AWS DOP-C02 30-, 60-, and 90-day study plan for deployment, monitoring, recovery, review loops, and final-week priorities.
Use this study plan when you want a structured route through AWS Certified DevOps Engineer - Professional (DOP-C02). DOP-C02 is not only a CI/CD exam. It tests whether you can provision, operate, monitor, recover, secure, and continuously improve distributed systems on AWS.
AWS’s current exam guide keeps DOP-C02 in the DevOps engineer lane: delivery systems, infrastructure automation, monitoring, event response, resilience, and operational security. The best answers usually preserve source of truth, promote immutable artifacts, automate with guardrails, observe the right signal, roll back safely, and prove the fix worked.
I verified these current AWS exam facts on May 17, 2026.
| Item | Value |
|---|---|
| Exam | AWS Certified DevOps Engineer - Professional |
| Exam code | DOP-C02 |
| Category | Professional |
| Questions | 75 total |
| Scoring | 65 scored + 10 unscored (unscored items are not identified) |
| Question types | Multiple choice and multiple response |
| Time | 180 minutes |
| Passing score | 750, scaled 100-1000 |
| Cost | 300 USD |
| Target candidate | 2+ years provisioning, operating, and managing AWS environments; experience with SDLC and programming or scripting |
AWS lists advanced networking, deep database performance optimization, full-stack application coding, and deep security recommendations to developers as out of scope for the target candidate. Use that as a study guardrail: DOP-C02 is about AWS DevOps operating patterns, not every adjacent engineering discipline.
| Domain | Weight | How to allocate study time |
|---|---|---|
| SDLC Automation | 22% | Spend the most time on CI/CD pipelines, testing gates, artifacts, approvals, deployment strategies, runtime fit, and rollback. |
| Configuration Management and IaC | 17% | Study CloudFormation, CDK, reusable components, StackSets, account onboarding, drift, desired state, and large-scale configuration automation. |
| Security and Compliance | 17% | Drill IAM at scale, pipeline roles, KMS, secrets, SCPs, Config, Security Hub, CloudTrail, audit evidence, and automated guardrails. |
| Resilient Cloud Solutions | 15% | Practice HA, scaling, self-healing, backup, restore, RTO/RPO, failover, health checks, and recovery validation. |
| Monitoring and Logging | 15% | Learn metrics, logs, traces, dashboards, alarms, anomaly detection, retention, ownership, and actionable telemetry. |
| Incident and Event Response | 14% | Drill EventBridge, AWS Health, runbooks, Systems Manager Automation, Step Functions, remediation, rollback, and troubleshooting order. |
The weights are close enough that you cannot safely ignore any domain. Hard DOP-C02 questions often combine several lanes: a failed canary with weak alarms, a StackSet failure with permissions, a drift issue with Config, or an incident workflow that needs rollback before remediation.
| Starting point | Typical study time | Best-fit timeline |
|---|---|---|
| You own AWS production pipelines and operations today | 55-80 hours | 30-60 days |
| You know AWS associate-level services but have limited DevOps ownership | 85-120 hours | 60 days |
| You are strong in DevOps tooling but newer to AWS operations | 100-140 hours | 60-90 days |
| You are new to both AWS operations and delivery automation | 140+ hours | 90 days before scheduling |
Choose the longer route if you have not debugged failed deployments, repaired infrastructure drift, designed alarms that drive action, or tied pipeline roles, KMS keys, secrets, and audit evidence into one delivery system.
Use one release-and-operations loop every week.
flowchart LR
S["Source of truth"] --> B["Build and test"]
B --> A["Artifact"]
A --> D["Deploy"]
D --> O["Observe"]
O --> R["Respond or roll back"]
R --> M["Miss rule"]
| Step | What to ask |
|---|---|
| Source of truth | Is the change controlled in code, template, configuration, policy, or pipeline definition? |
| Build and test | Which gate should catch the defect: unit, integration, security, policy, drift, performance, or approval? |
| Artifact | Is the tested artifact the same artifact promoted to production, and is it versioned and traceable? |
| Deploy | Which strategy fits the runtime and risk: rolling, canary, blue/green, immutable, Lambda alias shift, or container rollout? |
| Observe | Which metric, log, trace, event, dashboard, or alarm proves health or failure? |
| Respond or roll back | Should the system notify, queue, automate, contain, remediate, restore, or roll back first? |
You do not need a huge lab, but you should be able to explain these paths without guessing:
| Path | What you should know |
|---|---|
| CI/CD pipeline | Source, build, test, artifact, approval, cross-account promotion, deployment strategy, observability, and rollback |
| IaC lifecycle | Template/module, parameters, secrets, change set, stack events, drift detection, StackSets, rollback state, and recovery |
| Deployment strategy | Rolling, canary, blue/green, immutable, Lambda alias shift, container rollout, alarms, and blast-radius control |
| Observability | Metrics, logs, traces, dashboards, alarms, anomaly detection, retention, ownership, and actionability |
| Incident response | Event source, routing, human checkpoint, bounded automation, containment, evidence, remediation, and validation |
| Security control | Least-privilege pipeline roles, STS, KMS access, secrets rotation, SCPs, Config, CloudTrail, and compliance evidence |
Use this route only if you already work with AWS delivery or operations.
| Week | Focus | What to produce |
|---|---|---|
| 1 | SDLC automation | A pipeline decision table covering source, build, test, artifacts, promotion, approvals, runtime-specific deployment strategy, health checks, and rollback. |
| 2 | IaC and configuration management | A desired-state checklist for CloudFormation, CDK, StackSets, Service Catalog, Control Tower, drift, parameters, secrets, and account baselines. |
| 3 | Resilience, monitoring, and event response | A runbook map connecting alarms, dashboards, traces, EventBridge, Systems Manager, Step Functions, rollback, restore, and recovery evidence. |
| 4 | Security, compliance, and mixed review | A control matrix for pipeline roles, KMS, Secrets Manager, SCPs, Config, Security Hub, GuardDuty, CloudTrail, audit logs, and deployment guardrails. |
Every study day should create one concrete artifact.
| Artifact | Why it matters |
|---|---|
| Release path sketch | Forces source-of-truth, testing, artifact, deployment, observability, and rollback decisions into one flow. |
| Failure triage checklist | Prevents vague “check logs” answers and builds sequence discipline. |
| IaC recovery note | Helps with stack rollback, drift, parameter, dependency, quota, and permission questions. |
| Automation safety rule | Keeps remediation scoped, reversible, observable, and guarded by reliable signals. |
| Security evidence map | Separates preventive controls, detective controls, remediation history, and audit evidence. |
| Miss log | Turns plausible distractors into recognizable traps. |
This is the best default route for most candidates.
| Weeks | Focus | What to do |
|---|---|---|
| 1-2 | SDLC Automation | Study CI/CD pipelines, source stages, automated tests, security gates, artifacts, ECR/CodeArtifact, approvals, deployment strategies, and rollback. |
| 3 | Configuration Management and IaC | Drill CloudFormation, CDK, SAM, modules, StackSets, drift, parameters, secrets, Control Tower, Organizations, and configuration automation. |
| 4 | Resilient Cloud Solutions | Study Multi-AZ, self-healing, scaling, health checks, backup, restore, RTO/RPO, failover, and tested recovery. |
| 5 | Monitoring and Logging | Drill metrics, custom metrics, log collection, X-Ray, dashboards, alarms, anomaly detection, retention, and automated event management. |
| 6 | Incident and Event Response | Practice EventBridge patterns, AWS Health, SNS/SQS, Step Functions, Systems Manager Automation, Config remediation, and troubleshooting order. |
| 7 | Security and Compliance | Drill IAM at scale, permissions boundaries, cross-account roles, KMS, Secrets Manager, SCPs, Config, Security Hub, CloudTrail, and audit evidence. |
| 8 | Mixed practice and final repair | Run timed sets, group misses by lifecycle stage, review the cheat sheet, answer sample questions, and schedule only if misses are narrow. |
Use this route if you are building professional-level AWS operations judgment while studying.
| Phase | Weeks | Outcome |
|---|---|---|
| Delivery foundation | 1-3 | You can design a pipeline from source to production with testing, artifacts, approvals, deployment strategy, rollback, and auditability. |
| Infrastructure foundation | 4-5 | You can manage IaC lifecycle, cross-account provisioning, drift, secrets, desired state, and safe configuration changes. |
| Reliability and observability | 6-8 | You can connect health checks, scaling, backups, dashboards, alarms, traces, event routing, and incident workflows to recovery objectives. |
| Security and operations | 9-10 | You can enforce least privilege, rotate secrets, audit changes, validate compliance, and automate safe remediation. |
| Exam execution | 11-12 | You can answer mixed professional scenarios under time pressure and explain why distractors are incomplete. |
| Domain | Drill questions until you can answer… |
|---|---|
| SDLC Automation | Which stage should catch the failure, and what proves the released artifact is the tested artifact? |
| Configuration Management and IaC | Should you change the stack, parameter, module, account baseline, policy, automation document, or desired-state control? |
| Resilient Cloud Solutions | Does the design meet the stated failure domain, RTO, RPO, scaling, self-healing, and rollback expectation? |
| Monitoring and Logging | What signal is missing: metric, log, trace, event, dashboard, alarm, anomaly detection, retention, or owner? |
| Incident and Event Response | Should the response notify a human, queue work, run bounded automation, roll back, restore, or preserve evidence first? |
| Security and Compliance | Which control is blocking or missing: IAM, SCP, key policy, secret rotation, Config rule, CloudTrail, Security Hub, or audit boundary? |
| Decision | Choose by asking… |
|---|---|
| Pipeline fix vs manual fix | Does the requirement need repeatability, audit, rollback, and prevention of future drift? |
| CodePipeline vs CodeBuild vs CodeDeploy | Is the need orchestration, build/test execution, or deployment control? |
| ECR vs CodeArtifact | Is the artifact a container image or package/dependency artifact? |
| Canary vs blue/green vs rolling | What blast radius, validation signal, runtime, and rollback speed does the scenario require? |
| CloudFormation change set vs drift detection | Are you previewing a planned change or finding unmanaged change after the fact? |
| StackSets vs copied stacks | Do you need governed multi-account or multi-Region deployment? |
| CloudWatch alarm vs EventBridge rule | Is the trigger a metric threshold/state change or an event pattern? |
| Systems Manager Automation vs Lambda | Do you need an approved operational runbook with controlled steps or custom event code? |
| Config rule vs Security Hub finding | Is the need resource compliance evaluation or aggregated security posture/finding workflow? |
Do not turn DOP-C02 into the wrong exam.
| Do not over-study… | Learn this instead |
|---|---|
| Advanced routing and network failover algorithms | Network knowledge needed to deploy, observe, and operate AWS workloads safely |
| Deep database query and performance optimization | Operational fit: backups, monitoring, scaling, failover, and deployment impact |
| Full-stack application coding | Scripting, pipeline logic, release behavior, test automation, and operational troubleshooting |
| Security architecture consulting | Implementing automated controls, least privilege, secrets, audit trails, and compliance validation |
| Generic DevOps slogans | Concrete AWS control planes, signals, rollback paths, and evidence |
Use the final week for decision speed and explanation quality.
| Day | Work |
|---|---|
| 7 days out | Reread the cheat sheet and map every domain to one or two failure modes. |
| 6 days out | Drill pipeline, artifact, approval, test-gate, deployment, and rollback scenarios. |
| 5 days out | Drill IaC, CloudFormation/CDK, StackSets, drift, account onboarding, configuration automation, and cross-account deployment. |
| 4 days out | Drill monitoring, logging, dashboards, alarms, traces, anomaly detection, event routing, and retention. |
| 3 days out | Drill resilience, scaling, backup, failover, RTO/RPO, self-healing, and recovery validation. |
| 2 days out | Drill incident response, EventBridge, Systems Manager Automation, Step Functions, Config remediation, IAM, KMS, secrets, SCPs, and audit evidence. |
| 1 day out | Review only weak rules, domain weights, current facts, high-yield comparisons, and exam logistics. |
You are close to ready when:
This is not ideal for a professional-level exam, but if you are already near-ready:
Schedule only when your misses are narrow and explainable. If your explanations still sound like generic DevOps slogans, keep studying. DOP-C02 rewards concrete AWS operating patterns: source of truth, automated gates, safe rollout, evidence, remediation, and governance.