AWS DOP-C02 Practice Test

DOP-C02 practice test: what's covered

• DevOps Engineer Professional

Free DOP-C02 sample questions

1. A platform team runs CodePipeline in a central tooling account and must deploy CloudFormation stacks into separate dev, staging, and prod member accounts. What is the recommended way to grant the pipeline permission to act in those accounts?

   • A. Create cross-account IAM roles in each target account that the pipeline's CodePipeline and CloudFormation service roles assume during the deploy stage
   • B. Copy the production access keys into a CodeBuild environment variable so the pipeline can call CloudFormation directly in each account
   • C. Make every developer an administrator in the tooling account so the pipeline inherits their broad permissions automatically
   • D. Disable IAM entirely in the member accounts and rely on the default VPC security groups for isolation between environments
   Show answer

   Correct: A. Cross-account deployment uses roles in each target account with a trust policy allowing the tooling account; the pipeline assumes them via the deploy action's RoleArn, keeping least privilege. Static keys are incorrect because long-lived credentials should never be embedded. Making developers admins is wrong as it grants no scoped pipeline identity and breaks least privilege. Disabling IAM is not a security control and provides no deployment authorization.

2. An ECS service behind an Application Load Balancer must be released with the ability to validate the new version on a test listener before sending production traffic, and roll back instantly if errors spike. Which deployment approach meets this?

   • A. Use a rolling update on the ECS service so tasks are replaced gradually without any separate test listener or instant rollback
   • B. Use CodeDeploy blue/green for ECS, which provisions a replacement task set and shifts ALB traffic between target groups with CloudWatch-alarm rollback
   • C. Delete the existing service and recreate it from the new task definition during a maintenance window each release
   • D. Increase the desired task count and manually drain old tasks by terminating them one by one from the console
   Show answer

   Correct: B. CodeDeploy blue/green for ECS creates a green task set, exposes it on a test listener for validation, then shifts production traffic via ALB target groups and auto-rolls back when a CloudWatch alarm fires. A rolling update is incorrect because it has no test listener and no automatic rollback. Delete-and-recreate causes downtime and is not a controlled release. Manual draining is error-prone and not an automated strategy.

3. A team deploys a Lambda function and wants to send only 10% of invocations to the new version for 5 minutes before completing the shift, automatically reverting if errors occur. How should they configure CodeDeploy?

   • A. Publish the new version and immediately repoint the alias at 100% so all traffic moves at once with no monitoring window
   • B. Use the AllAtOnce deployment configuration so the canary percentage is ignored and the full cutover happens instantly
   • C. Use CodeDeploy alias traffic shifting with the Canary10Percent5Minutes configuration and a CloudWatch alarm that triggers automatic rollback
   • D. Schedule a nightly cron job that gradually edits the function code in place until the new logic is fully live
   Show answer

   Correct: C. Lambda canary deployments use a CodeDeploy alias pointing at two versions with weighted routing; Canary10Percent5Minutes sends 10% for 5 minutes, then the rest, rolling back if the alarm trips. Immediate 100% repoint is incorrect because it skips the safety window. AllAtOnce is wrong as it does no gradual shift. A cron job editing code in place is not a deployment strategy and bypasses CodeDeploy entirely.

4. A pipeline must keep database passwords and third-party API tokens out of source control and out of plaintext build logs. Which practices correctly secure these secrets in a CodePipeline/CodeBuild workflow? (Choose TWO.)

   • A. Store secrets in AWS Secrets Manager and reference them in CodeBuild using the secrets-manager environment variable type so values are injected at runtime
   • B. Commit the production credentials into a config file in the repository and add a comment asking teammates not to read them
   • C. Resolve secrets in CloudFormation templates with the {{resolve:secretsmanager:...}} dynamic reference instead of hardcoding values
   • D. Print every environment variable with an echo command at the start of the build to confirm the secret was loaded correctly
   • E. Email the database password to the whole engineering team so the value is easy to retrieve during incidents
   Show answer

   Correct: A and C. Secrets Manager integration in CodeBuild injects values at runtime without exposing them, and CloudFormation dynamic references keep secrets out of templates. Committing credentials is incorrect because anything in Git history is effectively leaked. Echoing all environment variables is wrong as it writes secrets to build logs. Emailing passwords is not a control and broadly exposes the value, so it is incorrect.

5. A delivery team wants the same container image artifact that passed integration tests in dev to be the exact image that reaches production, with old untagged images cleaned up automatically. What ECR-based approach achieves this?

   • A. Rebuild the image separately in each environment so dev, staging, and prod each compile their own copy of the application code
   • B. Push images to Amazon ECR with scan-on-push enabled, promote a single immutable digest across environments by tag, and use a lifecycle policy to expire stale images
   • C. Store images only on the developer laptop and copy them by hand into each environment as releases happen
   • D. Tag every build with the literal word latest and overwrite it repeatedly so only one image ever exists in the registry
   Show answer

   Correct: B. Promoting one immutable digest guarantees the tested artifact is what ships, scan-on-push surfaces CVEs early, and lifecycle policies prune old images automatically. Rebuilding per environment is incorrect because each build can differ, breaking the test-then-promote guarantee. Manual laptop copies are not reproducible or auditable. Reusing only the latest tag destroys version history and traceability, so it is wrong.

Last updated: 2026-10-19

DOP-C02 practice test FAQ

Related practice tests

• AWS DVA-C02 practice test
• AWS SAP-C02 practice test
• Azure AZ-400 practice test
• AWS SAA-C03 practice test
• Terraform Associate practice test
• AWS SOA-C02 practice test