the MOST likely cause and solution?
A. The S3 bucket policy does not grant read access to the target account's CodeDeploy service
role — add a bucket policy granting s3:GetObject to the role
B. The KMS key policy does not allow the target account to decrypt — add the target account's
CodeDeploy role to the KMS key policy with kms:Decrypt permission
C. The CodePipeline service role lacks s3:GetObject permission on the artifact bucket — update
the role policy
D. The target account lacks an IAM role with the correct trust relationship — create a cross-
account role in the target account
- detailed answer 100% correct :- B
Rationale: For cross-account CodePipeline deployments with encrypted artifacts, the target
account must have kms:Decrypt permission on the customer-managed KMS key. The
default aws/s3 key cannot be shared cross-account. S3 bucket policy (A) addresses S3 access but
, 3
not decryption. CodePipeline role (C) is in the source account. Cross-account role (D) is needed
but the KMS permission is the critical missing piece.
Question 2
A DevOps engineer is designing a blue/green deployment for an ECS Fargate service using
CodeDeploy. The application uses a shared RDS database that must support both blue and
green task sets during the deployment. The team needs to perform a database schema
migration as part of the deployment. What is the recommended approach?
A. Run the schema migration as a CodeDeploy lifecycle hook during the deployment
B. Run the schema migration before starting the blue/green deployment so both task sets can
work with the updated schema
C. Run the schema migration after the green task set is fully deployed and traffic is shifted
D. Use separate databases for blue and green environments and migrate data between them
- detailed answer 100% correct :- B
Rationale: Database schema changes should be decoupled from application code changes and
executed before the blue/green deployment begins. This ensures both blue and green task sets
can work with the updated schema. Running during deployment (A) risks incompatibility.
Running after (C) would leave the green environment with an incompatible schema. Separate
databases (D) add significant complexity and data consistency challenges.
Question 3
A company uses AWS CodeBuild to build a large monorepo with multiple microservices. The
build takes 25 minutes, and the team wants to reduce it to under 10 minutes. The buildspec.yml
currently builds all services sequentially. Which approach would be MOST effective?
A. Use CodeBuild batch builds to run each microservice build in parallel
B. Increase the CodeBuild compute type to a larger instance
C. Enable CodeBuild caching for all build dependencies
D. Split the monorepo into separate repositories
- detailed answer 100% correct :- A
Rationale: CodeBuild batch builds enable parallel execution of multiple build phases, which is
the most effective way to reduce build time for a monorepo. Larger compute (B) helps but
doesn't address the sequential bottleneck. Caching (C) reduces dependency installation time
, 4
but doesn't address the parallelization need. Splitting repositories (D) is a major architectural
change.
Question 4
A DevOps engineer is implementing a CI/CD pipeline using CodePipeline with a GitHub source
action. The pipeline must deploy to multiple environments (dev, staging, production) with
different configuration values per environment. What is the MOST maintainable approach for
managing environment-specific configurations?
A. Use separate branches in GitHub for each environment with environment-specific
configuration files
B. Use AWS Systems Manager Parameter Store with environment-specific paths and reference
them in the pipeline
C. Store all configurations in a single JSON file and use a Lambda function to select the
appropriate environment
D. Use environment variables in CodePipeline with different values for each stage
- detailed answer 100% correct :- B
Rationale: AWS Systems Manager Parameter Store provides centralized, secure, and versioned
configuration management with environment-specific paths. Separate branches (A) create
maintenance overhead. Single file with Lambda (C) adds complexity. Environment variables (D)
are limited and less secure for sensitive values.
Question 5
A company uses CodeDeploy for EC2 deployments with an in-place deployment strategy. The
deployment frequently fails because the application fails to start on instances during the
ApplicationStart lifecycle event. The team wants to automatically roll back to the previous
revision when this occurs. What should they configure?
A. Enable automatic rollback in the deployment group configuration for deployment failures
B. Configure a CloudWatch alarm on instance health status to trigger rollback
C. Use a canary deployment strategy instead of in-place
D. Implement a custom script in the AfterInstall hook that validates the application and triggers
rollback
- detailed answer 100% correct :- A
AWS Certified DevOps
Engineer – Professional
(DOP-C02) Practice Exam
v2.0 150 Advanced
Multiple-Choice Questions
with Answers and
Rationales a well
detailed one 2025 /
, 2
2026 written and graded
A+ upgraded
Domain 1: SDLC Automation (22%) — Questions 1–33
Question 1
A company operates a multi-account AWS environment with a centralized DevOps account that
hosts CodePipeline. The pipeline needs to deploy application artifacts to staging and production
accounts. The artifacts are encrypted using a customer-managed KMS key in the DevOps
account. During execution, the deployment stage in the target account fails with an access
denied error on the S3 artifact bucket. What is the MOST likely cause and solution?
A. The S3 bucket policy does not grant read access to the target account's CodeDeploy service
role — add a bucket policy granting s3:GetObject to the role
B. The KMS key policy does not allow the target account to decrypt — add the target account's
CodeDeploy role to the KMS key policy with kms:Decrypt permission
C. The CodePipeline service role lacks s3:GetObject permission on the artifact bucket — update
the role policy
D. The target account lacks an IAM role with the correct trust relationship — create a cross-
account role in the target account
- detailed answer 100% correct :- B
Rationale: For cross-account CodePipeline deployments with encrypted artifacts, the target
account must have kms:Decrypt permission on the customer-managed KMS key. The
default aws/s3 key cannot be shared cross-account. S3 bucket policy (A) addresses S3 access but
, 3
not decryption. CodePipeline role (C) is in the source account. Cross-account role (D) is needed
but the KMS permission is the critical missing piece.
Question 2
A DevOps engineer is designing a blue/green deployment for an ECS Fargate service using
CodeDeploy. The application uses a shared RDS database that must support both blue and
green task sets during the deployment. The team needs to perform a database schema
migration as part of the deployment. What is the recommended approach?
A. Run the schema migration as a CodeDeploy lifecycle hook during the deployment
B. Run the schema migration before starting the blue/green deployment so both task sets can
work with the updated schema
C. Run the schema migration after the green task set is fully deployed and traffic is shifted
D. Use separate databases for blue and green environments and migrate data between them
- detailed answer 100% correct :- B
Rationale: Database schema changes should be decoupled from application code changes and
executed before the blue/green deployment begins. This ensures both blue and green task sets
can work with the updated schema. Running during deployment (A) risks incompatibility.
Running after (C) would leave the green environment with an incompatible schema. Separate
databases (D) add significant complexity and data consistency challenges.
Question 3
A company uses AWS CodeBuild to build a large monorepo with multiple microservices. The
build takes 25 minutes, and the team wants to reduce it to under 10 minutes. The buildspec.yml
currently builds all services sequentially. Which approach would be MOST effective?
A. Use CodeBuild batch builds to run each microservice build in parallel
B. Increase the CodeBuild compute type to a larger instance
C. Enable CodeBuild caching for all build dependencies
D. Split the monorepo into separate repositories
- detailed answer 100% correct :- A
Rationale: CodeBuild batch builds enable parallel execution of multiple build phases, which is
the most effective way to reduce build time for a monorepo. Larger compute (B) helps but
doesn't address the sequential bottleneck. Caching (C) reduces dependency installation time
, 4
but doesn't address the parallelization need. Splitting repositories (D) is a major architectural
change.
Question 4
A DevOps engineer is implementing a CI/CD pipeline using CodePipeline with a GitHub source
action. The pipeline must deploy to multiple environments (dev, staging, production) with
different configuration values per environment. What is the MOST maintainable approach for
managing environment-specific configurations?
A. Use separate branches in GitHub for each environment with environment-specific
configuration files
B. Use AWS Systems Manager Parameter Store with environment-specific paths and reference
them in the pipeline
C. Store all configurations in a single JSON file and use a Lambda function to select the
appropriate environment
D. Use environment variables in CodePipeline with different values for each stage
- detailed answer 100% correct :- B
Rationale: AWS Systems Manager Parameter Store provides centralized, secure, and versioned
configuration management with environment-specific paths. Separate branches (A) create
maintenance overhead. Single file with Lambda (C) adds complexity. Environment variables (D)
are limited and less secure for sensitive values.
Question 5
A company uses CodeDeploy for EC2 deployments with an in-place deployment strategy. The
deployment frequently fails because the application fails to start on instances during the
ApplicationStart lifecycle event. The team wants to automatically roll back to the previous
revision when this occurs. What should they configure?
A. Enable automatic rollback in the deployment group configuration for deployment failures
B. Configure a CloudWatch alarm on instance health status to trigger rollback
C. Use a canary deployment strategy instead of in-place
D. Implement a custom script in the AfterInstall hook that validates the application and triggers
rollback
- detailed answer 100% correct :- A
