Looking Back on My Journey to a Perfect 1000/1000 on the AWS Certified DevOps Engineer – Professional (DOP-C02)

Hi everyone! It has been almost 3 years since I last had the chance to write an article and share some knowledge.

Back in 2023, I built a blog website for sharing Software Engineering knowledge, hosted it on PythonAnywhere, and wrote around a dozen articles. Then work at the company became too busy, so the blog basically went into “hibernation.”

Now that I’ve just finished taking the AWS Certified DevOps Engineer – Professional (DOP-C02) exam, I wanted to write something again, talk a little about the journey, and share some of what I learned. Hopefully, it can help those of you who are planning to take this certification.

As for why I decided to take the exam, I left my previous company around the middle of this year so I could return to school and finally finish the two Japanese courses I still owed. I also wanted to keep my technical knowledge from becoming outdated and see how far my current abilities could take me, so I decided to study for and take this certification.

AWS was running a Global Retake voucher at the time, offering a 25% discount and a free retake if you failed, so I felt confident enough to schedule the exam for November 20.

I studied for nearly 4 months in total and spent at least around 4 hours per day learning.

And the result was something I honestly did not expect:

I achieved a perfect score of 1000/1000.

This article contains quite a lot of subjective content based on my own experience studying for and taking the DOP-C02 exam. I’m still relatively young, born in 2003, so I would really appreciate constructive feedback from everyone so I can continue improving myself and learning more.

I also strongly encourage everyone to filter, compare, and re-check information across multiple sources so you can build a more complete perspective and find the learning approach that works best for you.

Hopefully, these experiences can provide at least some value on your journey toward the AWS Certified DevOps Engineer – Professional (DOP-C02).

1. Studying the Theory

I had previously passed SAA-C03, which helped quite a lot when studying for DOP-C02. Many services and concepts covered in SAA-C03 appear again here, such as ASG, ELB, Storage Gateway, Route 53, KMS, CloudWatch, high availability, multi-AZ, multi-region, and so on.

Most of AWS’s basic core services and concepts are already introduced in SAA-C03.

This time, I continued using Stephane Maarek’s Udemy course as my main learning resource. Stephane’s English accent is quite easy to understand, the slides are comprehensive, and the course covers around 70% of the foundational knowledge clearly.

The course includes slides, videos, and a .zip file to support the hands-on exercises.

The first time through, I watched all the videos to build an overall knowledge structure. For topics I already knew, I could skip ahead to save time. For topics I did not know, I noted them down and studied them more carefully.

The second time, I only read the slides. I had quite a lot of time available, so I read them very carefully, especially the bolded lines.

While reading, I also did hands-on exercises. Whenever something in the slides was not clear, I asked AI about it and had it point me to the relevant AWS documentation so I could read further. Whenever possible, I immediately tried the concept hands-on while it was still fresh.

Stephane’s course

You can also check out Cantrill’s course. I have read quite a few positive reviews about his material.

Cantrill’s course

Note: For courses on Udemy, you can wait for sales, which happen every few days and usually offer very large discounts. From my experience, I never buy anything there for more than VND 400,000 because sooner or later it will go on sale.

2. Some Key Knowledge I Took Away During the Learning Process

Alongside Stephane’s material, I used the Exam Guide as my second primary learning resource.

The guide describes the percentage of questions from each domain in detail, which tasks may appear within each domain, and what each task expects you to know.

You can use it as a roadmap for both studying and hands-on practice.

During the learning process, I summarized a few things below. Hopefully, they will be useful.

AWS DOP-C02 Exam Guide

Domain 1: SDLC Automation

Task 1: Implement CI/CD pipelines

• Understand the software development lifecycle clearly: plan → code → build → test → release → deploy → operate → monitor.
• Design standardized CI/CD pipelines for multiple environments such as dev/test/staging/prod.
• Separate accounts according to best practices using a multi-account strategy.
• Manage environments through branch models such as main branch, feature branch, and release branch.
• Control source code versions and enforce code review and PR workflows.
• Manage secrets and sensitive information using a secret store instead of hardcoding them.
• Choose an appropriate deployment strategy depending on the workload type, such as EC2, ECS, Lambda, and so on.
• Automatically roll back when a deployment fails.
• Log pipeline activity so you can audit who deployed what.

Important services: CodeCommit, CodeBuild, CodePipeline, CodeDeploy, ECR, Secrets Manager, Parameter Store, IAM, CloudTrail.

Task 2: Integrate automated testing into CI/CD pipelines

• Understand the role of each type of test: unit test, integration test, UI test / end-to-end test, security scanning.
• Configure pipelines to run tests automatically when a Pull Request is created, when a PR is merged, or when an artifact is built.
• Configure thresholds to block deployments when tests fail or code quality falls below an acceptable level.
• Include performance testing such as load, stress, and spike testing before production.
• Automate static code analysis and security analysis.
• Use testing frameworks integrated with AWS to run tests on a schedule or based on events.

Important services: CodeBuild, CodePipeline, Step Functions, Lambda, CloudWatch Events, Inspector, CodeGuru Reviewer & Profiler.

Task 3: Build and manage artifacts

• Understand the concept of an artifact: output built from source code, such as JAR files, Docker images, ZIP files, packages, and so on.
• Use an artifact repository to manage storage, versioning, and build ID traceability.
• Separate the build process from the deployment process: build once, deploy many.
• Promote artifacts through multiple environments, such as dev → staging → prod, without rebuilding.
• Automate standardized AMI builds for EC2, also known as golden AMIs.
• Automate container image builds for ECS/EKS.
• Protect artifacts with encryption and access control.

Important services: ECR, CodeArtifact, S3, CodeBuild, Lambda, EC2 Image Builder, KMS.

Task 4: Implement deployment strategies for EC2, containers, and serverless

• Deploy to EC2 through CodeDeploy using either in-place or blue/green deployments.
• Deploy containers to ECS using either Fargate or EC2.
• Deploy serverless applications such as Lambda using alias routing or weighted traffic shifting.
• Configure storage services appropriate for each workload, including EFS, S3, and EBS.
• Choose the right deployment strategy: rolling update, blue/green, canary.
• Control access to artifact repositories for each environment.
• Configure automated rollback based on health checks and CloudWatch alarms.

Important services: CodeDeploy, ECS, EKS, Lambda, EFS, S3, EBS, EC2 Image Builder, AppConfig, IAM.

Domain 2: Configuration Management and Infrastructure as Code

Task 1: Define infrastructure as code and reusable components

• Build infrastructure with IaC to ensure consistency, repeatability, and version control.
• Use CloudFormation/CDK to create templates, modules, and nested stacks.
• Separate configuration using parameters, mappings, and SSM Parameter Store so modules can be reused.
• Use change sets to preview changes before deployment.
• Manage IaC through Git with reviews, pull requests, tagging, and CI pipelines.
• Detect drift between templates and the actual environment.
• Automatically remediate drift when it occurs.
• Build templates around reusable patterns such as networking, compute, database, and monitoring.

Important services: CloudFormation, CDK, SAM, AppConfig, SSM Parameter Store, Config Rules, CloudTrail.

Task 2: Automate multi-account and multi-region deployments

• Apply multi-account best practices for security, networking, logging, sandbox, production, and so on.
• Use Organizations to manage accounts and SCPs to enforce guardrails.
• Use StackSets to deploy IaC across accounts and regions.
• Configure cross-account IAM roles so CI/CD can perform deployments.
• Use multi-region replication for high availability and disaster recovery architectures.
• Use Service Catalog to distribute standardized templates.

Important services: AWS Organizations, Control Tower, CloudFormation StackSets, IAM Roles, STS, Service Catalog, Config Aggregator.

Task 3: Build scalable configuration management and automation

• Manage configuration across large systems using SSM State Manager to continuously enforce configuration.
• Automatically run patches, update operating systems, and apply security baselines through Patch Manager.
• Use Run Command to make changes across large numbers of EC2 instances quickly.
• Use Automation Documents to orchestrate multi-step workflows.
• Use Step Functions to coordinate complex processes.

Important services: Systems Manager (State Manager, Patch Manager, Automation, Run Command), Step Functions, EventBridge.

Domain 3: Resilient Cloud Solutions

Task 1: Implement highly available architectures

• Design multi-AZ architectures for databases, compute, and routing.
• Use multi-region architectures for mission-critical systems.
• Decouple microservices with queues and pub/sub to avoid tight coupling.
• Implement auto healing: instance fails → automatically replace it.
• Use health checks and graceful degradation.
• Design fault isolation zones to limit blast radius.

Important services: ALB, NLB, Auto Scaling, SQS, SNS, EventBridge, RDS Multi-AZ, Aurora Serverless, DynamoDB.

Task 2: Implement scalable architectures

• Use horizontal scaling for compute and containers.
• Use dynamic scaling based on metrics such as CPU, memory, and SQS queue depth.
• Scale Lambda using concurrency controls.
• Optimize scaling using pre-warming and scheduled scaling.

Important services: Auto Scaling, Application Auto Scaling, ECS, EKS, DynamoDB Auto Scaling, Lambda concurrency, SQS.

Task 3: Implement disaster recovery strategies

• Compare DR strategies: Backup & Restore, Pilot Light, Warm Standby, Multi-Region Active-Active.
• Automatically replicate data across regions.
• Regularly test DR through automation.

Important services: AWS Backup, S3 CRR, DynamoDB Global Tables, RDS Replica, CloudEndure/DRS, Route 53 failover.

Domain 4: Monitoring and Logging

Task 1: Configure monitoring, logging, and metrics

• Collect logs from applications, containers, operating systems, and AWS services.
• Create custom CloudWatch metrics to track application logic.
• Configure log retention policies appropriate for compliance requirements.
• Centralize logging across multiple accounts.
• Connect logs to visualization dashboards.

Important services: CloudWatch Logs, CloudWatch Metrics, CloudTrail, X-Ray, OpenSearch, Container Insights.

Task 2: Audit and analyze logs and metrics

• Use Logs Insights to query logs and identify causes of failures.
• Analyze application behavior based on latency and traffic patterns.
• Use X-Ray to trace distributed systems.
• Detect anomalies and high error rates.

Important services: CloudWatch Logs Insights, CloudTrail, X-Ray, OpenSearch Dashboards, GuardDuty findings.

Task 3: Automate monitoring and alerts

• Create CloudWatch Alarms for CPU, memory, error rate, and business KPIs.
• Use event-driven remediation to automatically restart services, scale out, or fix configuration.
• Send notifications through SNS, Slack, email, or webhooks.
• Use Systems Manager to automatically handle failures.
• Combine EventBridge with other services to trigger workflows.

Important services: CloudWatch Alarms, SNS, EventBridge, Lambda, Systems Manager Automation.

Domain 5: Incident and Event Response

Task 1: Manage event sources and workflows

• Use EventBridge to organize event routing.
• Use event filtering and schema registry to process the correct event types.
• Design retry, exponential backoff, and DLQ mechanisms for failures.
• Build fan-out architectures for multiple subscribers.

Important services: EventBridge, SNS, SQS, Lambda, Step Functions.

Task 2: Apply changes based on events

• Automatically remediate security drift when it is detected.
• Automatically enforce operating system and configuration baselines.
• Use Patch Manager to apply security patches on a schedule.
• Use Config Rules to trigger immediate configuration remediation.

Important services: Systems Manager Automation, Patch Manager, State Manager, Config Rules, Lambda.

Task 3: Troubleshoot system and application issues

• Use logs, metrics, and traces to identify the root cause.
• Diagnose ECS/EKS/EC2/Lambda issues.
• Analyze databases using Performance Insights.
• Check networking using VPC Flow Logs.

Important services: CloudWatch Logs, X-Ray, CloudTrail, RDS Performance Insights, ECS/EKS logs, VPC Flow Logs.

Domain 6: Security and Compliance

Task 1: Implement IAM techniques at scale

• Apply the principle of least privilege.
• Use IAM Roles instead of IAM Users.
• Understand and use RBAC and ABAC.
• Use permission boundaries to restrict permissions available to developers or teams.
• Implement cross-account access through STS AssumeRole.
• Use Organizations SCPs to enforce guardrails across accounts.
• Rotate secrets and keys periodically.
• Require MFA for important accounts.

Important services: IAM, STS, Organizations SCPs, Identity Center (SSO), Secrets Manager, KMS, CloudTrail.

Task 2: Automate security controls & data protection

• Apply defense in depth, with security at every layer: edge → network → app → data.
• Encrypt data at rest using KMS and data in transit using ACM TLS.
• Use WAF rules to protect web applications and Shield to protect against DDoS attacks.
• Use Network Firewall to control traffic.
• Use Macie to automatically scan for PII data.
• Use Security Hub as a centralized compliance platform.
• Use GuardDuty to detect threats, compromised keys, and anomalous IP activity.
• Automatically run remediation when findings are detected.

Important services: KMS, ACM, WAF, Shield Advanced, Network Firewall, Macie, Security Hub, GuardDuty, Config Rules.

Task 3: Security monitoring and auditing

• Enable CloudTrail for every account and send logs to a dedicated logging account.
• Store logs for auditing purposes.
• Enable VPC Flow Logs to monitor traffic.
• Use Inspector to periodically scan for vulnerabilities.
• Send alerts when threats are detected and automatically isolate affected resources.

Important services: CloudTrail, Config, VPC Flow Logs, CloudWatch Logs, Inspector, Access Analyzer, GuardDuty.

Below are two areas that I personally found difficult and especially easy to get confused by. The questions are long, and they frequently ask you to choose the optimal solution rather than simply one that works.

1. Authentication, Authorization, and IAM

During my preparation, the part that gave me the biggest headache was authentication/authorization.

The reason is that AWS has so many different mechanisms. Each service may use a different permission model, and the exam really likes mixing them together.

The most difficult areas for me were:

• Understanding and correctly applying IAM users → groups → roles → policies → identity federation → IdP.
• IAM Identity Center, permission sets, and how they map to IAM roles in each account.
• Working with OIDC, SAML, Web Identity, STS AssumeRole, and so on.
• Implementing authentication/authorization in EKS using aws-auth ConfigMap, IRSA, Pod Identity, and so on.
• Managing certificates and PKI systems on AWS using ACM, ACM Private CA, and so on.
• Authentication and authorization at the API layer: API Gateway IAM auth, Lambda authorizer, Cognito User Pool authorizer, API keys, usage plans, resource policies, and so on.
• Combining credential rotation, secret rotation, permission boundaries, SCPs, resource policies, and more.

2. Multi-account, Multi-region with AWS Organizations, Control Tower, and StackSets

Another difficult area involves enterprise-scale deployments, especially when working with multiple accounts or multiple regions.

The hardest part is being able to distinguish between the options and choose the right solution:

• When to use Account Factory, Account Factory Customization (AFC), or Account Factory for Terraform (AFT).
• When Control Tower Customizations (CfCT) should be used.
• When a delegated administrator account is enough.
• When StackSets are required to deploy resources to individual member accounts.
• When using the Organizations API is more efficient.

Examples of scenarios AWS likes to ask about:

• Create AWS Config Conformance Packs across the entire organization: → A delegated administrator is enough. StackSets are not required.
• Deploy IAM baseline policies, guardrails, and SCPs: → Control Tower / Organizations.
• Create repeated resources in every account, such as S3 buckets, CloudWatch alarms, or custom IAM roles: → StackSets are the better choice.
• Automate account creation when onboarding a new team or project: → Account Factory, AFC, or AFT.

Why is this part difficult?

• Enterprise workflows are nothing like basic labs.
• Organizations + Control Tower provide far too many different ways of doing things.
• AWS gives you long scenarios and asks you to choose the optimal solution, not merely one that works.

3. Hands-on Practice

Because my account was no longer eligible for the Free Tier, I had to spend some money on hands-on practice.

I tried registering another account with a different email address, phone number, and VISA card, but right after logging in I was informed that the account had already used up the Free Tier.

I contacted AWS Support about this and learned that AWS can track this situation.

During the first month, I did a lot of hands-on work with Organizations, Control Tower, CloudFormation, StackSets, Config, and so on.

However, I often forgot to delete stacks afterward, while EC2 instances, EIPs, Config rules, and other resources kept running for days. That ended up costing me quite a bit.

Later, I contacted AWS Support and asked whether they could waive that month’s bill because it was an honest mistake.

They were extremely helpful. They waived the bill and even gave me some additional credits to continue experimenting with.

Hands-on practice is extremely important. I spent around 60% of my study time doing hands-on exercises.

When you actually work with the services, you see and understand many things that are difficult to fully grasp just by reading.

Here are a few examples:

• When deploying a stack containing IAM Roles/Policies, hands-on practice helps you properly understand IAM Capabilities, including the difference between CAPABILITY_IAM and CAPABILITY_NAMED_IAM.

  You also learn to distinguish whether a failed stack deployment is caused by CloudFormation missing a capability, a KMS key policy, or an IAM policy.

  So when you see a question such as:

  “CloudFormation deployment fails when creating a custom-named IAM role”

  if you have done this hands-on before, you can immediately recognize that the answer is the missing CAPABILITY_NAMED_IAM.

• When configuring Systems Manager for EC2, hands-on practice helps clarify the difference between State Manager and Maintenance Window.

  Both are part of Systems Manager. Both use SSM Documents to perform predefined automation on EC2. But in practice, they serve different purposes.

  When you create a State Manager Association yourself, you see that State Manager is designed to continuously enforce configuration and keep resources in the defined state.

  A Maintenance Window, on the other hand, only runs according to a schedule.

  So if you encounter a question such as:

  “How to ensure all instances always remain compliant with a security baseline?”

  once you have done the hands-on work, you can immediately choose State Manager instead of confusing it with Maintenance Window.

• When building a CI/CD pipeline with CodePipeline, you may be asked to verify a deployment by making an external HTTP request.

  CodePipeline does not have a native action for making an HTTP request, so you need to use Lambda to call the URL and check the result.

  When you create a Lambda function yourself and integrate it into the pipeline, you see how Lambda performs the verification step: if the URL returns 200 OK, the pipeline continues. If it fails, the pipeline stops.

  So when you encounter a question such as:

  “How to verify a newly deployed application before promoting to production?”

  if you have done this hands-on, you can immediately identify Lambda Invoke Action in CodePipeline as the optimal solution.

These are just a few examples showing how important hands-on practice is.

The exam is very long, with 75 questions, so hands-on work helps build the reflexes you need to process questions quickly instead of hesitating between multiple answers.

4. Practice Exams

My main sources for practice exams were Tutorials Dojo + Stephane Maarek + Neal Davis + AWS Skill Builder.

My main goal with practice exams was to get used to the timing and pacing of the real exam, while also filling in gaps in areas where my knowledge was still weak.

Tutorials Dojo had the hardest exams.

When I was only halfway through Stephane’s theory slides, I became curious about how difficult the practice exams were, so I jumped straight into a full practice exam.

I failed immediately with only around 60%.

That made it clear that I was not ready to enter the practice exam phase yet, so I stopped there and deliberately did not read the correct answers or explanations. That way, when I came back later, I could retake the test and get a more accurate measurement of my progress.

Their explanations are extremely detailed, and I learned quite a lot from carefully reading through them.

There are three exams on the platform, with several modes such as review mode, timed mode, and topic-based mode.

Around five days before the real exam, I retook all of them and scored around 90% on each one. At that point, I felt pretty confident about taking the exam.

Tutorials Dojo’s practice exams

Stephane’s exams were about as difficult as Tutorials Dojo’s.

There are two exams. I failed both on my first attempt, but I scheduled time to retake them before the real exam and scored above 90% on both.

Stephane Mareek’s practice exams

Neal Davis’s exams were the ones I felt were closest to the actual exam question format.

The exams from the two instructors above are quite long. On my first attempts, I usually reached around question 40 and then gave up because I was exhausted.

Neal Davis instead divides the questions into multiple sets of around 20 to 25 questions rather than full-length tests.

On my first attempt, I scored above 80% on most of those sets.

Neal Davis’s practice exams

AWS Skill Builder also provides a free set of 20 questions and an official practice exam that requires a USD 29/month subscription.

You can check those out as well. I found them quite valuable.

Official Practice Question Set

Official Practice Exam

5. The Testing Center

I registered to take the exam at Viet Professional Co. Ltd, 278 Đ. Ung Văn Khiêm, Phường 25, Bình Thạnh, Thành phố Hồ Chí Minh.

I had taken SAA-C03 there previously, so I chose the same center again because I was already familiar with the equipment and the route.

My exam started at 7:30 AM, and I arrived at the center at 7:00 AM.

The check-in procedure was very quick.

I only needed to bring my citizen ID card and give it to the staff. They took a portrait photo, asked me to sign, and scanned my fingerprint if I had never taken an AWS exam before.

After that, I returned to my seat and waited for the other candidates to finish their check-in procedures before we entered the testing room.

You are not allowed to bring any personal belongings into the exam room. Everything must be stored in a separate locker, with an individual key provided to each candidate.

6. My Experience During the Exam

Because I had a free retake available, I walked into the exam feeling pretty confident.

That said, I still had to take a few Panadol tablets before going in because even when practicing at home, by around question 40 I would usually start feeling dizzy. The exam is long, and it is very easy to lose motivation halfway through.

I had even asked my mother at home to light some incense for our ancestors, so luckily I managed to stay awake and focused until the very end.

On my first pass, I answered everything I could. Questions involving difficult concepts or services I had never seen before were flagged so I could return to them later.

After finishing around half of the exam, I took a 2 to 3 minute break at my desk. I stretched, massaged my eyes, relaxed a little, and tried to avoid becoming stressed or discouraged because the exam really is extremely long.

When I finished question 74, I had 15 minutes remaining.

The final question involved configuring IAM roles and policies inside Organizations. It was a multiple-choice question where I had to choose 3 correct answers.

I was fairly confused by it, but with 15 minutes left, I eventually managed to work through it.

At one point, I almost selected random answers just so I could submit the exam because the question was extremely long and honestly pretty discouraging to look at.

Either I answered it correctly, or it happened to be an unscored question, because I ended up receiving 1000/1000.

I feel extremely lucky to be here writing this article and sharing the experience with everyone.

After completing the survey and everything else, I had exactly 2 minutes left before leaving.

CodeCommit and OpsWorks did not appear anywhere in my exam, so you can probably skip those two services.

However, I recently saw information that AWS has started supporting CodeCommit again, so I do not know whether it might appear in future versions of the exam.

If I had to list the services worth focusing on, they would be:

CodePipeline, including all the services that can integrate into a CI/CD pipeline, CloudWatch, SSM, EKS, IAM, Organizations and Control Tower, CloudFormation, Config, and so on.

Conclusion

This article has become quite long, so thank you to everyone who patiently read all the way to the end.

I hope these experiences provide at least one useful perspective for your own learning and career journey.

Wishing everyone great health, a positive mindset, and continued progress on whichever path you have chosen.

Thank you very much!