Examworthyexamworthy.comAWS Certified DevOps Engineer - Professional cheat sheet
Amazon Web Services
Free to share. Examworthy is not affiliated with or endorsed by Amazon Web Services; DOP-C02 and related marks belong to their respective owners.
At a glance
Format: Multiple choice and multiple response
Domain weight map
Heaviest first - spend your time hereHow this exam thinks
DOP-C02 is an automate-it-correctly professional exam: almost every question is a layered scenario with a delivery, resilience, observability, incident or governance constraint, and the right answer is the AWS-native approach that meets it with the most automation, the smallest blast radius and the least operational overhead.
Spot the trap
Tempting wrong answers, and why they failCommon misconception
That a wiki and PR review keep pipeline definitions consistent. Manual copying still drifts; only a shared template enforces it.
SDLC Automation
Common misconception
That DeletionPolicy: Retain protects a resource from being modified during a stack update. It only governs deletion, not in-place changes.
Configuration Management and Infrastructure as Code
Common misconception
That a permission boundary is a guardrail an account administrator cannot undo. It is set inside the account, so a local admin can edit or detach it at will.
Security and Compliance
Common misconception
That latency-based Route 53 routing fails over automatically when a Region goes down. It optimises for speed, not health, so it can keep sending traffic there.
Resilient Cloud Solutions
Common misconception
That calling PutMetricData synchronously in the handler is the correct way to emit metrics. It adds a network call on the request path and can throttle at scale.
Monitoring and Logging
Common misconception
That enough retries and concurrency guarantee delivery. EventBridge discards an event once its retries run out, so a sustained burst still loses events with no durable buffer.
Incident and Event Response
Common misconception
That a long lived personal access token is fine for CI access. It breaks on staff turnover and CodeConnections avoids storing one at all.
SDLC Automation
Common misconception
That a custom cross-account pipeline is the standard way to roll out an org-wide baseline. It still needs manual maintenance for every new account.
Configuration Management and Infrastructure as Code
Key terms
Exam-day rules
- Read the long scenario for its real constraint first. The zero-downtime, recovery-objective, blast-radius, auditability or automation limit named in the question is what picks the answer, so find it before you judge the options.
- When two services both work, default to the managed, automated, AWS-native, least-overhead one. Reach for a custom Lambda, a polling job or a self-hosted component only when the scenario names a reason the managed path cannot meet.
- For remediation or response that needs no human, choose the event-driven serverless chain. An EventBridge rule, a CloudWatch Logs subscription filter or an alarm invoking a Systems Manager runbook or Lambda beats an SNS email or a scheduled scan whenever the requirement is to act automatically.
- Match the deployment strategy to the stated downtime and rollback need. Blue/green for zero downtime and instant rollback, canary for a held slice then a single shift, linear for equal timed increments, and let a failing build action gate the pipeline natively.
- Treat broad permissions and stored long-lived keys as wrong answers. A wildcard policy, a public bucket, or an embedded access key is the trap; a scoped IAM role, OIDC with STS, and an SCP preventive ceiling almost always win the security questions.
Revision schedule
- Day 1Map the blueprint and book a date
- Week 1Build the delivery and IaC decision maps
- Weeks 1 to 3Go deep on SDLC Automation and IaC (Domains 1 and 2)
- Weeks 3 to 4Lock resilience and observability (Domains 3 and 4)
- Week 4Cover incident response and security (Domains 5 and 6)