AWS DOP-C02 Cheat Sheet: CI/CD, IaC, and Incident Response

Use this cheat sheet for AWS Certified DevOps Engineer - Professional (DOP-C02) after you know the basics but before you start a timed practice block. The goal is not to memorize a vendor catalog; the goal is to classify the scenario and reject attractive wrong answers quickly.

DOP-C02 is a professional operations exam disguised as a delivery exam. The strongest answer usually keeps five things connected: a source of truth, an automated gate, a safe rollout, telemetry that proves health, and a rollback or remediation path with scoped permissions.

Quick facts (DOP-C02)

I verified these current AWS exam facts on May 24, 2026.

Domain weights and review priority

This exam is not just “CI/CD.” It tests whether delivery, infrastructure, observability, resilience, incident response, and security controls work together as one operating system.

Operations proof stack

DOP-C02 questions are usually asking whether an AWS workload can be changed safely, observed clearly, recovered quickly, and governed consistently. Keep this stack in mind before choosing a service:

1. Source of truth: code, templates, parameters, runbooks, policies, and artifacts must be versioned or centrally managed.
2. Automated gate: tests, approvals, change sets, Config rules, security scans, or deployment checks stop unsafe changes before they spread.
3. Controlled rollout: canary, linear, blue-green, immutable, rolling, StackSets, or staged account/Region rollout limits blast radius.
4. Health evidence: CloudWatch metrics/logs, X-Ray traces, CloudTrail events, deployment status, synthetic checks, and application signals prove whether the change is healthy.
5. Safe response: rollback, traffic shift stop, Systems Manager Automation, Step Functions, EventBridge remediation, or tested restore brings the system back under control.
6. Permission boundary: deployment roles, service roles, KMS key policies, SCPs, secrets access, and resource policies keep automation scoped.

If an answer automates deployment but omits health evidence, rollback, or scoped permissions, it is usually incomplete for a professional-level question.

Official task compression

First-pass question triage

1. Name the tested lane before reading the answer choices.
2. Underline the constraint: security, cost, reliability, latency, governance, implementation effort, or evidence.
3. Reject answers that solve a neighboring problem but not the stated requirement.
4. Prefer the smallest correct control, service, workflow, or command that satisfies the constraint.
5. Look for proof: logs, tests, metrics, policy evidence, deployment status, evaluation results, or user-visible recovery.

Question-type traps

Unanswered questions are incorrect and there is no penalty for guessing. Professional-level stems are long; read the last sentence first, then scan for the constraint that decides between similar automation patterns.

Release proof chain

    flowchart LR
	  S["Source change"] --> B["Build and unit tests"]
	  B --> A["Artifact or image"]
	  A --> G{"Automated gates pass?"}
	  G -- "No" --> F["Fail closed and preserve evidence"]
	  G -- "Yes" --> D["Progressive deployment"]
	  D --> M["Metrics, logs, traces, synthetic checks"]
	  M --> H{"Healthy?"}
	  H -- "Yes" --> P["Promote"]
	  H -- "No" --> R["Rollback, stop traffic shift, or remediate"]

This is the default mental model for DOP-C02. If an option deploys without a durable artifact, skips testing, lacks alarms, or has no rollback path, it is probably weaker even if it names a real AWS service.

Release flow

Use this when the stem mixes source control, tests, deployment safety, and rollback.

    flowchart LR
	  C["Commit / merge"] --> T["Build + test"]
	  T --> A{"Pass gates?"}
	  A -->|yes| D["Deploy with canary, blue-green, or rolling strategy"]
	  A -->|no| F["Fail safely and fix the pipeline"]
	  D --> M["Monitor, alarm, and roll back if needed"]

DOP-C02 answer sequence

Use this when the question is really asking how to make delivery repeatable and safe.

    flowchart TD
	  S["Scenario"] --> S1["Source of truth first"]
	  S1 --> B["Build and test gates"]
	  B --> P["Package artifacts and parameters"]
	  P --> R["Release with the right rollout strategy"]
	  R --> O["Observe metrics, logs, traces, alarms"]
	  O --> X["Rollback, retry, or promote"]

Professional-level answer filter

What to know cold

Scenario eliminations

DOP-C02 distractors often automate the wrong thing. The strongest answer keeps a source of truth, reduces blast radius, proves health with telemetry, and preserves rollback.

Final answer stack

When two options both name real AWS services, keep the answer that satisfies the whole operating loop:

1. Identify the failing lifecycle stage. Is the issue source, build, artifact, deployment, infrastructure, telemetry, incident response, security, or compliance?
2. Prefer automation with evidence. A pipeline, runbook, or remediation is weaker if it cannot show logs, status, metrics, approvals, or execution history.
3. Reduce blast radius before speed. Professional answers prefer staged rollout, health checks, rollback, and failure containment over fast global change.
4. Fix the narrow failing layer. For access denied, check SCPs, boundaries, roles, resource policies, KMS keys, and service roles before granting broad admin access.
5. Return to source of truth. Manual emergency changes should be reconciled back into IaC, parameters, policy, or automation.
6. Automate repeated incidents carefully. EventBridge, Systems Manager Automation, Lambda, and Step Functions must be idempotent, scoped, observable, and safe to retry.

Failure-mode map

Deployment strategy chooser

Deployment strategy traps

IaC and drift control

IaC and account-governance chooser

Observability and response map

Monitoring traps

Security and compliance chain

    flowchart TD
	  R["Deployment or automation request"] --> O["Org guardrail: SCP?"]
	  O --> B["Boundary or session policy?"]
	  B --> I["Deployment role identity policy?"]
	  I --> P["Target resource policy?"]
	  P --> K["KMS key policy, grant, or secret access?"]
	  K --> L["CloudTrail, Config, Security Hub, or log evidence?"]

Use this chain for access-denied and compliance questions. A pipeline can have an IAM allow and still fail because an SCP, permission boundary, resource policy, KMS key policy, secret policy, or service role is missing.

Common traps and better instincts

Final 15-minute review

Practice fit

Use IT Mastery for the exact product route, practice status, spaced review when available, and close-answer explanation practice as coverage expands.

Decision order

DevOps Pro questions reward automation with guardrails: source of truth, progressive delivery, telemetry, rollback, and scoped permissions.