Home › Certifications › DOP-C02 Certification Guide
AWS Certification Guide · 2026DOP-C02 Certification Guide 2026: AWS Certified DevOps Engineer – Professional
Everything about the DOP-C02 exam — all six domains and exact weightings, why no single domain exceeds 22%, the higher 750 pass mark, the 10 questions that do not count, how it compares with Microsoft's AZ-400, DevOps salary bands, and a 14-week roadmap.
Authorized Training & Technology Partners
DOP-C02 — AWS Certified DevOps Engineer – Professional
The credential this guide covers
DOP-C02 (AWS Certified DevOps Engineer – Professional) is the top tier of AWS's DevOps track. Six domains, 75 questions in 180 minutes, and you need 750 out of 1000 — a higher bar than the 720 required at associate level. Only 65 of the 75 questions are scored; 10 are unscored pilot items. And the defining characteristic: no domain is larger than 22%.
That flatness is the whole exam in one number, and it is the sharpest contrast in this entire guide series. Microsoft's equivalent, AZ-400, puts 50–55% of its exam into a single domain — build and release pipelines. AWS spreads DOP-C02 across six domains that range from 14% to 22%. The two certifications hold genuinely different views of what a DevOps engineer is.
DOP-C02 exam at a glance
| Attribute | Detail |
|---|---|
| Exam code | DOP-C02 — AWS Certified DevOps Engineer – Professional |
| Level | Professional — AWS's highest role-based tier |
| Questions | 75 total — 65 scored, 10 unscored pilot items, not identified during the exam |
| Duration | 180 minutes |
| Scoring | Scaled 100–1,000; minimum passing score 750 — higher than the 720 at associate level |
| Domains | Six, weighted 22 / 17 / 17 / 15 / 15 / 14 |
| Cost | US$300 |
| Validity | 3 years |
| Prerequisites | None enforced. AWS recommends 2 or more years provisioning, operating and managing AWS environments |
| Also assumed | Software development lifecycle experience, plus programming or scripting ability |
| Exam guide version | Version 1.6, DOP-C02 |
What is the DOP-C02 certification?
AWS targets an experienced practitioner: someone with two or more years of hands-on experience provisioning, operating and managing AWS environments, who also understands the software development lifecycle and can program or script. That last requirement is the one people underestimate — this is not an operations exam you can pass without writing code.
The six domains cover CI/CD pipelines, configuration management and infrastructure as code, resilient cloud solutions, monitoring and logging, incident and event response, and security and compliance. Notice what that list is: it is the full lifecycle of a running system, not just the part that ships it.
The associate exams pass at 720. Professional exams pass at 750 on the same scaled 100–1,000 range. Combined with a flat blueprint where nothing is worth less than 14%, that means you cannot trade a strong domain against a weak one. On AZ-400 you can carry a poor security score on the strength of pipelines, because pipelines are half the exam. On DOP-C02 there is no domain big enough to carry you.
DOP-C02 domains and weightings
Six domains, spanning just eight percentage points from largest to smallest. This is the flattest blueprint in this guide series.
DOP-C02 exam blueprint — share of scored content by domain
Official AWS weightings, DOP-C02 exam guide version 1.6
Source: AWS Certified DevOps Engineer – Professional (DOP-C02) Exam Guide, version 1.6. Percentages are of scored content and total exactly 100%. Applied to the 65 scored questions: roughly 14 SDLC, 11 configuration, 11 security, 10 resilience, 10 monitoring and 9 incident-response questions.
How concentrated is each exam?
Now that this series covers all fifteen certifications, one comparison becomes possible that no single-vendor guide can make: how much of each exam rests on its single biggest domain. It is a good proxy for whether you can specialise or must be broad.
Share of the exam carried by its largest single domain
The four architecture and DevOps exams in this series, by blueprint concentration
Calculated by us from each vendor's published blueprint; Microsoft figures use range midpoints, AWS figures are exact. DOP-C02 is the least concentrated exam in the series — its biggest domain is smaller than the smallest domain on several others. AZ-400 is the most concentrated by a wide margin.
On AZ-400 the correct strategy is to pour more than half your time into pipelines, because that is more than half the exam. On DOP-C02 that strategy fails. Six domains between 14% and 22% means the efficient plan is even coverage and ruthless elimination of weak spots — the marks you lose are the ones you never studied, not the ones you studied least.
The six domains as flashcards
SDLC Automation
CI/CD pipelines: SDLC concepts, phases and models; pipeline deployment patterns for single- and multi-account environments. Configuring code, image and artifact repositories. Using version control to integrate pipelines with application environments. Setting up build processes with CodeBuild. Managing build and deployment secrets via Secrets Manager and Systems Manager Parameter Store. Determining deployment strategies with CodeDeploy. Then integrating automated testing into CI/CD.
22% · largest domainConfiguration Management and IaC
Defining cloud infrastructure as code, managing it across accounts and Regions, and handling drift. Reusable, composable templates and modules rather than copy-paste stacks. Multi-account provisioning at scale, and the account-vending patterns that make it manageable. This domain is where “it works in my account” stops being an acceptable answer.
17% of scored contentSecurity and Compliance
Identity and access management at scale, automated security controls, and compliance validation as a continuous process rather than an audit event. Secrets and credential handling inside pipelines. Tied with configuration management as the joint second-largest domain — and, as on SAA-C03, weighted far more heavily than candidates expect.
17% · joint secondResilient Cloud Solutions
Highly available, fault-tolerant and scalable architectures, and the deployment strategies that keep them available while changing: blue-green, canary and rolling releases. Designing to a stated RTO and RPO, and choosing a disaster recovery posture that matches the requirement rather than the budget you wish you had.
15% of scored contentMonitoring and Logging
Collecting, aggregating and analysing logs and metrics across accounts. Instrumenting applications for meaningful telemetry rather than volume. Auditing and traceability. Alerting that fires on the thing that matters instead of on everything. Together with incident response this is 29% of the exam — more than SDLC automation.
15% of scored contentIncident and Event Response
Event-driven automated actions, troubleshooting deployment and infrastructure failures, and automating remediation so the same incident does not require a human twice. The smallest domain at 14%, and the one that most clearly separates people who have been on call from people who have not.
14% · smallest domainWho DOP-C02 is actually for
- Engineers with two or more years running AWS environments — AWS's own recommendation, and the point below which the scenarios stop being answerable from reasoning alone.
- SAA-C03 holders moving from design into delivery — the conventional route, because DOP-C02 assumes associate-level architecture fluency without re-explaining it.
- Site reliability engineers — monitoring, logging, incident response and resilience together are 44% of this exam, which is squarely SRE territory.
- Platform engineers running multi-account estates — multi-account patterns appear in the very first task statement and recur throughout.
Where it will not carry you
- It is not an entry point. Professional tier, 750 to pass, two years of recommended experience, and programming or scripting assumed.
- You cannot specialise your way through it. Six near-equal domains means one neglected area is enough to fail.
- It is AWS-specific. The DevOps principles transfer to Azure or GCP; CodeBuild, CodeDeploy and Systems Manager do not.
What a professional-tier DevOps engineer earns
This is the most demanding credential in our AWS track, and the pay reflects the scarcity rather than the badge. Very few engineers can genuinely cover all six of these domains — and the ones who can are the people organisations trust with production.
The DevOps progression
Entry
Mid
Senior
Principal / Staff SRE
AWS DevOps engineer pay by market
India and the US shown as two separate charts, because rupee and dollar bands are different measures on different scales and should never share an axis.
India — annual CTC
AWS DevOps engineer and SRE roles, ₹ lakh per annum
Bar length maps the upper bound of each band against a ₹87 L scale. Bands compiled from published Indian AWS DevOps and SRE ranges, and sit above the general DevOps bands on our AZ-400 page because professional-tier AWS roles skew toward product companies and global capability centres.
United States — annual base
AWS DevOps engineer and SRE roles, US$ thousands
Bar length maps each figure against a $250K scale. Bands compiled from published US AWS DevOps engineer and site reliability engineer ranges; base pay only, excluding bonus, equity and on-call compensation.
These are role bands, not certification outcomes. No published figure attaches a salary increase to holding DOP-C02 alone. What is defensible is narrower and more useful: a professional-tier credential with a 750 pass mark and six near-equal domains is genuinely hard to obtain, so it functions as a credible filter — which is precisely why employers weight it more than an associate badge.
Compensation figures are compiled from independent, publicly available industry sources and are shown for role context. They are not a guarantee of pay in any specific market, company or outcome, and 360DT does not promise a salary result from any certification or programme.
Why DOP-C02 is the harder DevOps credential
1. Operations outweighs delivery
Monitoring and logging, incident and event response, and resilient cloud solutions together account for 44% of the exam — twice the weight of SDLC automation. AWS is asserting that a DevOps engineer is primarily someone who keeps systems running, and only secondarily someone who ships them. That is a defensible position, and it is the opposite emphasis to AZ-400.
2. Multi-account is assumed from the first task statement
The very first skills bullet under CI/CD pipelines names pipeline deployment patterns for single- and multi-account environments, and multi-account provisioning recurs through the configuration management domain. Single-account experience, however deep, leaves a visible gap here.
3. The pass mark is genuinely higher
750 rather than 720, across six domains where nothing is worth less than 14%. There is no domain large enough to compensate for a weak one. Professional tier is not a marketing label on this exam — the scoring structure enforces it.
4. Three-year validity makes it worth the effort
A hard exam you sit once every three years is a materially better investment than an easier one you renew annually. Against Microsoft's annual renewal for AZ-400, DOP-C02 costs more up front and considerably less to maintain.
Your 14-week DOP-C02 roadmap
Even coverage, because the blueprint is even — roughly two weeks per domain, plus dedicated weeks for building and for timed practice. Assume 8–10 hours per week. This plan assumes associate-level AWS fluency; if you do not have it, take SAA-C03 first.
CI/CD foundations
SDLC concepts, phases and models. Code, image and artifact repositories. Version control integrated with application environments. Build processes with CodeBuild. Deployment strategies with CodeDeploy. Build one working pipeline before you read about a second.
Pipelines at multi-account scale
Deployment patterns for single- and multi-account environments — the first task statement, and the one that separates professional from associate. Managing build and deployment secrets with Secrets Manager and Parameter Store. Then integrating automated testing into CI/CD. Completes the 22% domain.
Infrastructure as code
Defining cloud infrastructure as code. Reusable, composable templates and modules. Parameterisation and stack composition. Deploying the same definition into multiple accounts and Regions without forking it.
Configuration management and drift
Managing configuration across accounts and Regions. Detecting and remediating drift. Multi-account provisioning and account-vending patterns. Systems Manager for fleet configuration. Completes the 17% configuration domain.
Identity and access at scale
Cross-account roles and trust relationships. Permission boundaries and service control policies. Least privilege applied to pipelines and automation, not just to people — the CI/CD role is usually the most over-permissioned identity in an estate.
Automated security and compliance
Automated security controls and continuous compliance validation. Secrets and credential handling inside pipelines. Audit evidence produced as a by-product of the pipeline rather than assembled before an audit. Completes the 17% security domain.
Resilient architecture
Highly available, fault-tolerant and scalable design on AWS. Multi-AZ and multi-Region trade-offs. Designing to a stated RTO and RPO and choosing the disaster recovery posture that actually meets it.
Deploying without downtime
Blue-green, canary and rolling deployment strategies, and which risk profile each suits. Automated rollback triggers. Database changes alongside application changes — the part that breaks real releases. Completes the resilience domain.
Monitoring and instrumentation
Collecting and aggregating logs and metrics across accounts. Instrumenting applications for telemetry that answers questions rather than fills dashboards. Distributed tracing. Auditing and traceability requirements.
Alerting that works
Alarm design, composite alarms and thresholds that fire on the thing that matters. Log analysis and querying at volume. Metric filters and anomaly detection. Completes the monitoring domain — and prepares directly for the next one.
Event-driven response and auto-remediation
Event-driven automated actions. Troubleshooting failed deployments and failed infrastructure changes. Automating remediation so a recurring incident stops needing a human. Completes the sixth and final domain.
Build the whole thing once
One multi-account pipeline, end to end: infrastructure as code, automated tests, security scanning, canary deployment with automated rollback, cross-account roles, centralised logging, and an alarm that triggers an automated remediation. If you can build that, you have covered all six domains at once.
Timed practice, scored by domain
Full 75-question, 180-minute sittings. Score every domain separately. With six domains between 14% and 22% and a 750 pass mark, any domain below 70% is a genuine risk — there is nothing large enough elsewhere to carry it.
Weak spots and the exam
Close the gaps the practice sittings exposed, in weakest-first order. Rehearse pacing: 180 minutes for 75 questions is under two and a half minutes each, and professional-tier scenarios are long. Then book.
DOP-C02 scenarios are considerably longer than associate-level ones — often several paragraphs establishing an environment before the question arrives. Read the final sentence first. It usually tells you what is being optimised for — cost, recovery time, least operational overhead — and that single word decides between two otherwise workable answers. And remember 10 of the 75 questions are unscored.
Learn from AWS and cloud certified trainers
Certification prep at 360DT is delivered live by AWS, Microsoft, Cisco and NVIDIA certified trainers and Anthropic Authorized Instructors — our full international faculty.
Bipeen
AWS, Microsoft, and Anthropic Certified Trainer
AI, machine learning, and cloud transformation expert with more than 25 years of experience. A renowned global corporate trainer and conference speaker known for practical, outcome driven sessions.
Florian Garcia Compte
Cisco Certified Systems Instructor (CCSI)
Partner Director at AVAANZA FORMACION, a Cisco Learning Partner based in Madrid. Certified Cisco Systems Instructor (CCSI No. 21053) specializing in Cisco Data Center (ACI/SDN), Nexus, and Wireless, delivering official Cisco certification courses including CCNA, CCNP Enterprise, and CCNP Data Center.
Shantanu Pandey
Microsoft, Google, NVIDIA and HPE Certified Trainer
Director of Engineering at Meteoros Automation, ranked in Microsoft's Top 100 Trainers of 2025, holding MCT, Google Cloud, NVIDIA and PeopleCert credentials, with 500+ trainings delivered since 2011.
Vikas Mittal
Google and Anthropic Authorized AI Instructor
Veteran technology trainer with more than 25 years of rich industry experience spanning Google, Microsoft, and emerging AI platforms. An exceptional mentor recognized for proven teaching excellence.
Deep
Anthropic Authorized Instructor and AI Cloud Specialist
Seasoned technology leader with over 20 years of experience across AI, cloud computing, and enterprise training. Known for simplifying complex ideas and delivering practical, real world learning.
Sid
Anthropic Authorized Instructor and Azure Data Engineer
Dynamic corporate trainer and consultant with more than 10 years of experience across Microsoft Fabric, Azure Data Engineering, and modern cloud platforms. Focused on clear, practical learning that sticks.
Arshad Ahmad
Microsoft Certified Trainer (MCT), Cybersecurity & Power Platform Expert
Technology Trainer with 15 years in strategic client delivery, holding MCT, Azure Solutions Architect Expert, Cybersecurity Architect Expert and Power BI Data Analyst credentials, with 200+ trainings delivered.
Sravia
NVIDIA Authorized Instructor and AI Data Specialist
Passionate AI and data evangelist with over 10 years of experience across machine learning, MLOps, and cloud native technologies. Dedicated to delivering impactful, engaging enterprise training programs.
Johan
Microsoft Business Applications MVP and Microsoft Certified Trainer
D365 Customer Service Lead – Europe at Avanade, and founder of the Power Platform School. A Microsoft Business Applications MVP and Microsoft Certified Trainer based in London, specializing in Dynamics 365 Customer Service and Power Platform.
Akim Nyamande
Microsoft, CompTIA, Juniper and Cisco Certified Trainer
IT training facilitator with over five years of experience and certifications across Microsoft, CompTIA, Juniper, and Cisco. Previously a Network Administrator before moving into technical training, now delivering hands-on courses in networking, systems administration, and cybersecurity fundamentals.
Ali El Khatib
Cisco Certified Systems Instructor (CCSI) and Microsoft Certified Trainer
Infrastructure Engineer at RHUH with 13 years in the training field, holding CCSI, MCSE, CCNP Routing and Switching, CCNP Security, CompTIA and Microsoft Azure certifications.
AWS DevOps + Solutions Architect Program
The 360DT AWS DevOps + Solutions Architect Program takes you from associate architecture through to professional-tier DevOps — multi-account CI/CD pipelines, infrastructure as code and drift management, automated security and compliance, resilient deployment strategies, cross-account monitoring, and event-driven auto-remediation. Both credentials, one programme, in the order AWS intends.
Explore the AWS Program
DOP-C02 frequently asked questions
What is the DOP-C02 passing score?
750 out of 1000 on a scaled 100–1,000 range — higher than the 720 required at associate level. You answer 75 questions in 180 minutes, of which 65 are scored and 10 are unscored pilot items that do not affect your result and are not identified during the exam.
How many domains does DOP-C02 have?
Six: SDLC Automation (22%), Configuration Management and IaC (17%), Security and Compliance (17%), Resilient Cloud Solutions (15%), Monitoring and Logging (15%), and Incident and Event Response (14%). They total exactly 100% of scored content. Some third-party summaries list five domains with different percentages — check the official exam guide, currently version 1.6.
Is DOP-C02 harder than AZ-400?
Harder to prepare for, in one specific sense. AZ-400 concentrates 50–55% of its marks in a single domain, so deep pipeline expertise can carry you. DOP-C02 spreads six domains across just 14–22%, with a higher 750 pass mark, so no strength compensates for a gap. AZ-400 has more objectives; DOP-C02 is less forgiving of uneven knowledge.
Do I need SAA-C03 before DOP-C02?
Not as an enforced prerequisite — AWS does not require one. But DOP-C02 assumes associate-level fluency in AWS services and architecture and does not stop to explain it, so SAA-C03 first is the conventional and sensible route. AWS separately recommends two or more years of experience provisioning, operating and managing AWS environments.
Do I need to be able to code for DOP-C02?
Yes. AWS states candidates should have software development lifecycle experience plus programming or scripting ability. Between infrastructure as code, automated testing in pipelines, and event-driven auto-remediation, a substantial share of the exam assumes you write and read code rather than only configure services.
How long does it take to prepare for DOP-C02?
Around fourteen weeks at 8–10 hours per week for an engineer already working on AWS — the roadmap on this page, which gives roughly two weeks per domain because the blueprint is that flat. Add time if you have only ever worked in a single AWS account, since multi-account patterns appear from the first task statement onward.
How long is DOP-C02 valid and what does it cost?
US$300, valid for three years. That is double the cost of the associate exam but the same three-year validity — and considerably less ongoing maintenance than the annual renewal Microsoft requires for its expert-tier certifications.
Which domain do candidates underestimate most?
Security and compliance, at 17% — joint second-largest. People preparing for a DevOps exam study pipelines and infrastructure, then meet questions on cross-account permission design, pipeline credential handling and continuous compliance validation. The same pattern appears on SAA-C03, where security is the single biggest domain.
Sources and further reading
- AWS — AWS Certified DevOps Engineer – Professional (DOP-C02) Exam Guide, version 1.6 (six domains with exact weightings, task statements and skills, 65 scored plus 10 unscored questions, scaled 100–1,000 scoring with a 750 minimum passing score)
- AWS Certification — DOP-C02 exam details page (75 questions, 180 minutes, US$300, three-year validity, and the recommendation of two or more years provisioning, operating and managing AWS environments plus SDLC and programming or scripting experience)
- Microsoft Learn — AZ-400 skills measured, used for the blueprint concentration comparison (build and release pipelines at 50–55%)
- Blueprint concentration figures were calculated by us from each vendor's published weightings; Microsoft values use range midpoints, AWS values are exact
- Published Indian and US AWS DevOps engineer and site reliability engineer compensation ranges, used for role context only
360DT is an independent training provider. AWS certification exams are administered by AWS through its authorised testing providers and are not included in programme tuition. Exam details are accurate as of 20 August 2026; always confirm current format, pricing, validity and exam guide version with AWS before booking.