Updated Amazon DOP-C02 Exam Dumps (July, 2026)

AWS Certified DevOps Engineer - Professional

Question 1

A company hosts a security auditing application in an AWS account. The auditingapplication uses an IAM role to access other AWS accounts. All the accounts are in thesame organization in AWS Organizations.A recent security audit revealed that users in the audited AWS accounts could modify ordelete the auditing application's IAM role. The company needs to prevent any modificationto the auditing application's IAM role by any entity other than a trusted administrator IAMrole.Which solution will meet these requirements?

A. Create an SCP that includes a Deny statement for changes to the auditing application'sIAM role. Include a condition that allows the trusted administrator IAM role to makechanges. Attach the SCP to the root of the organization.
B. Create an SCP that includes an Allow statement for changes to the auditingapplication's IAM role by the trusted administrator IAM role. Include a Deny statement forchanges by all other IAM principals. Attach the SCP to the IAM service in each AWSaccount where the auditing application has an IAM role. 
C. Create an IAM permissions boundary that includes a Deny statement for changes to theauditing application's IAM role. Include a condition that allows the trusted administrator IAMrole to make changes. Attach the permissions boundary to the audited AWS accounts
D. Create an IAM permissions boundary that includes a Deny statement for changes to theauditing application’s IAM role. Include a condition that allows the trusted administrator IAMrole to make changes. Attach the permissions boundary to the auditing application's IAMrole in the AWS accounts. 

Answer: A

Question 2

A company uses an organization in AWS Organizations to manage several AWS accountsthat the company's developers use. The company requires all data to be encrypted intransit.Multiple Amazon S3 buckets that were created in developer accounts allow unencryptedconnections. A DevOps engineer must enforce encryption of data in transit for all existingS3 buckets that are created in accounts in the organization.Which solution will meet these requirements?

A. Use AWS Cloud Formation StackSets to deploy an AWS Network Firewall firewall toeach account. Route all outbound requests from the AWS environment through the firewall.Deploy a policy to block access to all outbound requests on port 80. 
B. Use AWS CloudFormation StackSets to deploy an AWS Network Firewall firewall toeach account. Route all inbound requests to the AWS environment through the firewall.Deploy a policy to block access to all inbound requests on port 80
C. Turn on AWS Config for the organization. Deploy a conformance pack that uses the s3-bucket-ssi-requests-only managed rule and an AWS Systems Manager Automationrunbook. Use a runbook that adds a bucket policy statement to deny access to an S3bucket when the value of the aws:SecureTransport condition key is false. 
D. Turn on AWS Config for the organization. Deploy a conformance pack that uses the s3-buckot-ssl-requests-only managed rule and an AWS Systems Manager Automationrunbook. Use a runbook that adds a bucket policy statement to deny access to an S3bucket when the value of the s3:x-amz-server-side-encryption-aws-kms-key-id conditionkey is null. 

Answer: C

Question 3

A Company uses AWS CodeCommit for source code control. Developers apply theirchanges to various feature branches and create pull requests to move those changes tothe main branch when the changes are ready for production.The developers should not be able to push changes directly to the main branch. Thecompany applied the AWSCodeCommitPowerUser managed policy to the developers’ IAMrole, and now these developers can push changes to the main branch directly on everyrepository in the AWS account.What should the company do to restrict the developers’ ability to push changes to the mainbranch directly?

A. Create an additional policy to include a Deny rule for the GitPush and PutFile actions.Include a restriction for the specific restriction for the specific repositories in the policyrepositories in the policy statement with a condition that references the main branch.ACreate an additional policy to include a Deny rule for the GitPush and PutFile actionsInclude a restriction for the specific repositories in the policy statement with a condition thatreferences the main branch 
B. Remove the IAM policy, and add an AWSCodeCommitReadOnly managed policy. Addan Allow rule for the GitPush and PutFile actions for the specific repositories in the policystatement with a condition that references the mam branch. 
C. Modify the IAM policy Include a Deny rule for the GitPush and PutFile actions for thespecific repositories in the policy statement with a condition that references the mainbranch. 
D. Create an additional policy to include an Allow rule for the GitPush and PutFile actions.Include a restriction for the specific repositories in the policy statement with a condition thatreferences the feature branches. 

Answer: A

Question 4

A company frequently creates Docker images of an application. The company stores theimages in Amazon Elastic Container Registry (Amazon ECR). The company createsboth tagged images and untagged images.The company wants to implement a solution to automatically delete images that have notbeen updated for a long time and are not frequently used. The solution must retain at leasta specified number of images.Which solution will meet these requirements with the LEAST operational overhead?

A. Use Amazon S3 Lifecycle policies on the ECR repository to automatically delete imagesbased on image age or the absence of tags on the image.
B. Use Amazon ECR lifecycle policies to delete images based on age or the number ofimages that need to be retained in the repository. 
C. Configure an AWS Lambda function to run on a schedule to delete images based onage or the number of images that need to be retained in the repository. 
D. Use AWS Systems Manager to run a script by using the aws:executeScript action toautomatically delete images based on image age or the absence of tags on the image. 

Answer: B

Question 5

A company uses AWS Organizations to manage multiple AWS accounts. The companyneeds a solution to improve the company's management of AWS resources in a productionaccount.The company wants to use AWS CloudFormation to manage all manually createdinfrastructure. The company must have the ability to strictly control who can make manualchanges to AWS infrastructure. The solution must ensure that users can deploy newinfrastructure only by making changes to a CloudFormation template that is stored in anAWS CodeConnections compatible Git provider.Which combination of steps will meet these requirements with the LEAST implementationeffort? (Select THREE).

A. Configure the CloudFormation infrastructure as code (IaC) generator to scan for existingresources in the AWS account. Create a CloudFormation template that includes thescanned resources. Import the CloudFormation template into a new CloudFormation stack
B. Configure AWS Config to scan for existing resources in the AWS account. Create aCloudFormation template that includes the scanned resources. Import the CloudFormationtemplate into a new CloudFormation stack. 
C. Use CodeConnections to establish a connection between the Git provider and AWSCodePipeline. Push the CloudFormation template to the Git repository. Run a pipeline inCodePipeline that deploys the CloudFormation stack for every merge into the Gitrepository. 
D. Use CodeConnections to establish a connection between the Git provider andCloudFormation. Push the CloudFormation template to the Git repository. Sync the Gitrepository with the CloudFormation stack.
E. Create an IAM role, and set CloudFormation as the principal. Grant the IAM role accessto manage the stack resources. Create an SCP that denies all actions to all the principalsexcept by the IAM role. Link the SCP with the production OU. 
F. Create an IAM role, and set CloudFormation as the principal. Grant the IAM role accessto manage the stack resources. Create an SCP that allows all actions to only the IAM role.Link the SCP with the production OU.

Answer: A,C,E

Alex Drouillard      July 05, 2026

I've been using Amazon's study materials for a while now, and they've truly elevated my learning experience.

Nyajal Wal      July 04, 2026

The study materials I purchased from Amazon were comprehensive and well-structured, making it easy for me to follow along

Kamal Kumar      July 03, 2026

I highly recommend Amazon's study materials to anyone looking to excel in their academic or professional pursuits.

Jordan Dooley      July 02, 2026

Amazon's study materials exceeded my expectations in terms of quality and depth of content.

LI PIN TENG      July 01, 2026

Thanks to Amazon's study materials, I was able to grasp complex concepts with ease and confidence.

Gaurav Sahu      June 30, 2026

The variety of study materials available on Amazon cater to diverse learning styles, making it accessible for everyone.

Pulkit      June 29, 2026

I'm impressed by the attention to detail and accuracy of information in Amazon's study materials.

Alex Drouillard      June 28, 2026

Amazon's study materials are a valuable investment for anyone serious about their education and career advancement.

Ann Opara      June 27, 2026

The user-friendly interface of Amazon's study materials made it convenient for me to navigate through different topics

Ankush Kumar      June 26, 2026

I've noticed a significant improvement in my exam scores since incorporating Amazon's study materials into my routine.