15 Free AWS DevOps Engineer Professional (DOP-C02) Practice Questions with Answers (2026)

The buildspec can pull values from Secrets Manager at build time, so the secret never sits in the project configuration or the repository. The service role controls who can read it.

• B puts secret material in source control and adds key handling to the build.
• C still exposes the value as plain configuration in the pipeline.
• D moves the plaintext value into the buildspec, which is usually in the repository.

Cross-account CodePipeline deployments need a customer managed key, because you cannot edit the key policy of an AWS managed key to grant another account. The bucket policy and a role in the target account complete the access path.

• A speeds up transfers. It does nothing for permissions.
• C exposes build artifacts publicly, which is a security failure.
• D removes encryption at rest and still does not grant the production account access to the bucket.

Service-managed StackSets integrate with Organizations. With automatic deployment on, any account that joins the target OU gets the stack without anyone touching it.

• A relies on each team launching the product, which is a manual step.
• B needs the admin and execution roles set up in each account, and new accounts are not added automatically.
• C deploys Config rules and remediation actions for compliance checks. It is not the tool for provisioning a baseline IAM role and SNS topic.

UpdateReplacePolicy controls what happens to the old physical resource when an update replaces it. Snapshot takes a final snapshot before the old instance is removed.

• A applies when the resource is removed from the template or the stack is deleted, not when it is replaced during an update.
• C only stops the whole stack from being deleted.
• D blocks the replacement, but the team wants the replacement to go ahead.

State Manager keeps instances in a defined state. Associations that target a tag apply to new matching instances and reapply on their schedule, which corrects drift.

• B runs once, so new instances and later drift are missed.
• C runs at first boot only, so it does not fix drift.
• D depends on a person remembering to run it.

Aurora global database replicates storage to secondary Regions with typical lag under one second and supports managed failover, so it meets both objectives with little extra work.

• A protects against an Availability Zone failure, not a Regional one.
• B gives a recovery point of up to a day.
• D could work but adds a replication task and a database server to run, which is more overhead.

The grace period tells Auto Scaling to wait before acting on health check results for a new instance. Setting it longer than the start-up time stops the replace loop.

• B hides real application failures, because EC2 checks only see instance status.
• C affects how long draining instances keep connections. It has no effect on new instances.
• D controls idle connection time, not health evaluation.

Cross-account observability links source accounts to a monitoring account, which can then query logs and view metrics and traces in place. No data is copied.

• A copies logs in batches, which the team wants to avoid.
• B streams metrics only, not logs.
• C records API activity, not application logs or metrics.

A metric filter turns matching log events into a CloudWatch metric with no code to run, and an alarm on that metric does the rest.

• A adds export jobs and queries, and still needs something to raise the alarm.
• C works but adds a function to build and maintain.
• D detects unusual API activity, not application errors.

AWS Health publishes scheduled retirement events to EventBridge. A rule can start an Automation runbook that stops and starts the instance on new hardware.

• A reacts after a system check fails. A scheduled retirement is known in advance and may not cause a failed check first.
• B is a report that needs a person to act.
• D records API calls. It does not take any action.

ContinueUpdateRollback resumes the rollback, and you can tell CloudFormation to skip resources it cannot roll back. The stack then returns to UPDATE_ROLLBACK_COMPLETE and can be updated.

• A only works while an update is in progress, not after the rollback has failed.
• B cannot run an update while the stack is in a failed rollback state.
• C deletes the stack, which the team wants to avoid and which may remove data.

An SCP sets the maximum permissions for every principal in member accounts, including administrators and the account root user. A deny in the SCP cannot be overridden by IAM policies in those accounts.

• A detects the change after it happens. It does not prevent it.
• B must be applied to each principal and can be removed by anyone with enough IAM rights.
• D detects threats. It does not block API calls.

Requiring a permissions boundary on every role developers create caps that role's effective permissions, so developers can work alone without escalating privileges.

• A blocks role creation completely, which defeats the goal.
• C allows any privilege and only spots misuse later.
• D gives advice. It does not enforce a limit.

An organization-level Access Analyzer reviews resource policies and creates findings for any resource shared with a principal outside the organization. It updates when policies change.

• B scans workloads for software vulnerabilities and network exposure, not external sharing through resource policies.
• C covers a fixed set of checks and does not analyse cross-account access across these resource types.
• D finds sensitive data in S3, not who can access resources.