10 beginner questions across all six DOP-C02 domains: SDLC Automation (CodeDeploy canary, buildspec), Configuration Management and IaC (StackSets, change sets), Resilient Cloud Solutions (Auto Scaling health checks, RDS Multi-AZ), Monitoring and Logging (metric filters), Incident and Event Response (EventBridge) and Security and Compliance (secrets, AWS Config remediation).

Ready to test yourself? Take the graded Beginner test (free; sign in with Google, one click) to get your score.

  1. A team deploys a new AWS Lambda version with AWS CodeDeploy. They want 10% of traffic to move to the new version first, and the remaining 90% five minutes later if no alarms fire. Which deployment configuration type is this?

    • A. Linear
    • B. Canary ✔ correct
    • C. All-at-once
    • D. In-place

    Answer: B. A canary configuration shifts traffic in two increments, for example LambdaCanary10Percent5Minutes. Linear shifts equal increments at regular intervals; all-at-once moves all traffic immediately.

    Source: docs.aws.amazon.com/codedeploy/latest/userguide/deployment-configurations.html · Domain: SDLC Automation

  2. Which file tells AWS CodeBuild which commands to run in the install, build and post-build phases, and which artifacts to produce?

    • A. appspec.yml
    • B. template.yaml
    • C. Dockerfile
    • D. buildspec.yml ✔ correct

    Answer: D. A buildspec is a YAML collection of build commands and settings that CodeBuild uses to run a build, including phases and artifacts. appspec.yml belongs to CodeDeploy and describes deployment steps.

    Source: docs.aws.amazon.com/codebuild/latest/userguide/build-spec-ref.html · Domain: SDLC Automation

  3. A company must deploy the same AWS CloudFormation template, which creates baseline IAM roles, to 40 accounts in three Regions with a single operation. Which feature should a DevOps engineer use?

    • A. CloudFormation StackSets ✔ correct
    • B. CloudFormation nested stacks
    • C. CloudFormation drift detection
    • D. CloudFormation stack policies

    Answer: A. StackSets create, update or delete stacks across multiple accounts and Regions with a single operation from an administrator account. Nested stacks reuse templates inside one stack; drift detection finds manual changes.

    Source: docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/what-is-cfnstacksets.html · Domain: Configuration Management and IaC

  4. A CloudFormation change set lets you preview how proposed changes to a stack will affect your running resources before you run the update.

    • A. True ✔ correct
    • B. False

    Answer: A. True. A change set lists the changes CloudFormation will make, such as whether a resource will be replaced, so you can review them and then run or delete the change set.

    Source: docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks · Domain: Configuration Management and IaC

  5. An Auto Scaling group sits behind an Application Load Balancer. The application on some instances hangs, and the load balancer marks them unhealthy, but the group never replaces them. What should the engineer do?

    • A. Increase the desired capacity of the Auto Scaling group
    • B. Turn on detailed monitoring for every instance
    • C. Turn on ELB health checks for the Auto Scaling group ✔ correct
    • D. Add a launch lifecycle hook to the Auto Scaling group

    Answer: C. By default the group relies on EC2 status checks, which pass while the OS runs. Turning on ELB health checks lets Amazon EC2 Auto Scaling use the load balancer's results and replace instances that fail them.

    Source: docs.aws.amazon.com/autoscaling/ec2/userguide/ec2-auto-scaling-health-checks.htm · Domain: Resilient Cloud Solutions

  6. In an Amazon RDS Multi-AZ DB instance deployment (one standby), the standby instance can serve read-only traffic to reduce load on the primary.

    • A. True
    • B. False ✔ correct

    Answer: B. False. The standby in a Multi-AZ DB instance deployment is for high availability only and cannot serve reads. Use read replicas or a Multi-AZ DB cluster deployment for read scaling.

    Source: docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Concepts.MultiAZSingleStandby.htm · Domain: Resilient Cloud Solutions

  7. An application writes logs to Amazon CloudWatch Logs. The team wants an alarm when more than 20 lines containing ERROR appear within 5 minutes. What should they configure?

    • A. An AWS X-Ray sampling rule for the application
    • B. A CloudWatch Logs metric filter and a CloudWatch alarm on its metric ✔ correct
    • C. An AWS CloudTrail trail that delivers logs to Amazon S3
    • D. An AWS Config managed rule for the log group

    Answer: B. A metric filter turns matching log events into a CloudWatch metric, and a CloudWatch alarm on that metric fires when the count crosses the threshold. CloudTrail records API calls, not application log lines.

    Source: docs.aws.amazon.com/AmazonCloudWatch/latest/logs/MonitoringLogData.html · Domain: Monitoring and Logging

  8. Whenever a production EC2 instance enters the stopped state, a team wants a Lambda function to run automatically and notify the on-call engineer. What is the simplest way to do this?

    • A. An Amazon EventBridge rule for EC2 state-change events ✔ correct
    • B. An AWS CloudFormation drift detection check that runs every hour
    • C. An AWS Trusted Advisor check with a weekly refresh
    • D. An Amazon Inspector scan of the running instance

    Answer: A. EventBridge rules match incoming events by an event pattern, such as an EC2 instance state-change notification, and send them to targets like Lambda functions or SNS topics in near real time.

    Source: docs.aws.amazon.com/eventbridge/latest/userguide/eb-rules.html · Domain: Incident and Event Response

  9. A pipeline and an application need a database password. Which two AWS options store the password securely so it is not hardcoded in source code? (Select TWO)

    • A. A plaintext variable in the buildspec.yml file in the repository
    • B. AWS Secrets Manager ✔ correct
    • C. A tag on the EC2 instance that runs the application
    • D. An object in a public Amazon S3 bucket
    • E. AWS Systems Manager Parameter Store SecureString parameter ✔ correct

    Answer: B, E. Secrets Manager (with optional automatic rotation) and Parameter Store SecureString parameters (encrypted with AWS KMS) keep secrets out of code; both can be referenced from CodeBuild and applications. Tags and plain files are readable.

    Source: docs.aws.amazon.com/secretsmanager/latest/userguide/intro.html · Domain: Security and Compliance

  10. A company wants any S3 bucket that becomes publicly readable to be detected and fixed automatically. Which approach fits best?

    • A. Amazon Macie sensitive data discovery jobs
    • B. AWS Artifact compliance reports
    • C. Amazon Inspector vulnerability scans
    • D. An AWS Config rule with automatic remediation ✔ correct

    Answer: D. AWS Config rules evaluate resource configurations, and automatic remediation runs a Systems Manager Automation document to fix noncompliant resources. Macie finds sensitive data; Artifact provides AWS compliance reports.

    Source: docs.aws.amazon.com/config/latest/developerguide/remediation.html · Domain: Security and Compliance

Original practice questions written by xOps School (DevOpsSchool Private Limited) from the public AWS exam objectives (DOP-C02 exam guide (docs.aws.amazon.com, current edition)), checked 2026-10-25. They are not actual exam questions. xOps School is not affiliated with or endorsed by AWS; exam names are trademarks of their owners. Official exam page: aws.amazon.com/certification/certified-devops-engineer-professional/.

Last modified: Sunday, 25 October 2026, 9:57 PM