DOP-C02 syllabus: every exam domain and topic

DOP-C02 is about automating delivery and operations across many accounts: pipelines, infrastructure as code, observability and automated response. This outline lists what each domain expects, in plain terms. Tick topics off as you cover them. Your ticks are saved in this browser.

This outline follows the official DOP-C02 exam guide. Check it for the exact wording.

SDLC automation

22%

Building, testing and releasing software automatically, safely, and across accounts. This is the largest domain.

CI/CD pipelines

CodePipeline stages, actions, artifacts, variables and pipeline triggers
Git sources through AWS CodeConnections, and CodeCommit
CodeBuild buildspec phases, environment variables from Parameter Store and Secrets Manager, caching, builds inside a VPC
Cross-account and cross-Region pipelines: artifact buckets, KMS keys and assumed roles
Manual approval actions and notifications

Testing and quality gates

Unit, integration and load tests as pipeline stages
CodeBuild test and code coverage reports
Stopping a release automatically on failed tests or alarms

Artifacts

CodeArtifact domains, repositories, upstreams and external connections
Amazon ECR: image scanning, lifecycle policies, replication
Versioning and promoting the same artifact through environments

Deployment strategies

CodeDeploy for EC2 and on-premises: in-place and blue/green, AppSpec lifecycle hooks
CodeDeploy for Lambda and ECS: canary, linear and all-at-once traffic shifting
Automatic rollback on failed deployments and CloudWatch alarms
Elastic Beanstalk deployment policies and environment URL swaps
Blue/green with Route 53 weighted records or ALB weighted target groups

Read the notes Practise this domain

Configuration management and IaC

17%

Defining infrastructure and configuration as code, and running it at the scale of an organization.

AWS CloudFormation

Change sets, drift detection, stack policies and termination protection
DeletionPolicy, UpdateReplacePolicy, CreationPolicy and UpdatePolicy
cfn-init, cfn-signal and cfn-hup
Nested stacks vs cross-stack references
Custom resources, macros and transforms
StackSets with self-managed and service-managed permissions
Rollback triggers, and recovering from UPDATE_ROLLBACK_FAILED

AWS CDK and AWS SAM

CDK constructs, synth, diff, deploy and bootstrapping
CDK Pipelines
SAM templates and gradual Lambda deployments

Multi-account foundations

AWS Organizations, OUs and service control policies
AWS Control Tower: landing zone, controls, Account Factory
AWS Service Catalog portfolios and launch constraints
AWS Resource Access Manager

Fleet configuration with Systems Manager

Run Command, State Manager and Automation runbooks
Patch Manager, patch baselines and maintenance windows
Session Manager instead of SSH
Parameter Store and AWS AppConfig feature flags
Inventory and compliance reporting

Read the notes Practise this domain

Resilient cloud solutions

15%

Keeping workloads available and scalable, and recovering automatically.

High availability

Multi-AZ and multi-Region designs
Route 53 health checks and failover routing
Aurora Global Database, DynamoDB global tables, S3 replication
Amazon Application Recovery Controller and zonal shift

Scaling

Auto Scaling policies, lifecycle hooks, warm pools and instance refresh
ECS service auto scaling and capacity providers
Lambda reserved and provisioned concurrency
Caching and throttling with API Gateway, CloudFront and ElastiCache

Disaster recovery automation

DR strategies by RTO and RPO
AWS Backup across Regions and accounts
AWS Elastic Disaster Recovery
Testing failure with AWS Fault Injection Service

Read the notes Practise this domain

Monitoring and logging

15%

Collecting, centralising and analysing metrics, logs and traces.

Metrics and alarms

CloudWatch metrics, custom and high-resolution metrics, metric math
CloudWatch agent for memory, disk and logs
Composite alarms and anomaly detection
Embedded Metric Format

Logs

Log groups, retention, metric filters and Logs Insights
Subscription filters to Lambda, Kinesis, Firehose and OpenSearch
Centralising logs across accounts
CloudTrail trails, organization trails and log file validation
VPC Flow Logs and load balancer access logs

Tracing and application monitoring

AWS X-Ray traces, sampling, annotations and metadata
AWS Distro for OpenTelemetry
CloudWatch Synthetics, Container Insights and Lambda Insights
Cross-account observability in CloudWatch

Read the notes Practise this domain

Incident and event response

14%

Detecting problems, notifying the right people and fixing issues automatically.

Event-driven automation

EventBridge rules, cross-account event buses, archive and replay
Remediation with Lambda, Step Functions and Systems Manager Automation
AWS Health events and notifications
AWS Config rules with automatic remediation

Troubleshooting

Failed deployments in CodeDeploy, CloudFormation and Elastic Beanstalk
Auto Scaling launch failures and lifecycle hook timeouts
Lambda retries, dead-letter queues and destinations
Root cause analysis with Logs Insights, X-Ray and Amazon DevOps Guru

Read the notes Practise this domain

Security and compliance

17%

Identity, secrets, detection and compliance controls applied across an organization.

Identity and access at scale

IAM roles, permission boundaries and attribute-based access control
IAM Identity Center for workforce access
IAM Access Analyzer: external access, unused access, policy validation
Least-privilege roles for pipelines and deployments

Data and secrets

Secrets Manager rotation and cross-account access
KMS key policies, grants and multi-Region keys
Encryption of pipeline artifacts, logs and backups

Detection and compliance

Security Hub standards and aggregated findings
GuardDuty, Inspector and Macie across the organization
AWS Config conformance packs and aggregators
AWS Firewall Manager for WAF, Shield Advanced and security groups
AWS Audit Manager evidence collection

Read the notes Practise this domain