AWS DevOps Engineer Professional (DOP-C02) Guide 2026: Cost, Domains + Best Prep

Last updated: September 2026. Written by Josh Hutcheson, OnlineCourseing editor. Exam facts re-read on AWS’s DevOps Engineer Professional page, exam guide and coming-soon page on 18 September 2026. See our review methodology.

THE 60-SECOND GUIDE

Start DOP-C02 prep with Maarek’s Udemy course →

What the DevOps Engineer Professional certifies

The DOP-C02 exam guide describes a candidate with two or more years of experience provisioning, operating and managing AWS environments, who also has software development lifecycle and programming or scripting experience, has built highly automated infrastructure, administers operating systems and secures AWS infrastructure. The exam validates six abilities: implementing CI/CD and continuous delivery, building and managing infrastructure as code, making systems resilient and scalable, monitoring and logging, responding to incidents automatically, and automating security and compliance across accounts.

It is the Professional-level continuation of both the Developer Associate and the CloudOps Engineer Associate (the renamed SysOps Administrator). The guide also lists what it does not expect: advanced networking such as routing algorithms, deep security recommendations for developers, designing and tuning databases, and writing full-stack application code. That boundary matters, because many candidates over-study networking and under-study CloudFormation, Organizations and event-driven remediation.

Should you pursue DOP-C02?

Take it if

• You are a DevOps engineer, SRE or platform engineer with two or more years operating production workloads on AWS.
• You already build pipelines with CodePipeline, GitHub Actions or Jenkins and manage infrastructure with CloudFormation, CDK or Terraform.
• You hold an Associate certification that is due for renewal: passing DOP recertifies the Developer and CloudOps Engineer Associates on the same path.

Skip it (for now) if

• You have not yet operated multi-account AWS environments. Start with the Developer Associate (DVA-C02, moving to DVA-C03) or the Solutions Architect Associate.
• Your organisation runs on Azure: the Azure DevOps Engineer Expert (AZ-400) is the equivalent.
• You want a vendor-neutral credential: Kubernetes (CKA, CKAD) and HashiCorp Terraform certifications travel across clouds.

Exam format, cost and logistics

Sources: AWS certification page, exam guide v1.6, AWS coming-soon page and AWS Certification FAQs. At 180 minutes for 75 questions you have 2 minutes 24 seconds per question, and many questions are a paragraph of scenario followed by four paragraph-length answers. Time management is part of the test.

The six exam domains and their task statements

Domain 1: SDLC Automation (22%)

• Task: Implement CI/CD pipelines.
• Task: Integrate automated testing into CI/CD pipelines.
• Task: Build and manage artifacts.
• Task: Implement deployment strategies for instance, container and serverless environments.

The biggest domain. Expect CodePipeline with cross-account and cross-Region actions, CodeBuild test reports, CodeArtifact repositories, ECR image scanning, and choosing between in-place, rolling, blue/green, canary and linear deployments for EC2, ECS and Lambda.

Domain 2: Configuration Management and IaC (17%)

• Task: Define cloud infrastructure and reusable components to provision and manage systems throughout their lifecycle.
• Task: Deploy automation to create, onboard and secure AWS accounts in a multi-account or multi-Region environment.
• Task: Design and build automated solutions for complex tasks and large-scale environments.

CloudFormation in depth (StackSets, change sets, drift detection, custom resources, helper scripts), the CDK, Service Catalog, AWS Organizations and Control Tower account vending, and Systems Manager Automation for fleet-wide changes.

Domain 3: Resilient Cloud Solutions (15%)

• Task: Implement highly available solutions to meet resilience and business requirements.
• Task: Implement solutions that are scalable to meet business requirements.
• Task: Implement automated recovery processes to meet RTO and RPO requirements.

Multi-AZ and multi-Region patterns, Auto Scaling lifecycle hooks, Route 53 health checks and failover, DynamoDB global tables, Aurora global databases, and matching backup-and-restore, pilot light, warm standby or active-active to a stated RTO and RPO.

Domain 4: Monitoring and Logging (15%)

• Task: Configure the collection, aggregation and storage of logs and metrics.
• Task: Audit, monitor and analyze logs and metrics to detect issues.
• Task: Automate monitoring and event management of complex environments.

CloudWatch agent, metric filters, composite and anomaly-detection alarms, cross-account observability, Logs Insights, subscription filters to Kinesis or OpenSearch, CloudTrail organization trails and X-Ray.

Domain 5: Incident and Event Response (14%)

• Task: Manage event sources to process, notify and take action in response to events.
• Task: Implement configuration changes in response to events.
• Task: Troubleshoot system and application failures.

EventBridge rules routing to Lambda, SNS, SQS and Systems Manager runbooks; Config rules with automatic remediation; Health events; and reading failed deployments, stuck stacks and throttled APIs.

Domain 6: Security and Compliance (17%)

• Task: Implement techniques for identity and access management at scale.
• Task: Apply automation for security controls and data protection.
• Task: Implement security monitoring and auditing solutions.

Service control policies, permission boundaries and IAM Identity Center; Secrets Manager rotation and KMS key policies; Security Hub, GuardDuty, Inspector, Macie and Config conformance packs aggregated across an organization.

The services that decide most questions

Scenarios the exam keeps returning to

DOP questions reward the answer that is most automated and least operationally heavy, even when a manual answer would also work. These recurring scenarios show the pattern:

• Roll out a stack to 40 accounts in three Regions. CloudFormation StackSets with service-managed permissions through Organizations, not a script looping over accounts.
• New accounts must arrive with guardrails. Control Tower account factory or Organizations plus SCPs and a baseline StackSet, applied automatically on account creation.
• A non-compliant security group must be fixed within minutes. A Config managed rule with an SSM Automation remediation document, or EventBridge triggering Lambda.
• A Lambda release must roll back on errors. CodeDeploy canary or linear deployment with CloudWatch alarms attached to the deployment group.
• An ECS service needs zero-downtime deploys. CodeDeploy blue/green with two target groups and a test listener.
• Logs from every account must reach a central bucket and be searchable. An organization CloudTrail plus CloudWatch Logs subscription filters to a central account, queried with Logs Insights or OpenSearch.
• RTO of minutes, RPO near zero. Warm standby or active-active with Aurora global database or DynamoDB global tables and Route 53 failover, not backup and restore.
• A deployment keeps failing on one instance. Read the CodeDeploy lifecycle event logs on the instance and fix the appspec hook, rather than redeploying blindly.

Deployment strategies compared

Task statement 1.4 asks you to implement deployment strategies for instance, container and serverless environments, and a large share of Domain 1 questions reduce to picking the right one. The deciding factors are always the same four: how much downtime is acceptable, how fast you must roll back, how much extra capacity you can pay for during the release, and whether you need to test with real traffic first.

When a question mentions “minimal downtime and fastest rollback”, the answer is almost always blue/green; when it says “test with a small percentage of production traffic and roll back automatically”, it is canary with alarms on the deployment group.

Disaster recovery: matching the strategy to RTO and RPO

Task statement 3.3 (automated recovery to meet RTO and RPO) is tested through scenarios that state a recovery time objective and a recovery point objective and ask for the cheapest design that meets both. The four standard strategies trade cost against speed:

The exam also expects you to automate the failover itself: Route 53 health checks and failover records, Aurora global database managed failover, DynamoDB global tables, and infrastructure defined in CloudFormation so the recovery Region can be rebuilt on demand.

What it costs, all in

Best ways to prepare for DOP-C02

Ranked on how well each prepares you for this exam, then on price. At Professional level the course matters less than the practice exams and the labs; pick one core course, not three.

#1 core course (tie): Stephane Maarek’s Udemy course

AWS Certified DevOps Engineer Professional 2026 – DOP-C02 is rated 4.6 from 21,017 ratings with 185,546 students and was updated in September 2026 (read on Udemy on 18 September). It is about 20 hours of advanced video, which is short for a Professional exam by design: it assumes Associate-level knowledge and spends its time on the Professional-specific services and patterns. On Udemy sale it costs $15 to $30. Its brevity is the trade-off; if your Associate knowledge is thin, it moves fast.

See Maarek’s DOP-C02 course on Udemy →

#1 core course (tie): Adrian Cantrill’s course

Cantrill’s DevOps Engineer Professional course costs $80 on learn.cantrill.io with a 14-day refund window. It is longer and more explanatory than Maarek’s, with extensive demos, and it is the course most often recommended by people who found Maarek too fast. Choose it if you want depth and have the time. We have no affiliate relationship with Cantrill.

Structured on Coursera

Coursera’s Exam Prep: AWS Certified DevOps Engineer – Professional specialization is a six-course series from Whizlabs (4.4 from 32 course reviews, 3,064 enrolled), estimated at three months at seven hours a week. The review base is small, so we rank it below the two courses above; it suits people who want deadlines inside a Coursera subscription. For a foundation rather than exam prep, AWS’s own DevOps and AI on AWS specialization (three courses, 4.6 from 56 reviews) walks through building a CI/CD pipeline and AIOps on AWS at a beginner level.

For a portfolio: Udacity Cloud DevOps Engineer Nanodegree

The Udacity Cloud DevOps Engineer Nanodegree is an intermediate program of about 53 hours with four human-reviewed projects on AWS covering infrastructure as code, CI/CD with GitHub Actions, and monitoring. It was updated on 20 August 2026 (4.6 from 471 reviews) and lists eleven prerequisites. It is not exam prep; it produces the projects that interviews for DevOps roles ask about. Udacity’s list price is $249 a month; a 40% promotion was showing when we checked, and our reader code onlinecourseing40 applies. Read our full Cloud DevOps Engineer Nanodegree review.

Practice exams and free supplements

• Tutorials Dojo practice exams ($14.99): four timed exams, six section-based tests, 15 quizzes and flashcards with a year of access. At Professional level these are the single highest-value purchase. No affiliate relationship.
• AWS Skill Builder: AWS’s official DOP exam-prep plan and practice question set on the free tier; hands-on labs on the paid plan.
• AWS whitepapers and prescriptive guidance: AWS’s published material on CI/CD and blue/green deployment maps directly to Domain 1 and explains why the exam prefers one strategy over another.

A 14-week study plan

1. Weeks 1–2: baseline. Read the exam guide, take one Tutorials Dojo section-based test per domain untimed, and list your two weakest domains.
2. Weeks 3–8: core course. Maarek or Cantrill, rebuilding every demo in a sandbox Organization with at least two member accounts.
3. Weeks 9–10: labs. Build the five labs below; this is where multi-account scenarios stop being abstract.
4. Weeks 11–13: practice exams. Timed full-length exams, reviewing every explanation, until you score above 80% on fresh sets and finish with 15 minutes to spare.
5. Week 14: exam. Book it in week 1 so the date drives the plan.

Five labs to build before you sit the exam

• A cross-account pipeline (Domain 1). CodePipeline in a tools account deploying a CloudFormation stack into a separate prod account through an assumed role.
• StackSets across an Organization (Domain 2). A baseline stack (CloudTrail, Config, an S3 bucket policy) deployed to every account with service-managed permissions.
• Blue/green on ECS (Domains 1 and 3). CodeDeploy with two target groups, a test listener and an alarm-driven rollback.
• Auto-remediation (Domain 5 and 6). A Config rule flagging public S3 buckets and an SSM Automation document that fixes them.
• Central logging (Domain 4). An organization trail plus a CloudWatch Logs subscription filter shipping to a central account, queried with Logs Insights.

Tear everything down after each lab and set a budget alarm; NAT gateways, load balancers and Config recordings are the usual surprise bills.

Registration and test day

You book through your AWS Certification account and sit the exam at a Pearson VUE test centre or online with a proctor. Online delivery needs a quiet room, a webcam, a room scan and ID matching your registration name exactly. If you already hold an active AWS certification, check your Certification account for the 50% discount voucher before paying the full $300. Three hours is a long sitting; a test centre avoids the risk of an online session ending because of a dropped connection or someone walking into the room. Most candidates see pass or fail at the end of the session, with the domain-level report following within five business days.

Mistakes that cost people the exam

• Running out of time. Read the last sentence of the question first, then the scenario; flag long questions and come back.
• Choosing the manual answer. If one option is a script or a person and another is a managed, event-driven service, the managed one is usually right.
• Under-studying CloudFormation. StackSets, change sets, drift, custom resources and cfn helper scripts appear far more than candidates expect.
• Over-studying networking. The guide puts advanced networking out of scope; know VPC basics and move on.
• Skipping multi-account practice. Organizations, SCPs and cross-account roles run through every domain.

Salary impact, honestly

Earlier versions of this page quoted a pass rate sourced to a subreddit and salary bands attributed to compensation websites. We removed them: AWS publishes no pass rate, and salary data for “DevOps engineer” varies by tens of thousands of dollars across markets, seniority and company size, so a single band misleads more than it informs. What holds up is narrower: DOP-C02 is one of three AWS Professional certifications (alongside Solutions Architect and Generative AI Developer), it maps closely to the DevOps, SRE and platform roles that pay well in cloud-heavy companies, and it is most valuable to people who already have the experience it describes. For your market, check a live salary aggregator for the exact job title you are targeting.

DOP-C02 versus the neighbouring certifications

Frequently asked questions

How hard is the AWS DevOps Engineer Professional exam?

Hard. It is a Professional-level exam of 75 long scenario questions in 180 minutes, with a higher scaled passing score (750) than the Associate exams (720). AWS does not publish a pass rate, and figures quoted online are self-reported. What makes it hard is reading speed and multi-service scenarios where two or three answers would work and you must pick the most automated, least operational option.

Do I need an Associate certification before DOP-C02?

No. AWS has no certification prerequisites, so you can book DOP-C02 directly. AWS recommends two or more years of experience provisioning, operating and managing AWS environments, plus software development and scripting experience. In practice most successful candidates have passed the Developer Associate or the CloudOps Engineer Associate first because it covers half the ground at a lower level.

How much does DOP-C02 cost?

The exam is $300 USD per attempt, and a retake costs the full $300 again. Prep runs from $0 on AWS Skill Builder to about $15 to $30 for Stephane Maarek’s Udemy course, $80 for Adrian Cantrill’s course and $14.99 for Tutorials Dojo practice exams, so a realistic all-in budget is $330 to $400. If you hold another active AWS certification, AWS’s 50% voucher can cut the exam fee to $150.

Is there a DOP-C03 coming?

Not as of 18 September 2026. AWS’s certification page and exam guide still carry DOP-C02, and AWS’s coming-soon page lists no change to the DevOps Engineer Professional. AWS does announce changes to other exams months ahead (the Developer Associate moves to DVA-C03 after 1 December 2026), so check the certification page before booking. The only announced DOP change is that the Korean-language version retires after 31 December 2026.

How long should I study for DOP-C02?

With an Associate certification and daily AWS work, 10 to 14 weeks at 8 to 10 hours a week is typical. Without hands-on multi-account experience, plan longer and budget for labs, because the exam’s scenarios assume you have operated pipelines, CloudFormation StackSets and Organizations in anger.

Is DOP-C02 worth it?

For engineers who automate delivery and operations on AWS, yes: it is one of AWS’s three Professional certifications and the one closest to day-to-day DevOps, SRE and platform work. It is worth less to someone without the experience behind it, because interviews for those roles probe hands-on incidents and pipelines rather than the badge.

How long is DOP-C02 valid, and does it renew my Associates?

It is valid for three years. Under AWS’s recertification policy, passing a Professional exam also recertifies the Associate certifications on the same path (the Developer and CloudOps Engineer Associates for DevOps), which is one practical reason to take DOP before your Associates lapse.

What happens if I fail DOP-C02?

You wait 14 calendar days, pay the full $300 again, and there is no limit on attempts. The score report classifies your performance by domain; the retake plan is to drill the weakest one or two domains with section-based practice tests rather than rewatching a whole course.

Final verdict

DOP-C02 is the AWS certification closest to real DevOps work, and it is stable: current version, no successor announced, three-year validity, and it renews your Associates on the way. Prepare with one core course (Maarek if your Associate knowledge is fresh, Cantrill if you want depth), make Tutorials Dojo practice exams the centre of the last month, and build the multi-account labs yourself. If you have not yet run pipelines or an AWS Organization, start with the Developer Associate and come back.

Start DOP-C02 prep with Maarek’s Udemy course →

Related guides: AWS Developer Associate (DVA-C02 and C03) · AWS Solutions Architect Associate · AWS Machine Learning Engineer Associate (MLA-C01 → C02) · Azure DevOps (AZ-400) · Best cloud DevOps courses · Udacity Cloud DevOps review · Best cloud certifications · AWS vs Azure