AWSDOP-C02
🧭

DOP-C02 Exam Tips

How to read the questions, exam-day tactics, and mechanics — a mix of a repeatable question-analysis method and community advice from people who passed.

📋 Exam mechanics

Questions
75 total — 65 scored + 10 unscored (you can't tell which; treat every question seriously).
Time
180 minutes (3 hours) → about 2.4 min per question.
Format
Multiple choice, multiple response, plus newer ordering, matching, and case-study questions.
Extended time
Request +30 min (210 total) if English isn't your first language — do it before booking, via your AWS Certification account.

🎯 Scoring — it's scaled, not a percentage

Your raw score (out of the 65 scored questions) is converted to a scaled 100–1000 score, where 750 = pass. The scaling adjusts for question difficulty, so there is no fixed "X out of 65" that always equals 750.

⚠️750/1000 is NOT 75%. Community estimates put the raw pass bar around ~72% (roughly ~47 of 65) — but treat that as an estimate, not a guarantee, because of scaling. In timed practice, aim for ~80%+ to give yourself cushion.
ℹ️Compensatory scoring: you do NOT need to pass each domain individually. A strong domain (e.g. CI/CD) offsets a weaker one — so don't panic over a single shaky area.

📊 Domain weightings — spend time proportionally

Domain 1 — SDLC Automation largest22% · ~17 Q
Domain 2 — Configuration Management & IaC 17% · ~13 Q
Domain 6 — Security & Compliance 17% · ~13 Q
Domain 3 — Resilient Cloud Solutions 15% · ~12 Q
Domain 4 — Monitoring & Logging 15% · ~12 Q
Domain 5 — Incident & Event Response 14% · ~11 Q
🎯CI/CD is ~a quarter of the exam. Master CodePipeline / CodeBuild / CodeDeploy and you've covered the single biggest slice.

🔍 How to read a question (in order)

  1. Read the last sentence first. The actual ask is almost always the final line. Read it, then go back to the context knowing what to hunt for.
  2. Circle the qualifier. MOST/LEAST operationally efficient, cost, secure, available, least dev effort. On hard questions all options work — the qualifier is the only separator.
  3. Extract the hard constraints and find the one that eliminates options (e.g. "no internet" kills bastion/NAT; "independent per Region" kills edge-optimized; "can't be deleted by root" forces Vault Lock).
  4. Predict the answer before reading options. Name the service/pattern first; options become verification, not discovery.
  5. Ignore narrative fluff — company names, backstory, dollar figures that don't change the technical ask.
  6. Diff near-identical options. When two options differ by one clause, that clause IS the question — evaluate only the difference.
  7. Classify multi-select: complementary (each answer is a different piece of one solution) vs alternatives (each independently works). Changes how you pick.
ℹ️Stuck on what it's asking? Translate the whole stem into one plain sentence: "Who/what needs to do X, under constraint Y, optimizing for Z?" If you can't write that, you haven't found the ask — reread the final question line + the qualifier and ignore the rest.

🧩 Newer question formats

Ordering
Arrange steps in sequence. Nail the first and last steps first — usually the most obvious — then slot the middle.
Matching
Pair items from two lists. Start with the pairs you're most confident about, then use elimination.
Case study
Several questions about one scenario. Read the scenario once, carefully — it's reused across the questions.

🚫 "Impossible-mechanism" distractors — eliminate on sight

AWS plants options describing things that can't happen. If an option asserts one of these, kill it without further thought:

  • ✗"SCP "grants / allows"…" — SCPs never grant — they are ceilings only
  • ✗"Permissions boundary "allows creating users"" — Boundaries never grant either — only cap
  • ✗"AWS Config "attaches an SCP"" — Config evaluates compliance; Organizations attaches SCPs
  • ✗"Notification rule "invokes CodeBuild / Lambda"" — CodeCommit notification rules only target SNS / AWS Chatbot
  • ✗"S3 action "runs a script"" — S3 stores objects; it never executes anything
  • ✗"CloudTrail "detects the DB failure"" — CloudTrail logs API calls, not operational events → use EventBridge / RDS Event Subscriptions
  • ✗"CloudWatch Metrics Insights "queries the logs"" — It queries metrics, not raw logs → Athena (S3 files) or Logs Insights (log groups)
  • ✗"Turn off cross-zone LB "on the ALB"" — For an ALB it is disabled at the target-group level, not the LB

⚡ Keyword → service reflexes

NetApp / ONTAP / SnapMirror
→ FSx for NetApp ONTAP
"Audit resource configuration / is it compliant now"
→ AWS Config (managed rule, or custom rule + Lambda)
"Who called this API / audit trail"
→ CloudTrail (retain via trail → S3; query with Athena)
"anonymous is not authorized" (API Gateway)
→ AWS_IAM authorization + SigV4 signing
"Don't reprocess successful SQS messages" + scale
→ ReportBatchItemFailures (+ DLQ)
On-prem shell access, no internet
→ Systems Manager Session Manager (no bastion/NAT)
"React to an AWS event / run on a schedule"
→ EventBridge rule → target (Lambda / Step Functions / SNS)
"Detect a threat / anomalous IAM behavior"
→ GuardDuty (detect) → EventBridge → Lambda (respond)
"Find sensitive data / PII in S3"
→ Macie
"Zero-downtime cutover, terminate old fleet later"
→ CodeDeploy blue/green + termination wait
"Customizations an account can request" (Control Tower)
→ Service Catalog blueprints + AWSControlTowerBlueprintAccess
"Automatically to all new accounts, with SCPs"
→ CfCT (or StackSets auto-deploy)
ℹ️Also watch layer / type mismatches: task vs instance (ECS task stop = EventBridge, not EC2 lifecycle) · state vs action (Config vs CloudTrail) · API type vs endpoint type (edge-optimized is single-Region) · detect vs act (GuardDuty/Macie find; EventBridge+Lambda respond).

⏱️ Exam-day tactics (from people who passed)

Flag-and-return aggressively
One passer marked 25 of 75 and came back with ~45 min left. Never burn time on a hard one — flag, move on, protect pace.
Skim: beginning, middle, end
Only a few sentences matter. Skim for key terms, then read closely once you know the ask.
Practice in timed exam mode
Rehearse pacing (~2.4 min/Q) before the day. Time pressure — not knowledge — is what most people run out of.
Remote-exam logistics
Run the Pearson/VUE system test 1–2 days early. Expect no pen/paper. Keep your head visible to the camera.
Trust your first read
Second-guessing burns time and often flips a right answer to wrong. Change only with a concrete reason.
Target ~80% in practice
Because scaling is opaque, aim well above the ~72% estimate so you clear the pass line regardless of your question mix.

🎓 What transfers from practice dumps — and what doesn't

✅ Transfers (verified vs AWS sample questions)
  • Read-the-ask / find-the-qualifier / eliminate-on-a-constraint
  • Keyword → service reflexes
  • Layer & type mismatch spotting
  • "All options work, pick the best" — more common on the real exam
⚠️ Dump-specific — don't rely on these
  • Obvious one-clause option diffs (real distractors are subtler)
  • Cartoonishly-broken options (real ones bury the flaw)
  • OCR garble as a "tell" — the real exam is clean
  • Trusting the answer key — this dump has ~7 wrong answers
🎯The real exam is harder in ways a dump can't simulate: strict 2.4 min/question pacing, no answer key or community vote, and fresh service combinations. Do at least one full 75-question, 180-minute timed run before exam day, and calibrate with AWS's official practice set on Skill Builder.
Sources

Community pass-rate/raw-score figures are estimates; AWS publishes only the scaled 750/1000 threshold.