AWS Certified DevOps Engineer Professional (DOP-C02) Exam Guide (2026)

If you can say why an in-place CodeDeploy cut is not a blue/green shift, when a CloudFormation stack update is the wrong way to patch a fleet, and what EventBridge should do before anyone opens the console, you are in the right exam.

DOP-C02 is the current AWS DevOps Engineer Professional code. It replaced DOP-C01 on 7 March 2023. The official exam guides index still lists DOP-C02 as the professional DevOps sitting. The Coming Soon page names CloudOps C03 and the MLA-C02 beta. It does not name a DOP-C03.

This guide is for people who will sit DOP-C02 on the current blueprint, including the Security and Compliance domain, Resilient Cloud Solutions as the home for high availability and disaster recovery, and the pipeline work that still carries the most scored weight.

Who this exam is for

Take it if the job is already the pipeline and the fleet. The exam guide describes the target candidate as having 2 or more years provisioning, operating, and managing AWS environments, and experience with the software development lifecycle and programming or scripting. The certification page repeats that mix. The January 2023 Training and Certification blog also names people who already hold Developer Associate and are ready for the professional step.

The recommended knowledge list is a gap check. Highly automated infrastructure. Administering operating systems. Modern development and operations processes. Experience securing AWS infrastructure. If those four are not already weekly work, sit Developer Associate and CloudOps Associate first.

Four job tasks are explicitly out of scope. Advanced networking such as advanced routing algorithms and failover techniques. Deep-level security recommendations to developers. Designing, querying, and optimizing database performance. Developing full-stack application code. Security still appears, as automation, IAM at scale, and auditing. Databases still appear, as failover, backup, and recovery. Application code still appears, as the artifact the pipeline ships. The sitting punishes people who treat those stems as a chance to design a schema or rewrite a service.

Skip it if the work is alarms and patch windows with no delivery pipeline. That is CloudOps. Skip it if the question you actually want answered is how to shape a workload end to end. That is Solutions Architect. AWS notes that passing this exam recertifies Developer Associate and CloudOps or SysOps Associate, which is a hint about the ground it assumes.

The candidate AWS wants can read a stem and name the stage. Build, test, artifact, deploy, observe, then change the fleet. The sitting punishes people who recognize a service logo but cannot say which stage the constraint is actually asking about.

Exam shape

DOP-C02 has six domains:

SDLC Automation is the single heaviest domain at 22%. Configuration Management and IaC ties Security and Compliance at 17%. Those three carry 56% of the scored content. If a study plan gives equal calendar time to all six, the math is already against you.

The sitting is 75 questions over 180 minutes. AWS scores 65 of them. Ten are unscored research questions, they are not identified on the exam, and they do not affect the result. The cost is 300 USD.

The passing score is 750 on a scaled range of 100 to 1,000. That matches several other professional and specialty sittings and is higher than the 720 used on several AWS associate exams. Scoring is compensatory, so a weak Domain 5 can still pass if Domain 1 is clean. Unanswered questions score as incorrect and there is no separate penalty for guessing, so leave nothing blank.

The exam guide lists two question types:

1. Multiple choice. One correct response and three distractors.
2. Multiple response. Two or more correct responses out of five or more options.

The marketing overview box agrees. Unlike Security Specialty, this outline does not add ordering or matching. Prepare for stems that ask for one action and stems that ask for a combination.

Languages are English, Japanese, Korean, and Simplified Chinese. The Korean version retires after 31 December 2026. The credential lasts 3 years. Recertify by passing the latest version of this exam, or maintain it for one year on AWS Skill Builder.

One practical detail from the certification page: the exam uses short names for some AWS services, and a short name to full name list is available behind the Help button during the sitting. Read that list before exam day so the abbreviations do not cost reading time.

What changed from DOP-C01 to DOP-C02

The Training and Certification blog that opened registration is the official delta. The domain count stayed at six. Almost everything about the last four domains moved.

Read that table as a restructure, not a renumbering. AWS says nothing was deleted. Content was reordered to align with the AWS Well-Architected Framework.

Moves the blog names:

• C01 Task 2.3, apply security concepts in the automation of resource provisioning, now lives in Domain 6 as IAM at scale, automated security controls, and security monitoring.
• C01 Task 3.4, tagging and other metadata strategies, is no longer a standalone task. Tagging is a habit across the outline.
• C01 Domain 4, Policies and Standards Automation, is spread through C02 Domains 2, 3, 4, and 6.
• C01 Domain 6, High Availability, Fault Tolerance, and Disaster Recovery, moved into Domain 3, Resilient Cloud Solutions.
• Normalization of data schemes was out of scope on C01 and is in scope on C02.

The weight shift is the part to act on. Incident and Event Response lost four points, from 18% to 14%. Configuration Management lost two, from 19% to 17%. Security and Compliance is now a named 17% domain. C01 had no domain with that name. The closest C01 slice was Policies and Standards Automation at 10%.

C01 study notes still cover pipelines, CloudFormation, CloudWatch, and CodeDeploy. They are thin on the Security and Compliance domain, on resilience as its own home, and on tagging as a cross-cutting control instead of a Domain 3 checkbox.

The 2026 calendar did not change the code. Sit C02.

How a pipeline picks a deploy

Domain 1 is not a logo list. It is a constraint list. The stem will tell you the compute platform, whether the instance can be replaced, and how much traffic may move at once.

CodeDeploy names three compute platforms: EC2/On-Premises, AWS Lambda, and Amazon ECS. The platform picks the legal methods before you pick a color.

On EC2/On-Premises you can do an in-place deploy or a blue/green deploy. In-place stops the application on the existing instance, installs the new revision, starts it, and validates. A load balancer can take the instance out of service while that happens. That is a mutable pattern. Blue/green on EC2 provisions replacement instances, installs the new revision there, waits if you want a test window, then shifts traffic. Rollback is a traffic shift back to the original instances if you have not terminated them. On-premises instances are not supported for blue/green. Only Amazon EC2 is.

Lambda and ECS cannot use in-place. Every Lambda and ECS deploy in CodeDeploy is blue/green. Traffic then shifts canary, linear, or all at once. Canary is a small first slice, then the rest. Linear is a fixed slice on a fixed schedule. All at once is the whole cut. If the stem is a Lambda function and the option is "in-place on the running version," that option is already wrong.

Task 1.4 also asks you to contrast mutable and immutable patterns. Image Builder and a new AMI or container image are the immutable path. Patching the running instance is the mutable path. The exam wants the path that matches the risk, not the path you used last week.

The rest of Domain 1 feeds that choice. CodePipeline models the stages. CodeBuild runs the tests that Task 1.2 places at the right stage: unit and coverage near the merge, load and security later. CodeArtifact, Amazon S3, and Amazon ECR hold the artifact. Secrets Manager and Systems Manager Parameter Store hold the secrets the build and the deploy are allowed to read. A stem that starts the pipeline by polling the repo on a timer is slower than an EventBridge rule on the branch. The official sample set trains that habit. Responsiveness is the constraint.

Multi-account pipelines belong here too. A single-account CodePipeline is not wrong. It is wrong when the stem already named a tool account, a test account, and a prod account.

How monitoring stops and response starts

Domain 4 stops at knowing. Domain 5 starts at doing. The boundary is the same shape Security Specialty uses for detection and response, with different services.

Domain 4 owns telemetry. CloudWatch namespaces, metrics, dimensions, and resolution. Metric filters that turn a log line into a number. Metric streams into S3 or Kinesis Data Firehose. The CloudWatch agent for custom metrics. Log group retention and S3 lifecycle. Subscriptions into Kinesis, Lambda, or OpenSearch Service. Logs Insights or Athena when the question is a search. X-Ray when the question is a slow call through API Gateway, a container, or Lambda. Anomaly detection when the baseline is the point. Inspector, Config rules, and CloudTrail when the question is an audit of what already happened.

Domain 4 also owns the first automation layer. EventBridge or S3 Event Notifications to SNS or Lambda. Alarms that notify. Auto scaling on EC2, RDS storage, DynamoDB, an ECS capacity provider, or an EKS autoscaler. ALB and Route 53 health checks. Config rules that remediate a known drift. Installing the SSM Agent and the CloudWatch agent so the next event has something to read.

Domain 5 owns the event after it exists. AWS Health, EventBridge, and CloudTrail as sources. Fan out, streaming, and queues. Workflows in SQS, Kinesis, SNS, Lambda, and Step Functions. Then Task 5.2, which is the one people skip: change the configuration. Systems Manager and AWS Auto Scaling for the fleet. Config for the desired state. Remediate a non-desired system state. Then Task 5.3, root cause on a failed CodePipeline, CodeBuild, CodeDeploy, or CloudFormation run, or on a failed auto scaling, ECS, or EKS process. CloudWatch synthetics and Systems Manager OpsCenter sit here, not in Domain 4.

A stem that says "the alarm fired" and asks what to configure in CloudWatch is usually Domain 4. A stem that says "the alarm fired" and asks what to do to the fleet is Domain 5. The first answer is almost never "open the console and reboot."

How to study without wasting a month

Order the weeks by weight, not by the order the domains are printed in.

Week 1. SDLC Automation, because it is 22%. Draw one pipeline from commit to prod and keep it. Source, CodeBuild, tests, artifact, CodeDeploy. Write the platform and the method on the last box. Practice the in-place versus blue/green split until the illegal options disappear before you read the distractors. Add Image Builder and an immutable AMI. Add a multi-account pipeline that promotes an artifact instead of rebuilding it. Put Secrets Manager or Parameter Store on the build role, not in the buildspec as plaintext.

Week 2. Configuration management and security, 34% combined. CloudFormation, CDK, and SAM for the template. StackSets for the same stack in many accounts and Regions. Learn the two permission models. Self-managed needs the IAM trust roles. Service-managed uses Organizations and can auto-deploy to a new account. Sequential Region deploy is the default. Failure tolerance is per Region. Then desired state. State Manager associations keep a node where you defined it. Maintenance Windows are for time-boxed work. They are not the same tool. Finish the week in Domain 6. Permissions boundaries and session policies for least privilege. SCPs for the organization ceiling. Secrets Manager rotation for machine identities. Security Hub, GuardDuty, Macie, and CloudFormation drift detection as the audit surface. Encrypt with KMS, CloudHSM, or ACM from the constraint, not from habit.

Week 3. Resilience, 15%. Translate an RTO and an RPO into a pattern before you pick a service. Pilot light and warm standby are named on the outline. Multi-AZ is not always enough. Multi-Region DynamoDB, RDS, Route 53, S3, and CloudFront are the named cross-Region tools. Test the failover. AWS Backup across Regions. A load balancer that recovers from a dead target. Auto scaling, caching, and loose coupling when the stem is scale rather than disaster. ECS, EKS, API Gateway, Lambda, and Fargate when the stem is a container or a function that has to grow.

Week 4. Monitoring and response, 29% combined. Build one worked event end to end. A log line becomes a metric filter, then an alarm, then an EventBridge rule, then a Systems Manager change. Write that as a sequence even though this exam does not score ordering items. Domain 4 is the collection and the first automation. Domain 5 is the change and the root cause. If you cannot say which domain a stem belongs to, you will pick a dashboard when the answer is a runbook.

Do not spend the month building a second organization "for the cert." Spend it reading stems and naming the stage before looking at the options.

Traps that look like easy elimination

Professional items rarely give you one plausible answer and three absurd ones. They give you two delivery actions that both work and one constraint that picks between them.

• In-place CodeDeploy is legal only on EC2/On-Premises. Lambda and ECS deploys are blue/green. An in-place option on a function is already dead.
• Blue/green on EC2 needs replacement Amazon EC2 instances. On-premises instances do not get that method.
• Canary, linear, and all-at-once are traffic-shift settings on Lambda and ECS. They are not a third platform.
• Mutable means you change the running node. Immutable means you replace it with a new image. Image Builder is the immutable factory. SSH and a package manager are the trap.
• A CloudFormation stack update in one account is not a StackSet. StackSets exist when the stem already named many accounts or many Regions.
• Self-managed StackSets need the IAM roles you create. Service-managed StackSets need Organizations. Automatic deploy to a new account is the service-managed tell.
• State Manager holds a desired state on a schedule. A Maintenance Window holds a clock. Patch Tuesday is a window. "Antivirus must be running" is an association.
• Domain 4 configures the alarm. Domain 5 changes the fleet after the alarm. "Create a dashboard" does not remediate a failed deploy.
• AWS Health, EventBridge, and CloudTrail are event sources. CloudWatch is where you watch. X-Ray is where you trace. OpsCenter is where you track the incident.
• An SCP is a permissions ceiling on principals in an account. A permissions boundary is a ceiling on what a delegated admin can grant. A resource policy speaks for the resource. They are not interchangeable.
• Macie finds sensitive data. It does not stop the read. GuardDuty watches behavior. Inspector scans for known vulnerabilities. Config records compliance. Drift detection on a CloudFormation stack is a stack problem, not a GuardDuty finding.
• KMS is the default key service. CloudHSM is the answer when the stem names single-tenant hardware or full customer control of the HSM.
• Advanced routing algorithms, database query tuning, and full-stack feature work are out of scope for this candidate. If an option asks you to redesign the schema or write the application, look for the pipeline or the recovery action instead.

If deleting the scenario still lets you pick the answer from the service name, the question is easier than the live exam.

How this maps to CloudFluently

Start with the official outline. The AWS Certified DevOps Engineer Professional (DOP-C02) exam guide carries the task statements and weights. Domain pages sit next to it for SDLC Automation, Configuration Management and IaC, Resilient Cloud Solutions, Monitoring and Logging, Incident and Event Response, and Security and Compliance. The certification page carries the logistics. The January 2023 update post carries the C01 to C02 map. Browse the AWS certification prep index for the official practice question set and pretest.

DevOps Professional sits on top of associate-level ground, and that ground is already live here. Domain 1 assumes CodeBuild, artifacts, and IAM for a running app are already reflexes, which is the AWS Developer Associate practice exam sets and the Developer Associate study notes. Domain 4 and Domain 5 assume CloudWatch, EventBridge, Systems Manager, and Config are already reflexes, which is the AWS CloudOps Associate practice exam sets and the CloudOps Associate study notes. Domain 3 assumes multi-AZ, failover, and Route 53 are already reflexes, which is the AWS Solutions Architect Associate practice exam sets and the Solutions Architect Associate study notes.

Work those associate banks until the fundamentals are automatic, then use this page and the official outline for the professional-only skills: multi-account pipelines, StackSets permission models, CodeDeploy platform rules, the Domain 4 and Domain 5 split, and IAM at organization scale.

Frequently Asked Questions

Is the exam code still DOP-C02 in 2026? Yes. The exam guides index lists DOP-C02 as the professional DevOps sitting. Coming Soon names other updates and does not name DOP-C03. DOP-C01 ended on 6 March 2023. DOP-C02 began on 7 March 2023.

What is the passing score? 750 on a scaled range of 100 to 1,000. Scoring is compensatory, so there is no per-domain pass requirement.

How many questions count? Sixty-five scored questions. Ten additional unscored research questions are included and are not identified on the exam. The sitting is 75 questions over 180 minutes and costs 300 USD.

Are there ordering and matching questions? The DOP-C02 exam guide lists two response types: multiple choice and multiple response. The marketing overview box says the same. Prepare for both. Do not study this sitting as if it added the ordering and matching forms that appear on some newer outlines.

Which domain is heaviest? SDLC Automation at 22%. Configuration Management and IaC and Security and Compliance follow at 17% each.

Does passing this exam recertify an associate? Yes. The recertification page says passing the latest DevOps Engineer Professional exam recertifies Developer Associate and CloudOps or SysOps Associate.

Do DOP-C01 study notes still work? Partly. Pipelines, CloudFormation, CloudWatch, and CodeDeploy carry over. They are thin on Security and Compliance as a 17% domain, on Resilient Cloud Solutions as the home for HA and DR, and on tagging as a cross-cutting habit.

Where is the official outline? AWS Certified DevOps Engineer Professional (DOP-C02). Use AWS for task statements and weights. Use this page for what changed and how to sequence the study.