This is the free Amazon DOP-C02 practice question bank —
220 of 424 total questions, each with a full explanation, free to
read with no signup required. Updated 2026-08-06.
Every answer is verified against official Amazon documentation —
see our methodology.
Question 1
An ecommerce company hosts a web application on Amazon EC2 instances that are in an Auto Scaling group. The company deploys the application across multiple Availability Zones.
Application users are reporting intermittent performance issues with the application.
The company enables basic Amazon CloudWatch monitoring for the EC2 instances. The company identifies and implements a fix for the performance issues. After resolving the issues, the company wants to implement a monitoring solution that will quickly alert the company about future performance issues.
Which solution will meet this requirement?
A. Enable detailed monitoring for the EC2 instances. Create custom CloudWatch metrics for application-specific performance indicators. Set up CloudWatch alarms based on the custom metrics. Use CloudWatch Logs Insights to analyze application logs for error patterns.
B. Use AWS X-Ray to implement distributed tracing. Integrate X-Ray with Amazon CloudWatch RUM. Use Amazon EventBridge to trigger automatic scaling actions based on custom events.
C. Use Amazon CloudFront to deliver the application. Use AWS CloudTrail to monitor API calls. Use AWS Trusted Advisor to generate recommendations to optimize performance. Use Amazon GuardDuty to detect potential performance issues.
D. Enable VPC Flow Logs. Use Amazon Data Firehose to stream flow logs to Amazon S3. Use Amazon Athena to analyze the logs and to send alerts to the company.
Show Answer
Correct Answer: A
Explanation: Detailed CloudWatch monitoring provides higher-frequency EC2 metrics (1-minute instead of basic 5-minute), enabling faster detection. Custom CloudWatch metrics allow monitoring application-specific performance indicators, and CloudWatch alarms can notify the team immediately when thresholds are breached. CloudWatch Logs Insights complements monitoring by helping investigate error patterns after alerts. The other options focus on tracing, network analysis, or unrelated services rather than fast operational alerting for application performance.
Sources:
https://codingnconcepts.com/aws/aws-certified-solutions-architect-associate-exam-questions
Question 2
A company deploys a web application on Amazon EC2 instances that are behind an Application Load Balancer (ALB). The company stores the application code in an AWS CodeConnections compatible Git repository.
When the company merges code to the main branch, an AWS CodeBuild project is initiated. The CodeBuild project compiles the code, stores the packaged code in AWS CodeArtifact, and invokes AWS Systems Manager Run Command to deploy the packaged code to the EC2 instances.
Previous deployments have resulted in defects, EC2 instances that were not running the latest version of the packaged code, and inconsistencies between instances. A DevOps engineer needs to improve the reliability of the deployment solution.
Which combination of actions will meet this requirement? (Choose two.)
A. Create a pipeline in AWS CodePipeline that uses the Git repository as the source provider. Configure the pipeline to have parallel build and test stages. In the pipeline, pass the CodeBuild project output artifact to an AWS CodeDeploy action.
B. Create a pipeline in AWS CodePipeline that uses the Git repository as the source provider. Configure the pipeline to have a build stage followed by a test stage. In the pipeline, pass the CodeBuild project output artifact to an AWS CodeDeploy action.
C. Create an AWS CodeDeploy application and a deployment group to deploy the packaged code to the EC2 instances. Configure the ALB for the deployment group.
D. Create individual AWS Lambda functions that use AWS CodeDeploy instead of Systems Manager to run build, test, and deploy actions.
E. Create an Amazon S3 bucket. Modify the CodeBuild project to store the packages in the S3 bucket instead of in CodeArtifact. Use deploy actions in CodeDeploy to deploy the artifact to the EC2 instances.
Show Answer
Correct Answer: B, C
Explanation: Use CodePipeline to orchestrate a sequential build then test workflow before deployment, and use CodeDeploy with an EC2 deployment group integrated with the Application Load Balancer for consistent, reliable deployments with deployment tracking and instance coordination. CodeDeploy for EC2 expects application revisions from Amazon S3 or GitHub, not CodeArtifact directly, so storing build artifacts in S3 is the standard deployment pattern; parallel build/test is inappropriate because tests depend on build output.
Sources:
https://www.certqueen.com/DOP-C02-exam.html
Question 3
A company wants to improve its security practices by enforcing least privilege across all projects. Developers must be able to access Amazon EC2 resources but not Amazon RDS resources. Database administrators must have access only to Amazon RDS resources.
Every employee has a unique IAM user. There are already pre-existing IAM policies for developer and database administrator job functions. All AWS resources are already tagged with appropriate project tags. All the IAM users are tagged with the appropriate project and job function.
The company must ensure that each employee can access only the project that the employee is working on.
Which solution will meet these requirements? (Choose three.)
A. For each project, create one IAM role for developers and one IAM role for database administrators. Tag the IAM roles with the corresponding projects and job functions.
B. Modify the pre-existing IAM policies to include a StringEquals ResourceTag condition for projects that match the PrincipalTag value. Attach the modified policies to the IAM roles for each job function.
C. Create an IAM policy that allows users to assume a role when the ResourceTag value matches the PrincipalTag value for project tags and job title tags. Attach the new policy to all IAM users.
D. Create an IAM policy that allows users to assume a role when the ResourceTag value matches the PrincipalTag value for project tags and job title tags. Attach the new policy to the IAM roles for each job function.
E. Tag the pre-existing IAM policies with the appropriate projects and job functions. Attach the modified policies to IAM roles for each job function.
F. For each project, create one IAM group for developers and one IAM group for database administrators. Add the appropriate users to each group so the users can assume their respective IAM roles.
Show Answer
Correct Answer: A, B, C
Explanation: Use IAM roles per project/job function, ABAC conditions comparing principal tags to resource tags in the permissions policies, and a user policy permitting AssumeRole only when the target role's tags match the user's project and job-function tags.
Question 4
A company runs a development environment website and database on an Amazon EC2 instance that uses Amazon Elastic Block Store (Amazon EBS) storage. The company wants to make the instance more resilient to underlying hardware issues. The company wants to automatically recover the EC2 instance if AWS determines the instance has lost network connectivity.
Which solution will meet these requirements?
A. Add the EC2 instance to an Auto Scaling group. Set the minimum, maximum, and desired capacity to 1.
B. Add the EC2 instance to an Auto Scaling group. Configure a lifecycle hook to detach the EBS volume if the EC2 instance shuts down or terminates
C. Create an Amazon CloudWatch alarm for the StatusCheckFailed_System metric. Add an EC2 action to recover the instance when the alarm state is in ALARM
D. Create an Amazon CloudWatch alarm for the NetworkOut metric. Add an EC2 action to recover the instance when the alarm state is in INSUFFICIENT_DATA.
Show Answer
Correct Answer: C
Explanation: A CloudWatch alarm on the EC2 StatusCheckFailed_System metric with the EC2 recover action automatically recovers an instance when AWS detects underlying host or network infrastructure problems. Recovery preserves the instance ID, attached EBS volumes, private/public IPs (where applicable), and is specifically designed for hardware failures. Auto Scaling would replace rather than recover the instance, and NetworkOut is not the correct metric for this purpose.
Question 5
A company is using AWS CodeDeploy to deploy applications to a fleet of Amazon EC2 instances. During a recent deployment, several EC2 instances failed to update successfully.
A DevOps engineer must investigate the root cause of the failures and must determine which specific deployment lifecycle events encountered errors.
What is the MOST operationally efficient way to access and analyze the detailed deployment logs for troubleshooting?
A. Use SSH to connect to each EC2 instance that failed to update successfully. Read the logs from the CodeDeploy agent.
B. Use AWS Systems Manager Session Manager to connect to each EC2 instance that failed to update successfully. Read the logs from the CodeDeploy agent.
C. Create an Amazon S3 bucket to store CodeDeploy logs. Update the appspec.yml file to copy logs to the S3 bucket. Query the S3 bucket by using Amazon Athena
D. Send CodeDeploy agent logs to Amazon CloudWatch Logs by using the CloudWatch agent. Analyze the logs by using CloudWatch Logs Insights.
Show Answer
Correct Answer: D
Explanation: Centralizing CodeDeploy agent logs in Amazon CloudWatch Logs using the CloudWatch agent provides the most operationally efficient way to troubleshoot deployments across many EC2 instances. CloudWatch Logs Insights enables querying and filtering logs to identify which deployment lifecycle events failed without logging into individual instances. Options A and B require manual access to each instance, and C requires building a custom log export and analysis workflow that is less efficient.
Question 6
A company built its serverless infrastructure on AWS. The infrastructure consists of an Amazon API Gateway REST API, multiple AWS Lambda functions, and Amazon EventBridge.
The company wants to be aware of any new supply chain attacks that the company's CI/CD pipelines do not catch. The company needs a solution to detect malicious activity in the deployed application.
Which solution meets these requirements?
A. Enable AWS WAF for the API Gateway REST API. Configure an AWS WAF ACL. Add the known bad inputs managed rule group.
B. Enable Amazon GuardDuty. Enable Lambda Protection. Use EventBridge for event notifications.
C. Deploy AWS CloudFormation Guard in the CI/CD pipelines. Write rules to catch the supply chain attacks.
D. Create a firewall in AWS Network Firewall. Configure a policy. Add the managed rule for the Emerging Threats rule group.
Show Answer
Correct Answer: B
Explanation: Amazon GuardDuty with Lambda Protection detects malicious runtime behavior in AWS Lambda functions, including indicators consistent with compromised code or supply chain attacks that evade CI/CD scanning. EventBridge can deliver GuardDuty findings as notifications. AWS WAF protects against web request attacks, CloudFormation Guard validates IaC during CI/CD rather than runtime, and AWS Network Firewall is not applicable to this serverless architecture for detecting Lambda runtime compromise.
Question 7
A company uses AWS Lambda functions in the primary operating AWS Region of its AWS account. The company manually created the Lambda functions.
The company needs to use a Python-based AWS Cloud Development Kit (AWS CDK) application to manage the Lambda functions.
Which solution meets these requirements with the LEAST implementation effort?
A. Start a partial scan by using the AWS CloudFormation infrastructure as code (IaC) generator. Filter by the Lambda resource type. Create an AWS CDK application from the scanned resources. Download the AWS CDK application. For each Lambda function, set the from_asset parameter for the Lambda handler code object.
B. Start a partial scan by using the AWS CloudFormation infrastructure as code (IaC) generator. Filter by the Lambda resource type. Create a CloudFormation template from the scanned resources. Download the CloudFormation template. For each Lambda function, replace the Code/S3Bucket property and the Code/S3Key property with the Code/ZipFile property. Convert the CloudFormation template to an AWS CDK application.
C. Start a partial scan by using the AWS CloudFormation infrastructure as code (IaC) generator. Filter by the Lambda resource type. Create a CloudFormation template from the scanned resources. Download the CloudFormation template. For each Lambda function, replace the Code/S3Bucket property and the Code/S3Key property with the Code/ImageUri property. Convert the CloudFormation template to an AWS CDK application.
D. Create a resource inventory by using AWS Config. Filter by the Lambda resource type. Export the inventory to a .csv file. Write an AWS CDK application that references the Lambda functions from the .csv file. For each Lambda function, set the from_asset parameter for the Lambda handler code object.
Show Answer
Correct Answer: A
Explanation: The AWS CloudFormation IaC generator can discover existing Lambda resources and generate an AWS CDK application directly, minimizing migration effort. Because Lambda function code cannot be reconstructed from the deployed function configuration, the generated resources reference existing code locations; you must update each function to use CDK asset packaging (for example, using from_asset for local code). Options B and C add unnecessary CloudFormation conversion steps and incorrectly replace code properties. Option D relies on AWS Config inventory and requires building the CDK application manually, resulting in more work.
Question 8
A company uses Amazon Elastic Kubernetes Services (Amazon EKS) to host containerized applications that are available in Amazon Elastic Container Registry (Amazon ECR).
The company currently launches EKS clusters in the company's development environment by using the AWS CLI aws eks create-cluster command. The company uses the aws eks create-addon command to install required add-ons. All installed add-ons are currently version compatible with the version of Kubernetes that the company uses. All clusters exclusively use managed node groups for compute capacity.
Some of the EKS clusters require a version upgrade. A DevOps engineer must ensure that upgrades continuously occur within the AWS standard support schedule.
Which solution will meet this requirement with the LEAST operational overhead?
A. Run the aws eks update-cluster-version command. Providing appropriate arguments such as cluster name and version number.
B. Enable EKS Auto Mode on all EKS clusters. Remove all existing managed node groups.
C. Run the eksctl command to upgrade the EKS clusters. Provide appropriate arguments such as cluster name and version number
D. Refactor the environment to create EKS clusters by using infrastructure as code (IaC). Upgrade the clusters by using code changes.
Show Answer
Correct Answer: B
Explanation: Amazon EKS Auto Mode is designed to minimize operational overhead by having AWS manage key cluster infrastructure and lifecycle tasks, including automated updates. This best satisfies the requirement to keep clusters upgraded within the standard support schedule. The other options require manual upgrade execution (AWS CLI or eksctl) or a broader IaC refactor that still requires managing upgrade workflows.
Question 9
A company runs an application that uses an Amazon S3 bucket to store images. A DevOps engineer needs to implement a multi-Region disaster recover (DR) strategy for the S3 objects. The DevOps engineer enables two-way replication between the S3 buckets.
The company must be able to fail over to a second S3 bucket that is in a second AWS Region. When an image is added to either S3 bucket, the image must be replicated to the other S3 bucket within 15 minutes.
Which combination of steps will meet these requirements in the MOST operationally efficient way? (Choose three.)
A. Enable S3 Replication Time Control (S3 RTC) for each replication rule used in the configuration.
B. Create an S3 Multi-Region Access Point in an active-passive configuration.
C. Call the SubmitMultiRegionAccessPointRoutes operation in the Amazon S3 API when the company needs to fail over to the S3 bucket in the second Region.
D. Enable S3 Transfer Acceleration on both S3 buckets.
E. Configure a routing control in Amazon Route 53 Application Recovery Controller. Add both S3 buckets in an active-passive configuration.
F. Use an Amazon Route 53 Application Recovery Controller to shift traffic from the primary bucket to the failover bucket in the second Region.
Show Answer
Correct Answer: A, B, C
Explanation: S3 Replication Time Control (RTC) provides a replication SLA of within 15 minutes, satisfying the replication requirement. S3 Multi-Region Access Points provide a single global endpoint for active-passive multi-Region access. During a disaster, failover is performed by updating the Multi-Region Access Point routing with the SubmitMultiRegionAccessPointRoutes API to direct traffic to the secondary bucket. Transfer Acceleration is unrelated to replication or failover, and Route 53 Application Recovery Controller does not directly control S3 bucket access in this scenario.
Question 10
A company's applications run on Amazon EC2 instances and use AWS Lambda functions in multiple AWS accounts. All EC2 instances have the Amazon CloudWatch agent installed. All accounts belong to the same organization in AWS Organizations. The company has created a dedicated central log account.
All logs that the applications produce must be sent to a central location. The logs must be encrypted with keys that the company manages.
Which solution meets these requirements with the LEAST operational overhead?
A. In the central log account, enable logs as the data source in CloudWatch. Add the organization ID to the source account list. Create a CloudFormation StackSet by using the template provided by CloudWatch to enable central monitoring in all the organization's accounts.
B. Create an Amazon S3 bucket in the central log account. Create an Amazon Data Firehose stream in the central log account. Set the S3 bucket as the destination of the Firehose stream. Create a log subscription in the central log account. Set the Firehose stream as a target of the subscription. Store the subscription log ARN in AWS Systems Manager Parameter Store for each project to use to send logs to the S3 bucket.
C. Create an Amazon S3 bucket in each account. Create an Amazon OpenSearch Service cluster in the central log account. Create an Amazon Simple Queue Service (Amazon SQS) queue in the central log account. Create an S3 trigger that sends events to the SQS queue each time a new file is uploaded to the S3 bucket. Create a Lambda function that processes each file and sends each file to the OpenSearch Service cluster.
D. Create an Amazon S3 bucket in the central log account. Create an Amazon Data Firehose stream in each account. Set the S3 bucket as the destination of the Firehose streams. Create a log subscription in each account with the Firehose streams as a target.
Show Answer
Correct Answer: D
Explanation: Using CloudWatch Logs subscription filters with Amazon Data Firehose in each source account streams logs from EC2 (CloudWatch agent) and Lambda to a centralized S3 bucket in the logging account. S3 can use SSE-KMS with customer-managed KMS keys, satisfying encryption requirements. This architecture physically centralizes logs with relatively low operational overhead compared to custom processing solutions. Cross-account observability provides centralized viewing rather than log ingestion/storage in the central account.
$19
Get all 424 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.