AWS Certified DevOps Engineer Professional Practice Exam

The AWS Certified DevOps Engineer - Professional certification validates your ability to provision, operate, and manage distributed application systems on the Amazon Web Services (AWS) platform. This globally recognized credential demonstrates your proficiency in implementing continuous delivery systems, automating infrastructure deployments, and enforcing security best practices, making you a valuable asset to any organization leveraging the power of AWS.

Who should consider this exam?

• Individuals with at least 2 years of experience provisioning, operating, and managing AWS environments.
• Professionals with a solid understanding of development, operations, and DevOps principles.
• Anyone seeking to validate their expertise in implementing and managing continuous delivery systems on AWS.

Roles and Responsibilities

• Design, deploy, and manage distributed applications on AWS.
• Automate infrastructure provisioning and configuration management.
• Monitor and optimize application performance and resource utilization.
• Implement and enforce security controls and compliance requirements.
• Collaborate effectively with development, security, and operations teams.

Exam details

• Format: 50-65 multiple-choice and multiple-select questions
• Time Limit: 180 minutes
• Languages: English, Japanese, Korean (other languages offered periodically)
• Passing Score: 75%

AWS Certified DevOps Engineer Professional Course Outline 

The AWS DevOps Engineer Professional (DOP-C02) Exam covers the following topics - 

Module 1: Understanding SDLC Automation (22%)

1.1: Implement CI/CD pipelines.

• Configuring code, image, and artifact repositories
• Using version control to integrate pipelines with application environments
• Setting up build processes (for example, AWS CodeBuild)
• Managing build and deployment secrets (for example, AWS Secrets Manager, AWS Systems Manager Parameter Store)
• Determining appropriate deployment strategies (for example, AWS CodeDeploy)

1.2: Integrate automated testing into CI/CD pipelines.

• Running builds or tests when generating pull requests or code merges (for example, AWS CodeCommit, CodeBuild)
• Running load/stress tests, performance benchmarking, and application testing at scale
• Measuring application health based on application exit codes
• Automating unit tests and code coverage
• Invoking AWS services in a pipeline for testing

1.3 Build and manage artifacts.

• Creating and configuring artifact repositories (for example, AWS CodeArtifact, Amazon S3, Amazon Elastic Container Registry [Amazon ECR])
• Configuring build tools for generating artifacts (for example, CodeBuild, AWS Lambda)
• Automating Amazon EC2 instance and container image build processes (for example, EC2 Image Builder)

1. 4: Implement deployment strategies for instance, container, and serverless environments.

• Configuring security permissions to allow access to artifact repositories (for example, AWS Identity and Access Management [IAM], CodeArtifact)
• Configuring deployment agents (for example, CodeDeploy agent)
• Troubleshooting deployment issues
• Using different deployment methods (for example, blue/green, canary)

Module 2: Understanding Configuration Management and IaC (17%)

2.1 Define cloud infrastructure and reusable components to provision and manage systems throughout their lifecycle.

• Composing and deploying IaC templates (for example, AWS Serverless Application Model [AWS SAM], AWS CloudFormation, AWS Cloud Development Kit [AWS CDK])
• Applying AWS CloudFormation StackSets across multiple accounts and AWS Regions
• Determining optimal configuration management services (for example, AWS OpsWorks, AWS Systems Manager, AWS Config, AWS AppConfig)
• Implementing infrastructure patterns, governance controls, and security standards into reusable IaC templates (for example, AWS Service Catalog, CloudFormation modules, AWS CDK)

2.2 Deploy automation to create, onboard, and secure AWS accounts in a multiaccount/multi-Region environment.

• Standardizing and automating account provisioning and configuration
• Creating, consolidating, and centrally managing accounts (for example, AWS Organizations, AWS Control Tower)
• Applying IAM solutions for multi-account and complex organization structures (for example, SCPs, assuming roles)
• Implementing and developing governance and security controls at scale (AWS Config, AWS Control Tower, AWS Security Hub, Amazon Detective, Amazon GuardDuty, AWS Service Catalog, SCPs)

2. 3: Design and build automated solutions for complex tasks and large-scale environments.

• Automating system inventory, configuration, and patch management (for example, Systems Manager, AWS Config)
• Developing Lambda function automations for complex scenarios (for example, AWS SDKs, Lambda, AWS Step Functions)
• Automating the configuration of software applications to the desired state (for example, OpsWorks, Systems Manager State Manager)
• Maintaining software compliance (for example, Systems Manager)

Module 3: Understanding Resilient Cloud Solutions (15%)

3.1 Implement highly available solutions to meet resilience and business requirements.

• Translating business requirements into technical resiliency needs
• Identifying and remediating single points of failure in existing workloads
• Enabling cross-Region solutions where available (for example, Amazon DynamoDB, Amazon RDS, Amazon Route 53, Amazon S3, Amazon CloudFront)
• Configuring load balancing to support cross-AZ services
• Configuring applications and related services to support multiple Availability Zones and Regions while minimizing downtime

3.2 Implement solutions that are scalable to meet business requirements.

• Identifying and remediating scaling issues
• Identifying and implementing appropriate auto scaling, load balancing, and caching solutions
• Deploying container-based applications (for example, Amazon ECS, Amazon EKS)
• Deploying workloads in multiple AWS Regions for global scalability
• Configuring serverless applications (for example, Amazon API Gateway, Lambda, AWS Fargate)

3.3 Implement automated recovery processes to meet RTO/RPO requirements.

• Testing failover of Multi-AZ/multi-Region workloads (for example, Amazon RDS, Amazon Aurora, Route 53, CloudFront)
• Identifying and implementing appropriate cross-Region backup and recovery strategies (for example, AWS Backup, Amazon S3, Systems Manager)
• Configuring a load balancer to recover from backend failure

Module 4: Monitoring and Logging

4.1 Configure the collection, aggregation, and storage of logs and metrics.

• Securely storing and managing logs
• Creating CloudWatch metrics from log events by using metric filters
• Creating CloudWatch metric streams (for example, Amazon S3 or Amazon Kinesis Data Firehose options)
• Collecting custom metrics (for example, using the CloudWatch agent)
• Managing log storage lifecycles (for example, S3 lifecycles, CloudWatch log group retention)
• Processing log data by using CloudWatch log subscriptions (for example, Kinesis, Lambda, Amazon OpenSearch Service)
• Searching log data by using filter and pattern syntax or CloudWatch Logs Insights
• Configuring encryption of log data (for example, AWS KMS)

4.2 Audit, monitor, and analyze logs and metrics to detect issues.

● Building CloudWatch dashboards and Amazon QuickSight visualizations

● Associating CloudWatch alarms with CloudWatch metrics (standard and custom)

● Configuring AWS X-Ray for different services (for example, containers, API Gateway, Lambda)

● Analyzing real-time log streams (for example, using Kinesis Data Streams)

● Analyzing logs with AWS services (for example, Amazon Athena, CloudWatch Logs Insights)

4.3 Automate monitoring and event management of complex environments.

• Configuring solutions for auto scaling (for example, DynamoDB, EC2 Auto Scaling groups, RDS storage auto scaling, ECS capacity provider)
• Creating CloudWatch custom metrics and metric filters, alarms, and notifications (for example, Amazon SNS, Lambda)
• Configuring S3 events to process log files (for example, by using Lambda), and deliver log files to another destination (for example, OpenSearch Service, CloudWatch Logs) Configuring EventBridge to send notifications based on a particular event pattern
• Installing and configuring agents on EC2 instances (for example, AWS Systems Manager Agen [SSM Agent], CloudWatch agent)
• Configuring AWS Config rules to remediate issues
• Configuring health checks (for example, Route 53, Application Load Balancer)

Module 5: Incident and Event Response

5.1 Manage event sources to process, notify, and take action in response to events.

• Integrating AWS event sources (for example, AWS Health, EventBridge, CloudTrail, CloudWatch Events)
• Building event processing workflows (for example, Amazon Simple Queue Service [Amazon SQS], Kinesis, Amazon SNS, Lambda, Step Functions)

5.2 Implement configuration changes in response to events.

• Applying configuration changes to systems
• Modifying infrastructure configurations in response to events
• Remediating a non-desired system state

5.3 Troubleshoot system and application failures.

• Analyzing failed deployments (for example, AWS CodePipeline, CodeBuild, CodeDeploy, CloudFormation, CloudWatch synthetic monitoring)
• Analyzing incidents regarding failed processes (for example, auto scaling, Amazon ECS, Amazon EKS)

Module 6: Security and Compliance

6.1 Implement techniques for identity and access management at scale.

• Designing policies to enforce least privilege access
• Implementing role-based and attribute-based access control patterns
• Automating credential rotation for machine identities (for example, Secrets Manager)
• Managing permissions to control access to human and machine identities (for example, enabling multi-factor authentication [MFA], AWS Security Token Service [AWS STS], IAM profiles)

6.2 Apply automation for security controls and data protection.

• Automating the application of security controls in multi-account and multi-Region environments (for example, Security Hub, Organizations, AWS Control Tower, Systems Manager)
• Combining security controls to apply defense in depth (for example, AWS Certificate Manager [ACM], AWS WAF, AWS Config, AWS Config rules, Security Hub, GuardDuty, security groups, network ACLs, Amazon Detective, Network Firewall)
• Automating the discovery of sensitive data at scale (for example, Amazon Macie)
• Encrypting data in transit and data at rest (for example, AWS KMS, AWS CloudHSM, ACM)

6.3 Implement security monitoring and auditing solutions.

• Implementing robust security auditing\
• Configuring alerting based on unexpected or anomalous security events
• Configuring service and application logging (for example, CloudTrail, CloudWatch Logs)
• Analyzing logs, metrics, and security findings