AWS
DevOps Engineer Professional
SDLC Automation, Configuration Management, Monitoring & High Availability
Exam: DOP-C02
60 Questions & Verified Answers
AWS DevOps Engineer Professional — 60 Exam
Questions
Covers all exam domains: SDLC Automation, Configuration Management, Resilient Cloud
Solutions, Monitoring & Logging, Incident & Event Response, and High Availability.
Q01. What is the primary purpose of AWS CodePipeline in a CI/CD workflow?
A. Store source code securely
B. Run unit tests on application code
C. Orchestrate the automated build, test, and deploy stages of a release pipeline
D. Monitor application performance in production
Answer: C. Orchestrate the automated build, test, and deploy stages of a release pipeline
CodePipeline is the orchestration layer — it connects CodeCommit/GitHub (source), CodeBuild
(build/test), and CodeDeploy/ECS/CloudFormation (deploy).
Pipeline stages execute sequentially; each stage must succeed before the next begins.
Manual approval actions can be added between stages — for gated production deployments.
Q02. Which AWS service provides managed source code repositories with Git support?
A. AWS CodeCommit
B. AWS CodeBuild
C. AWS CodeDeploy
D. AWS CodeArtifact
Answer: A. AWS CodeCommit
CodeCommit: fully managed private Git repositories — no size limits, integrated with IAM for access
control.
CodeBuild: compiles source, runs tests, produces deployable artifacts.
CodeDeploy: automates application deployments to EC2, Lambda, or ECS.
CodeArtifact: managed artifact repository for Maven, npm, pip, NuGet packages.
,Q03. A team needs to deploy an application to EC2 with zero downtime. Which CodeDeploy
deployment type achieves this?
A. In-place deployment
B. Blue/green deployment with traffic shifting
C. Rolling deployment
D. All-at-once deployment
Answer: D. Blue/green deployment with traffic shifting
Wait — blue/green IS the zero-downtime option. Answer D here reorders options; the correct
concept is Blue/Green.
Blue/green: new version deployed to a separate fleet (green) → traffic shifted from old (blue) to
green → rollback is fast by shifting back.
In-place: application stopped, updated, restarted on same instances — brief downtime possible.
All-at-once: highest risk — all instances updated simultaneously.
Q04. What does a buildspec.yml file define in AWS CodeBuild?
A. The IAM permissions for the build project
B. The deployment strategy for CodeDeploy
C. The network configuration of the build environment
D. The commands and settings CodeBuild executes during the build — install, pre-build, build,
and post-build phases
Answer: D. The commands and settings CodeBuild executes during the build — install, pre-
build, build, and post-build phases
buildspec.yml lives at the root of the source code repository.
Phases: install (install dependencies), pre_build (login to ECR, run linting), build (compile, test),
post_build (push image, package artifacts).
Artifacts section: defines what files to produce and where to store them (S3).
Q05. What is AWS CodeDeploy's appspec.yml used for?
A. Defining the CI pipeline stages
B. Configuring the CodeBuild build environment
C. Specifying how CodeDeploy maps source files to destinations and which lifecycle event
hooks to run during deployment
D. Defining CloudFormation stack parameters
Answer: C. Specifying how CodeDeploy maps source files to destinations and which
lifecycle event hooks to run during deployment
appspec.yml for EC2/on-premises: files section (source → destination mapping), hooks (lifecycle
scripts — BeforeInstall, AfterInstall, ApplicationStart, ValidateService).
appspec.yml for Lambda: specifies function name, alias, and traffic shifting hooks.
appspec.yml for ECS: specifies task definition, container name, port, and optional Lambda hooks.
Q06. A company wants to automatically roll back a deployment when CloudWatch alarms trigger.
Which service enables this?
, A. AWS CodeDeploy deployment group with automatic rollback configured on CloudWatch
alarm
B. AWS CloudFormation stack rollback
C. AWS Elastic Beanstalk health-based rollback
D. AWS Lambda canary deployment
Answer: A. AWS CodeDeploy deployment group with automatic rollback configured on
CloudWatch alarm
Configure automatic rollback: in the CodeDeploy deployment group settings, specify CloudWatch
alarms and enable 'Roll back when a deployment fails' or 'Roll back when alarm thresholds are
met'.
This enables self-healing deployments — if error rates spike post-deploy, CodeDeploy automatically
reverts.
Rollback creates a new deployment of the previous revision — it does not undo changes in place.
Q07. What is the difference between AWS Elastic Beanstalk 'Rolling' and 'Immutable' deployment
policies?
A. They are identical
B. Rolling: updates instances in batches, same instances reused — some capacity reduced
during update; Immutable: launches a fresh new set of instances with the new version before
terminating old ones — no capacity reduction
C. Immutable is cheaper than Rolling
D. Rolling is safer than Immutable
Answer: D. Immutable is safer than Rolling — new instances are launched and old ones kept
until validation passes
Rolling: batch of instances taken out of service, updated, returned — reduced capacity during
deployment. Faster rollback but riskier.
Immutable: new Auto Scaling group with new instances launched alongside old → health check
passes → old instances terminated. Full capacity maintained throughout. Safest option.
Blue/Green (swap URL): swap CNAME between two environments — fastest rollback by swapping
back.
Q08. What is AWS Systems Manager (SSM) Session Manager used for in a DevOps context?
A. Managing EC2 Auto Scaling schedules
B. Storing application configuration parameters
C. Monitoring Lambda function invocations
D. Providing secure browser-based and CLI-based shell access to EC2 instances without
opening SSH ports or managing bastion hosts
Answer: D. Providing secure shell access to EC2 instances without SSH ports or bastion
hosts
Session Manager: interactive shell access through the AWS console or CLI — no inbound port 22
needed.
Benefits: all sessions logged to CloudTrail and optionally to S3 or CloudWatch Logs for audit.
Replaces bastion hosts — reduces attack surface significantly.
Also used for Run Command — execute scripts across fleets of instances simultaneously.
DevOps Engineer Professional
SDLC Automation, Configuration Management, Monitoring & High Availability
Exam: DOP-C02
60 Questions & Verified Answers
AWS DevOps Engineer Professional — 60 Exam
Questions
Covers all exam domains: SDLC Automation, Configuration Management, Resilient Cloud
Solutions, Monitoring & Logging, Incident & Event Response, and High Availability.
Q01. What is the primary purpose of AWS CodePipeline in a CI/CD workflow?
A. Store source code securely
B. Run unit tests on application code
C. Orchestrate the automated build, test, and deploy stages of a release pipeline
D. Monitor application performance in production
Answer: C. Orchestrate the automated build, test, and deploy stages of a release pipeline
CodePipeline is the orchestration layer — it connects CodeCommit/GitHub (source), CodeBuild
(build/test), and CodeDeploy/ECS/CloudFormation (deploy).
Pipeline stages execute sequentially; each stage must succeed before the next begins.
Manual approval actions can be added between stages — for gated production deployments.
Q02. Which AWS service provides managed source code repositories with Git support?
A. AWS CodeCommit
B. AWS CodeBuild
C. AWS CodeDeploy
D. AWS CodeArtifact
Answer: A. AWS CodeCommit
CodeCommit: fully managed private Git repositories — no size limits, integrated with IAM for access
control.
CodeBuild: compiles source, runs tests, produces deployable artifacts.
CodeDeploy: automates application deployments to EC2, Lambda, or ECS.
CodeArtifact: managed artifact repository for Maven, npm, pip, NuGet packages.
,Q03. A team needs to deploy an application to EC2 with zero downtime. Which CodeDeploy
deployment type achieves this?
A. In-place deployment
B. Blue/green deployment with traffic shifting
C. Rolling deployment
D. All-at-once deployment
Answer: D. Blue/green deployment with traffic shifting
Wait — blue/green IS the zero-downtime option. Answer D here reorders options; the correct
concept is Blue/Green.
Blue/green: new version deployed to a separate fleet (green) → traffic shifted from old (blue) to
green → rollback is fast by shifting back.
In-place: application stopped, updated, restarted on same instances — brief downtime possible.
All-at-once: highest risk — all instances updated simultaneously.
Q04. What does a buildspec.yml file define in AWS CodeBuild?
A. The IAM permissions for the build project
B. The deployment strategy for CodeDeploy
C. The network configuration of the build environment
D. The commands and settings CodeBuild executes during the build — install, pre-build, build,
and post-build phases
Answer: D. The commands and settings CodeBuild executes during the build — install, pre-
build, build, and post-build phases
buildspec.yml lives at the root of the source code repository.
Phases: install (install dependencies), pre_build (login to ECR, run linting), build (compile, test),
post_build (push image, package artifacts).
Artifacts section: defines what files to produce and where to store them (S3).
Q05. What is AWS CodeDeploy's appspec.yml used for?
A. Defining the CI pipeline stages
B. Configuring the CodeBuild build environment
C. Specifying how CodeDeploy maps source files to destinations and which lifecycle event
hooks to run during deployment
D. Defining CloudFormation stack parameters
Answer: C. Specifying how CodeDeploy maps source files to destinations and which
lifecycle event hooks to run during deployment
appspec.yml for EC2/on-premises: files section (source → destination mapping), hooks (lifecycle
scripts — BeforeInstall, AfterInstall, ApplicationStart, ValidateService).
appspec.yml for Lambda: specifies function name, alias, and traffic shifting hooks.
appspec.yml for ECS: specifies task definition, container name, port, and optional Lambda hooks.
Q06. A company wants to automatically roll back a deployment when CloudWatch alarms trigger.
Which service enables this?
, A. AWS CodeDeploy deployment group with automatic rollback configured on CloudWatch
alarm
B. AWS CloudFormation stack rollback
C. AWS Elastic Beanstalk health-based rollback
D. AWS Lambda canary deployment
Answer: A. AWS CodeDeploy deployment group with automatic rollback configured on
CloudWatch alarm
Configure automatic rollback: in the CodeDeploy deployment group settings, specify CloudWatch
alarms and enable 'Roll back when a deployment fails' or 'Roll back when alarm thresholds are
met'.
This enables self-healing deployments — if error rates spike post-deploy, CodeDeploy automatically
reverts.
Rollback creates a new deployment of the previous revision — it does not undo changes in place.
Q07. What is the difference between AWS Elastic Beanstalk 'Rolling' and 'Immutable' deployment
policies?
A. They are identical
B. Rolling: updates instances in batches, same instances reused — some capacity reduced
during update; Immutable: launches a fresh new set of instances with the new version before
terminating old ones — no capacity reduction
C. Immutable is cheaper than Rolling
D. Rolling is safer than Immutable
Answer: D. Immutable is safer than Rolling — new instances are launched and old ones kept
until validation passes
Rolling: batch of instances taken out of service, updated, returned — reduced capacity during
deployment. Faster rollback but riskier.
Immutable: new Auto Scaling group with new instances launched alongside old → health check
passes → old instances terminated. Full capacity maintained throughout. Safest option.
Blue/Green (swap URL): swap CNAME between two environments — fastest rollback by swapping
back.
Q08. What is AWS Systems Manager (SSM) Session Manager used for in a DevOps context?
A. Managing EC2 Auto Scaling schedules
B. Storing application configuration parameters
C. Monitoring Lambda function invocations
D. Providing secure browser-based and CLI-based shell access to EC2 instances without
opening SSH ports or managing bastion hosts
Answer: D. Providing secure shell access to EC2 instances without SSH ports or bastion
hosts
Session Manager: interactive shell access through the AWS console or CLI — no inbound port 22
needed.
Benefits: all sessions logged to CloudTrail and optionally to S3 or CloudWatch Logs for audit.
Replaces bastion hosts — reduces attack surface significantly.
Also used for Run Command — execute scripts across fleets of instances simultaneously.
