This is the free Amazon DOP-C02 practice question bank —
220 of 422 total questions, each with a full explanation, free to
read with no signup required. Updated 2026-04-24.
Every answer is verified against official Amazon documentation —
see our methodology.
Question 1
A DevOps engineer successfully creates an Amazon Elastic Kubernetes Service (Amazon EKS) cluster that includes managed node groups. When the DevOps engineer tries to add node groups to the cluster, the cluster returns an error that states, "NodeCreationFailure: Instances failed to join the Kubernetes cluster."
The DevOps engineer confirms that the EC2 worker nodes are running and that the EKS cluster is in an active state.
How should the DevOps engineer troubleshoot this issue?
A. Ensure that the EKS cluster's VPC subnets do not overlap with the 172.17.0.0/16 CIDR range.
B. Use kubectl to update the kubeconfig file to use the credentials that created the cluster.
C. Run the AWSSupport-TroubleshootEKSWorkerNode runbook.
D. Create an AWS Identity and Access Management (IAM) OpenID Connect (OIDC) provider for the cluster.
Show Answer
Correct Answer: C
Explanation: The NodeCreationFailure error is a generic EKS managed node group error that can be caused by multiple issues such as IAM permissions, networking, bootstrap configuration, or security groups. AWS provides the AWSSupport-TroubleshootEKSWorkerNode Systems Manager Automation runbook specifically to diagnose and identify the root cause when worker nodes fail to join an EKS cluster. This is the recommended and most comprehensive troubleshooting approach for this scenario.
Question 1
A company wants to improve its security practices by enforcing least privilege across all projects. Developers must be able to access Amazon EC2 resources but not Amazon RDS resources. Database administrators must have access only to Amazon RDS resources.
Every employee has a unique IAM user. There are already pre-existing IAM policies for developer and database administrator job functions. All AWS resources are already tagged with appropriate project tags. All the IAM users are tagged with the appropriate project and job function.
The company must ensure that each employee can access only the project that the employee is working on.
Which solution will meet these requirements? (Choose three.)
A. For each project, create one IAM role for developers and one IAM role for database administrators. Tag the IAM roles with the corresponding projects and job functions.
B. Modify the pre-existing IAM policies to include a StringEquals ResourceTag condition for projects that match the PrincipalTag value. Attach the modified policies to the IAM roles for each job function.
C. Create an IAM policy that allows users to assume a role when the ResourceTag value matches the PrincipalTag value for project tags and job title tags. Attach the new policy to all IAM users.
D. Create an IAM policy that allows users to assume a role when the ResourceTag value matches the PrincipalTag value for project tags and job title tags. Attach the new policy to the IAM roles for each job function.
E. Tag the pre-existing IAM policies with the appropriate projects and job functions. Attach the modified policies to IAM roles for each job function.
F. For each project, create one IAM group for developers and one IAM group for database administrators. Add the appropriate users to each group so the users can assume their respective IAM roles.
Show Answer
Correct Answer: A, B, C
Explanation: The requirements are best met using attribute-based access control (ABAC) with IAM roles and tags. Creating per-project IAM roles for developers and DB administrators (A) establishes clear separation of duties. Modifying the existing job-function policies to include conditions that compare aws:ResourceTag (project) with aws:PrincipalTag (project) (B) ensures users can access only resources in their assigned project while still limiting access to EC2 or RDS as required. Finally, an IAM policy that allows users to assume roles only when role tags match the users’ project and job-function tags (C) ensures that each employee can assume only the correct role for their project. Other options either misuse tagging, attach policies at the wrong level, or rely on IAM groups, which do not support ABAC effectively.
Question 2
A company builds container images and stores them on Amazon Elastic Container Registry (Amazon ECR) in the company's primary AWS Region.
A DevOps engineer wants to replicate all the company's ECR repository images to a secondary Region. The DevOps engineer creates a new ECR repository in the secondary Region and configures permission on the new repository to allow replication.
Which solution will meet these requirements with the MOST operational efficiency?
A. Pull the existing primary ECR images and then push the images to the secondary ECR repository. Create a replication rule on the primary ECR registry to replicate the images to the secondary ECR registry.
B. Pull the existing primary ECR images and then push the images to the secondary ECR repository. Configure permission on the primary ECR registry to allow access from the secondary Region.
C. Configure permission on the primary ECR registry to allow access from the secondary Region. Create a replication rule on the primary ECR registry to replicate the images to the secondary ECR registry.
D. Configure an AWS Lambda function to automatically save the ECR images to an Amazon S3 bucket. Configure cross-Region replication for the S3 bucket. Configure a second Lambda function to push the images to ECR repositories in the replication destination Region when images are replicated to the S3 bucket.
Show Answer
Correct Answer: A
Explanation: Amazon ECR replication rules only replicate images that are pushed after the rule is created; they do not retroactively replicate existing images. To replicate all images, the existing images must first be manually pulled from the primary Region and pushed to the secondary Region. Then, configuring an ECR replication rule provides automated, ongoing replication for future images with minimal operational overhead. Option A is the only choice that satisfies both the immediate requirement (all existing images) and long-term operational efficiency.
Question 2
A company runs a development environment website and database on an Amazon EC2 instance that uses Amazon Elastic Block Store (Amazon EBS) storage. The company wants to make the instance more resilient to underlying hardware issues. The company wants to automatically recover the EC2 instance if AWS determines the instance has lost network connectivity.
Which solution will meet these requirements?
A. Add the EC2 instance to an Auto Scaling group. Set the minimum, maximum, and desired capacity to 1.
B. Add the EC2 instance to an Auto Scaling group. Configure a lifecycle hook to detach the EBS volume if the EC2 instance shuts down or terminates
C. Create an Amazon CloudWatch alarm for the StatusCheckFailed_System metric. Add an EC2 action to recover the instance when the alarm state is in ALARM
D. Create an Amazon CloudWatch alarm for the NetworkOut metric. Add an EC2 action to recover the instance when the alarm state is in INSUFFICIENT_DATA.
Show Answer
Correct Answer: C
Explanation: An EC2 instance recovery action is specifically designed to handle underlying hardware or network failures detected by AWS system status checks. Creating a CloudWatch alarm on the StatusCheckFailed_System metric and configuring the Recover action automatically migrates the instance to healthy hardware while preserving the instance ID, IP addresses, and attached EBS volumes. Auto Scaling groups are not required and do not directly perform EC2 instance recovery.
Question 3
A company has deployed a microservices-based application on Amazon Elastic Container Service (Amazon ECS). The application is experiencing performance issues. The company needs to identify which microservices are causing the issues.
Which solution will provide this information?
A. Configure AWS X-Ray for each ECS task. Create an X-Ray group for each microservice. Implement custom X-Ray subsegments in each microservice to capture detailed timing information. Use an X-Ray service map to visualize and identify slow microservices and requests.
B. Configure AWS X-Ray for each ECS task. Use an X-Ray service map to visualize the application's architecture and request flow. Filter the X-Ray traces by response time and error rate. Identify the microservices that have high latency or high error rates. Analyze individual traces to identify slow microservices and requests.
C. Configure Amazon CloudWatch Container Insights for each ECS task. Analyze Container Insights metrics to identify slow microservices. Use CloudWatch Logs Insights to filter the Container Insights log data by response time and error rate. Analyze the log data to identify slow requests.
D. Configure Amazon CloudWatch Container Insights for each ECS task. Use the CloudWatch automatic dashboard for Amazon ECS to identify slow microservices. Use CloudWatch Logs Insights to analyze the Container Insights performance logs for each ECS task to identify slow requests.
Show Answer
Correct Answer: B
Explanation: AWS X-Ray provides distributed tracing that is specifically designed to identify performance bottlenecks in microservices architectures. By enabling X-Ray on each ECS task and using the X-Ray service map, the company can visualize request flow, dependencies, and latency between microservices. Filtering traces by response time and error rate highlights problematic services, and analyzing individual traces pinpoints where delays occur. This directly addresses the need to identify which microservices are causing the performance issues without unnecessary additional configuration.
Question 3
A company is using AWS CodeDeploy to deploy applications to a fleet of Amazon EC2 instances. During a recent deployment, several EC2 instances failed to update successfully.
A DevOps engineer must investigate the root cause of the failures and must determine which specific deployment lifecycle events encountered errors.
What is the MOST operationally efficient way to access and analyze the detailed deployment logs for troubleshooting?
A. Use SSH to connect to each EC2 instance that failed to update successfully. Read the logs from the CodeDeploy agent.
B. Use AWS Systems Manager Session Manager to connect to each EC2 instance that failed to update successfully. Read the logs from the CodeDeploy agent.
C. Create an Amazon S3 bucket to store CodeDeploy logs. Update the appspec.yml file to copy logs to the S3 bucket. Query the S3 bucket by using Amazon Athena
D. Send CodeDeploy agent logs to Amazon CloudWatch Logs by using the CloudWatch agent. Analyze the logs by using CloudWatch Logs Insights.
Show Answer
Correct Answer: D
Explanation: Centralizing CodeDeploy agent logs in Amazon CloudWatch Logs provides the most operationally efficient way to troubleshoot deployment failures across many EC2 instances. CloudWatch Logs Insights enables fast querying and filtering of logs to pinpoint which deployment lifecycle events failed, without manually accessing instances. SSH or Session Manager require per-instance investigation, and exporting logs to S3 with Athena adds unnecessary setup and latency.
Question 4
A company needs to manage shared libraries for various projects across its development AWS account and production AWS account. The company has configured IAM roles for developers and has defined an AWS CodePipeline pipeline by using the AWS Cloud Development Kit (AWS CDK).
A DevOps engineer must implement a solution to ensure that only developers can access the latest versions of the libraries. The solution must test shared packages independently before the shared packages are consumed by other applications and before they go to production.
Which solution will meet these requirements?
A. Create a single AWS CodeArtifact repository for development and production in a central account. Use IAM policies for the developer roles to allow only developers to access the shared libraries. Create an Amazon EventBridge role to start an AWS CodeBuild project and to test each package before the package is copied to the production repository.
B. Create an AWS CodeArtifact repository in the development account. Create another CodeArtifact repository in the production account. For the development repository, add a repository policy that allows only developers to access the shared libraries. Create an Amazon EventBridge rule to start the CodePipeline pipeline and to test each package before the package is copied to the production repository.
C. Create a single Amazon S3 bucket with versioning enabled for development and production in a central account. Use IAM policies for the developer roles to allow only the developers to access the shared libraries. Create an Amazon EventBridge rule to start an AWS CodeBuild project and to test each package before the package is copied to production.
D. Create an Amazon S3 bucket with versioning enabled in the development account. Create another S3 bucket with versioning enabled in the production account. For the development S3 bucket, add a bucket policy that allows only developers to access the shared libraries. Create an Amazon EventBridge role to start the CodePipeline pipeline. Configure the role to test each package when the package is copied to production and to revert the changes if the tests fail.
Show Answer
Correct Answer: B
Explanation: Using AWS CodeArtifact is the native and recommended service for managing shared libraries. Separate repositories in the development and production accounts allow clear promotion boundaries and isolation. Restricting the development repository with repository policies ensures only developers can access the latest versions. Testing packages in the pipeline before copying them to the production repository satisfies the requirement to validate shared packages independently before consumption and production use. Other options either mix dev/prod in a single repository or rely on S3, which lacks proper package-management features.
Question 4
A company built its serverless infrastructure on AWS. The infrastructure consists of an Amazon API Gateway REST API, multiple AWS Lambda functions, and Amazon EventBridge.
The company wants to be aware of any new supply chain attacks that the company's CI/CD pipelines do not catch. The company needs a solution to detect malicious activity in the deployed application.
Which solution meets these requirements?
A. Enable AWS WAF for the API Gateway REST API. Configure an AWS WAF ACL. Add the known bad inputs managed rule group.
B. Enable Amazon GuardDuty. Enable Lambda Protection. Use EventBridge for event notifications.
C. Deploy AWS CloudFormation Guard in the CI/CD pipelines. Write rules to catch the supply chain attacks.
D. Create a firewall in AWS Network Firewall. Configure a policy. Add the managed rule for the Emerging Threats rule group.
Show Answer
Correct Answer: B
Explanation: The requirement is to detect malicious activity in the deployed serverless application that bypasses CI/CD checks, including supply chain attacks. Amazon GuardDuty with Lambda Protection monitors runtime behavior of Lambda functions, such as anomalous network activity, unauthorized access, and indicators of compromise introduced through dependencies. Using EventBridge for notifications provides awareness of detections. The other options focus on perimeter filtering or CI/CD-time controls and do not detect runtime supply chain threats.
Question 5
A company manages its multi-account environment by using AWS Organizations and AWS Control Tower. The company must deploy standardized security controls and compliance policies across all of its AWS accounts and AWS Regions. Any changes to these controls must be automatically applied to all accounts simultaneously.
The company has the required security controls and compliance policies defined in AWS Cloud Development Kit (AWS CDK) as a security controls construct.
Which solution will deploy these controls across all accounts and Regions with the LEAST operational overhead?
A. Create an AWS CDK app that includes an AWS CloudFormation StackSets construct. Configure the StackSets construct to use the security controls construct as its template. Specify the target accounts and Regions. Create automation to deploy the CDK app to create and manage the CloudFormation stack set.
B. Create an AWS CDK app that synthesizes an AWS CloudFormation template from the security controls construct. Use Amazon EventBridge to invoke an AWS Lambda function to update a CloudFormation stack set when changes are made to the security controls construct.
C. Convert the security controls construct to an AWS CloudFormation macro. Create a CloudFormation stack set that references the macro and deploys the macro to all target accounts. Use Organizations to automatically add new accounts to the stack set’s list of target accounts.
D. Use AWS Control Tower to create a customized landing zone that includes configurations from the security controls construct. Configure AWS Control Tower to automatically enroll new accounts and to apply the landing zone template.
Show Answer
Correct Answer: D
Explanation: AWS Control Tower is purpose-built to centrally enforce and propagate standardized security controls, guardrails, and compliance configurations across all AWS accounts and Regions with minimal operational effort. It automatically applies configurations to existing and newly enrolled accounts and ensures consistency without requiring custom deployment automation. Using Control Tower avoids the overhead of managing custom CDK-driven StackSets, Lambda automation, or macros, making it the least operationally intensive solution.
Question 5
A company uses AWS Lambda functions in the primary operating AWS Region of its AWS account. The company manually created the Lambda functions.
The company needs to use a Python-based AWS Cloud Development Kit (AWS CDK) application to manage the Lambda functions.
Which solution meets these requirements with the LEAST implementation effort?
A. Start a partial scan by using the AWS CloudFormation infrastructure as code (IaC) generator. Filter by the Lambda resource type. Create an AWS CDK application from the scanned resources. Download the AWS CDK application. For each Lambda function, set the from_asset parameter for the Lambda handler code object.
B. Start a partial scan by using the AWS CloudFormation infrastructure as code (IaC) generator. Filter by the Lambda resource type. Create a CloudFormation template from the scanned resources. Download the CloudFormation template. For each Lambda function, replace the Code/S3Bucket property and the Code/S3Key property with the Code/ZipFile property. Convert the CloudFormation template to an AWS CDK application.
C. Start a partial scan by using the AWS CloudFormation infrastructure as code (IaC) generator. Filter by the Lambda resource type. Create a CloudFormation template from the scanned resources. Download the CloudFormation template. For each Lambda function, replace the Code/S3Bucket property and the Code/S3Key property with the Code/ImageUri property. Convert the CloudFormation template to an AWS CDK application.
D. Create a resource inventory by using AWS Config. Filter by the Lambda resource type. Export the inventory to a .csv file. Write an AWS CDK application that references the Lambda functions from the .csv file. For each Lambda function, set the from_asset parameter for the Lambda handler code object.
Show Answer
Correct Answer: A
Explanation: The AWS CloudFormation IaC generator can scan existing manually created Lambda functions and directly generate an AWS CDK application, avoiding the extra step of converting a CloudFormation template into CDK code. This minimizes implementation effort. Options B and C require template modification and conversion, and D requires manual inventory handling and custom CDK coding.
$19
Get all 422 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.