Read this the night before or on exam morning. It assumes you’ve studied the notes. It’s here to refresh, not to teach.
Exam day
- 75 questions in 180 minutes: 65 scored and 10 unscored trial questions you can’t spot. Scaled score out of 1,000; you need 750.
- About 2.4 minutes per question. No penalty for wrong answers, so never leave one blank. Flag and move on.
- Domain weights: SDLC automation 22%, configuration management and IaC 17%, security and compliance 17%, resilient cloud solutions 15%, monitoring and logging 15%, incident and event response 14%.
How to read a DOP question
Read the last sentence first (the actual ask), then hunt for the constraint words:
| The question says | Pick |
|---|---|
| Least operational overhead, most maintainable | The managed service with native integration. No custom scripts, cron jobs or servers to patch |
| Most secure | IAM roles (temporary credentials), private connectivity (VPC endpoints), least privilege |
| Near real time | Event-driven (EventBridge, subscription filters), not scheduled polling |
| Existing and future resources or accounts | AWS Config rules (they evaluate existing resources) or StackSets with automatic deployment — not a one-off script or an on-create event |
| Across the organization | Organizations + a delegated administrator + the service’s organization feature |
| Cost-effective | The cheapest option that still meets the stated RTO and RPO |
Elimination tricks
- Answers that mention features that don’t exist (“S3 basic auth”, “IPv6 Elastic IP”, “custom CodeDeploy environment variables”) are wrong.
- Answers needing SSH into instances or manual steps are almost always wrong.
- OpsWorks reached end of life in 2024, so it’s only “right” in old questions.
- In Choose TWO/THREE questions, each pick should be a different piece of the same solution (create a role + create a group that can assume it), not two alternative solutions.
Hook orders
CodeDeploy, EC2 in-place: ApplicationStop → DownloadBundle → BeforeInstall → Install → AfterInstall → ApplicationStart → ValidateService
With a load balancer: BeforeBlockTraffic → BlockTraffic → AfterBlockTraffic → (the above) → BeforeAllowTraffic → AllowTraffic → AfterAllowTraffic
ECS blue/green: BeforeInstall → AfterInstall → AfterAllowTestTraffic → BeforeAllowTraffic → AfterAllowTraffic
Lambda: BeforeAllowTraffic → AfterAllowTraffic
CodeBuild: install → pre_build → build → post_build
Deployment options at a glance
| Need | Choose |
|---|---|
| Gradual Lambda release with automatic rollback | CodeDeploy canary/linear + CloudWatch alarms (SAM DeploymentPreference) |
| ECS release tested before production traffic | CodeDeploy blue/green with a test listener |
| Beanstalk, full capacity, quick rollback | Immutable or traffic splitting |
| Beanstalk zero-downtime environment swap | Blue/green with environment URL swap |
| Instant traffic shift without DNS caching | ALB weighted target groups |
| Roll a new AMI through an ASG | Instance refresh, or CloudFormation UpdatePolicy |
CloudFormation one-liners
- Change set: preview. Drift detection: find manual changes. Stack policy: protect resources from updates.
- DeletionPolicy
Retain/Snapshot: keep data when the resource leaves the stack. - CreationPolicy + cfn-signal: don’t mark instances complete until software is installed.
- cfn-hup: re-apply metadata changes without replacing instances.
- Nested stacks: reuse inside one deployment. Exports/ImportValue: share between independent stacks.
- StackSets, service-managed, auto-deploy: every account in an OU, including new ones.
- UPDATE_ROLLBACK_FAILED: fix it, then continue update rollback (skip resources).
Numbers worth knowing
| Thing | Number |
|---|---|
| Lambda async retries | 2 (3 attempts total) |
| Lifecycle hook default timeout | 1 hour (extend with heartbeats) |
| CloudWatch Logs subscription filters per log group | 2 |
| EC2 basic / detailed monitoring | 5 minutes / 1 minute |
| High-resolution custom metrics | Down to 1 second |
| SQS message retention | Up to 14 days |
| Kinesis Data Streams retention | 24 hours default, up to 365 days |
| X-Ray default sampling | First request each second, then 5% |
Pairs people mix up
| A | B | The difference |
|---|---|---|
| Run Command | State Manager | Once, now / continuously enforced |
| Automation runbook | Run Command | Multi-step workflows on resources / a command on instances |
| Parameter Store | AppConfig | Store values / deploy config gradually with validation and rollback |
| Metric filter | Subscription filter | Logs → metric / logs → stream to another service |
| Log export to S3 | Firehose subscription | Batch, delayed / continuous |
| X-Ray annotation | X-Ray metadata | Indexed, filterable / not indexed |
| SCP | Permission boundary | Caps an account / caps one role or user |
| Nested stack | Cross-stack export | One lifecycle / independent stacks |
| Composite alarm | Anomaly detection | Combine alarms / learned band on one metric |
| Service-managed StackSets | Self-managed StackSets | Organizations, auto-deploy / roles you create |
Defaults that are usually right
- EventBridge → Systems Manager Automation for operational remediation.
- AWS Config rule + automatic remediation for compliance drift.
- Delegated administrator + auto-enable for GuardDuty, Security Hub, Inspector, Macie.
- Organization trail into a log archive account with Object Lock.
- Customer managed KMS key whenever artifacts or secrets cross accounts.
- Session Manager instead of SSH; Patch Manager with maintenance windows instead of scripts.
- Alarms wired into every deployment so rollback doesn’t wait for a person.