Based on the DOP-C02 exam guideReport an error

DOP-C02· ProWeek 16 · Day 4~54 min read

Day 4 - Full Mock Exam: A Comprehensive Check of the 6 Domains at Real 75-Question Pace

Today is the grand wrap-up of the 16 weeks of study. The real DOP-C02 is an exam of 75 questions (65 scored + 10 unscored) in 180 minutes, and the passing line is 750 out of 1000 points (about 75%). The real value of a mock exam is not the score itself but three things it reveals. First, pace (a feel for about 2 minutes 24 seconds per question); second, domain weaknesses (in which area does your accuracy collapse); and third, trap pattern recognition (why you were drawn to an attractive wrong answer). The 50 questions in this article reflect the real exam's domain weighting as is, and the explanation of each question digs into not only "why the correct answer is right" but also "why the wrong answers are attractive traps", training the ability to decide by clues after narrowing down to the last 2 in the exam room.

Let's engrave the solving tips once more. (1) Circle the qualifiers such as "MOST cost-effective," "LEAST operational overhead," "MINIMUM changes," and "automatically": when two options both work, the qualifier decides the answer. (2) A service name you see for the first time is usually a trap wrong answer. (3) If you agonize for more than 2 minutes, mark it immediately, move on, and come back at the end. (4) No blank answers: even with a 50% chance, always fill in an answer.

Exam Mechanics - Unscored Questions and the Meaning of the Score Scale

🔍 Going deeper: In an AWS exam, 10 of the 75 questions are unscored pilot questions (for collecting statistics for future exams; the test taker does not know which ones are unscored). So you must assume "every question counts toward the score" and solve them all seriously. The score is a scaled score (100-1000), a value in which the raw score (the number correct) is adjusted for the difficulty of the exam version. That is, 750 is not "exactly N of 65 questions" but a statistically adjusted passing line, and getting about 72-75% of the scored questions right is usually considered the safe zone. The result report shows "meets/does not meet (competency)" for each domain, but domain scores do not directly decide a pass (only the total score decides pass/fail); they are used only to identify weak domains. If you score under 75% on the mock exam, there is still time to reinforce the lacking domains with day1-3.

📝 Practice Questions

Click a choice to reveal the answer and explanation.

Question 1

You want to provide a standard CI/CD pipeline as self-service to 50 microservice teams while enforcing company standards. What is the most suitable?

Question 2

What must be in place when a CodePipeline in the Tooling account deploys cross-account to a Spoke account?

Question 3

You want to deploy a Lambda function in two stages: "send only 50% for 5 minutes, then the remaining 50% if there are no problems."

Question 4

You deploy an ECS service with Blue/Green and want to test the new version before switching production traffic.

Question 5

CodeBuild must access ECR, S3, and Secrets Manager from a private VPC with the internet blocked. What is most appropriate?

Question 6

You want to automatically check code quality and security vulnerabilities when a PR is opened.

Question 7

You want to verify at deployment that a container image has not been tampered with since it was built.

Question 8

You want to automatically block deployments during a production change freeze period (such as year-end).

Question 9

You want GitHub Actions to deploy to AWS without static access keys.

Question 10

You want to roll back automatically if the error-rate alarm fires during a Lambda Canary deployment.

Question 11

You want a CodePipeline to run only when a specific path in a monorepo changes and to pass dynamic variables.

Question 12

You want to deploy the same security baseline to 60 accounts and apply it automatically to accounts newly entering the OU as well.

Question 13

You want to preview which resources will be created, modified, or deleted before applying a CloudFormation change.

Question 14

During a CloudFormation stack deployment, you must call an external SaaS API to register a resource.

Question 15

You want a CI/CD in which the pipeline itself updates itself as the code changes.

Question 16

You want multiple teams to share Terraform State safely and prevent concurrent modification conflicts.

Question 17

You want to rotate RDS credentials automatically every 90 days without the application code having to change.

Question 18

You want to roll out feature flags gradually and block incorrect configuration values before deployment.

Question 19

You want to manage patching of 5,000 on-premises servers the same way as EC2.

Question 20

You want to periodically and automatically detect whether resources managed by CloudFormation have been changed externally in the console.

Question 21

Multi-Region DR for a relational DB with an RTO of 1 minute and an RPO of under 1 second.

Question 22

You need a key-value store that reads and writes simultaneously in two Regions.

Question 23

Provide global users with failover within 1 second and a fixed IP that does not change.

Question 24

What is the key characteristic of the Pilot Light DR strategy?

Question 25

You must guarantee replication of S3 objects to another Region with a 15-minute SLA.

Question 26

You want to automate DR failover but make sure the failover procedure is not affected by a failure of the primary Region.

Question 27

You want to verify in a controlled way that your resilience design works in a real failure.

Question 28

Integrate the metrics, logs, and traces of 30 accounts into a single dashboard.

Question 29

Publish high-cardinality custom metrics from Lambda in a cost- and performance-efficient way.

Question 30

Branch container logs to CloudWatch, S3, and OpenSearch at the same time.

Question 31

Trace the causality of where requests between microservices slow down.

Question 32

Monitor availability by periodically running synthetic tests of API/UI behavior even when there are no users.

Question 33

Collect page performance and errors of real end users from the browser.

Question 34

Retain several TB of logs at low cost for the long term and occasionally run large-scale analysis (the cost of Logs Insights is a burden).

Question 35

You want managed observability compatible with open-source Prometheus/Grafana.

Question 36

What is the standard entry point for automated response to security and operational signals?

Question 37

You are building a complex incident Runbook that needs multiple steps, retries, and an audit trail.

Question 38

You want to obtain human approval just before a risky action during an SSM Runbook execution.

Question 39

Safely run limited AWS CLI commands from Slack and receive notifications.

Question 40

Automate on-call paging and Post-Incident Analysis when an incident occurs.

Question 41

Automatically reprocess (re-drive) SQS DLQ messages while preventing infinite loops.

Question 42

Receive AWS-side events such as scheduled EC2 maintenance and route the automated response.

Question 43

Enable GuardDuty in 60 accounts and include new accounts automatically.

Question 44

Aggregate Security Hub Findings from all Regions into a single Region.

Question 45

Automatically block an S3 bucket if it becomes public.

Question 46

Automatically collect and report SOC 2 audit evidence (Config, CloudTrail, and SH enabled).

Question 47

Automatically scan and prioritize software vulnerabilities (CVEs) in EC2, Lambda, and ECR.

Question 48

Automatically detect and report whether S3 contains PII.

Question 49

Verify before deployment whether an IAM policy has the potential for external sharing.

Question 50

Let on-premises servers call AWS APIs without static access keys.

📊 Weakness Analysis Guide

After grading, calculate the accuracy per domain and decide the final reinforcement areas with the following criteria.

Accuracy	Verdict	Action
90%+	Stable	⭐ Only a light review of key points
75-89%	Passing range	Wrong-answer notebook + recheck trap patterns
60-74%	At risk	Reread the day1-3 narrative of that domain + read the boxes closely
<60%	Needs reinforcement	Restudy that Week's main material (starting from concepts)

🎯 Scenario (a weakness diagnosis example): If you keep getting "Inspector vs GuardDuty vs Macie" wrong in Domain 6, it is not simple lack of memorization but the classification of "what does it look at (the signal source)" has not taken hold. Review day3's detection service division-of-labor table (behavior/CVE/PII/exposure/causality) again, and train to map immediately by the noun clues in the question (CVE, PII, external exposure, signs of compromise). If you keep getting Canary/Linear wrong in Domain 1, re-engrave the structural difference from day1: "Canary = 2 stages, Linear = even increments." It is efficient to narrow weaknesses down not to "which domain" but to "which conceptual axis."

⭐ Key Points

⭐ Securing a feel for pace (2 min 24 s per question) is the biggest takeaway: mark anything over 2 minutes immediately.
⭐ You must analyze "why the wrong answers are attractive traps" so that you win after narrowing to 2 in the exam room.
⭐ Qualifiers (MOST/LEAST/cost-effective/automatically) break ties between options.
⭐ For domains with accuracy under 75%, reinforce with the day1-3 narrative before day5.
⭐ Narrow weaknesses down to "conceptual axes" (classification, structure, cost), not domains.

📌 Today's Summary

The real exam is 75 questions (including 10 unscored), 180 minutes, with a passing score of 750 (scaled), and the 50 mock questions here reflect the domain weighting.
Analyze the trap reason behind each wrong answer to train the ability to "narrow down to the last 2."
Identify weaknesses by per-domain accuracy but narrow them down by "conceptual axis."
Intensively reinforce domains under 75% with day1-3 before day5.
Next (day5) wraps up with a D-Day checklist and a short final mock.

Official references

Day 4 - Full Mock Exam: A Comprehensive Check of the 6 Domains at Real 75-Question Pace

Exam Mechanics - Unscored Questions and the Meaning of the Score Scale

🔍 Going deeper: In an AWS exam, 10 of the 75 questions are unscored pilot questions (for collecting statistics for future exams; the test taker does not know which ones are unscored). So you must assume "every question counts toward the score" and solve them all seriously. The score is a scaled score (100-1000), a value in which the raw score (the number correct) is adjusted for the difficulty of the exam version. That is, 750 is not "exactly N of 65 questions" but a statistically adjusted passing line, and getting about 72-75% of the scored questions right is usually considered the safe zone. The result report shows "meets/does not meet (competency)" for each domain, but domain scores do not directly decide a pass (only the total score decides pass/fail); they are used only to identify weak domains. If you score under 75% on the mock exam, there is still time to reinforce the lacking domains with day1-3.

📝 Practice Questions

Click a choice to reveal the answer and explanation.

Question 1

You want to provide a standard CI/CD pipeline as self-service to 50 microservice teams while enforcing company standards. What is the most suitable?

Question 2

What must be in place when a CodePipeline in the Tooling account deploys cross-account to a Spoke account?

Question 3

You want to deploy a Lambda function in two stages: "send only 50% for 5 minutes, then the remaining 50% if there are no problems."

Question 4

You deploy an ECS service with Blue/Green and want to test the new version before switching production traffic.

Question 5

CodeBuild must access ECR, S3, and Secrets Manager from a private VPC with the internet blocked. What is most appropriate?

Question 6

You want to automatically check code quality and security vulnerabilities when a PR is opened.

Question 7

You want to verify at deployment that a container image has not been tampered with since it was built.

Question 8

You want to automatically block deployments during a production change freeze period (such as year-end).

Question 9

You want GitHub Actions to deploy to AWS without static access keys.

Question 10

You want to roll back automatically if the error-rate alarm fires during a Lambda Canary deployment.

Question 11

You want a CodePipeline to run only when a specific path in a monorepo changes and to pass dynamic variables.

Question 12

You want to deploy the same security baseline to 60 accounts and apply it automatically to accounts newly entering the OU as well.

Question 13

You want to preview which resources will be created, modified, or deleted before applying a CloudFormation change.

Question 14

During a CloudFormation stack deployment, you must call an external SaaS API to register a resource.

Question 15

You want a CI/CD in which the pipeline itself updates itself as the code changes.

Question 16

You want multiple teams to share Terraform State safely and prevent concurrent modification conflicts.

Question 17

You want to rotate RDS credentials automatically every 90 days without the application code having to change.

Question 18

You want to roll out feature flags gradually and block incorrect configuration values before deployment.

Question 19

You want to manage patching of 5,000 on-premises servers the same way as EC2.

Question 20

You want to periodically and automatically detect whether resources managed by CloudFormation have been changed externally in the console.

Question 21

Multi-Region DR for a relational DB with an RTO of 1 minute and an RPO of under 1 second.

Question 22

You need a key-value store that reads and writes simultaneously in two Regions.

Question 23

Provide global users with failover within 1 second and a fixed IP that does not change.

Question 24

What is the key characteristic of the Pilot Light DR strategy?

Question 25

You must guarantee replication of S3 objects to another Region with a 15-minute SLA.

Question 26

You want to automate DR failover but make sure the failover procedure is not affected by a failure of the primary Region.

Question 27

You want to verify in a controlled way that your resilience design works in a real failure.

Question 28

Integrate the metrics, logs, and traces of 30 accounts into a single dashboard.

Question 29

Publish high-cardinality custom metrics from Lambda in a cost- and performance-efficient way.

Question 30

Branch container logs to CloudWatch, S3, and OpenSearch at the same time.

Question 31

Trace the causality of where requests between microservices slow down.

Question 32

Monitor availability by periodically running synthetic tests of API/UI behavior even when there are no users.

Question 33

Collect page performance and errors of real end users from the browser.

Question 34

Retain several TB of logs at low cost for the long term and occasionally run large-scale analysis (the cost of Logs Insights is a burden).

Question 35

You want managed observability compatible with open-source Prometheus/Grafana.

Question 36

What is the standard entry point for automated response to security and operational signals?

Question 37

You are building a complex incident Runbook that needs multiple steps, retries, and an audit trail.

Question 38

You want to obtain human approval just before a risky action during an SSM Runbook execution.

Question 39

Safely run limited AWS CLI commands from Slack and receive notifications.

Question 40

Automate on-call paging and Post-Incident Analysis when an incident occurs.

Question 41

Automatically reprocess (re-drive) SQS DLQ messages while preventing infinite loops.

Question 42

Receive AWS-side events such as scheduled EC2 maintenance and route the automated response.

Question 43

Enable GuardDuty in 60 accounts and include new accounts automatically.

Question 44

Aggregate Security Hub Findings from all Regions into a single Region.

Question 45

Automatically block an S3 bucket if it becomes public.

Question 46

Automatically collect and report SOC 2 audit evidence (Config, CloudTrail, and SH enabled).

Question 47

Automatically scan and prioritize software vulnerabilities (CVEs) in EC2, Lambda, and ECR.

Question 48

Automatically detect and report whether S3 contains PII.

Question 49

Verify before deployment whether an IAM policy has the potential for external sharing.

Question 50

Let on-premises servers call AWS APIs without static access keys.

📊 Weakness Analysis Guide

After grading, calculate the accuracy per domain and decide the final reinforcement areas with the following criteria.

Accuracy	Verdict	Action
90%+	Stable	⭐ Only a light review of key points
75-89%	Passing range	Wrong-answer notebook + recheck trap patterns
60-74%	At risk	Reread the day1-3 narrative of that domain + read the boxes closely
<60%	Needs reinforcement	Restudy that Week's main material (starting from concepts)

🎯 Scenario (a weakness diagnosis example): If you keep getting "Inspector vs GuardDuty vs Macie" wrong in Domain 6, it is not simple lack of memorization but the classification of "what does it look at (the signal source)" has not taken hold. Review day3's detection service division-of-labor table (behavior/CVE/PII/exposure/causality) again, and train to map immediately by the noun clues in the question (CVE, PII, external exposure, signs of compromise). If you keep getting Canary/Linear wrong in Domain 1, re-engrave the structural difference from day1: "Canary = 2 stages, Linear = even increments." It is efficient to narrow weaknesses down not to "which domain" but to "which conceptual axis."

⭐ Key Points

⭐ Securing a feel for pace (2 min 24 s per question) is the biggest takeaway: mark anything over 2 minutes immediately.

⭐ You must analyze "why the wrong answers are attractive traps" so that you win after narrowing to 2 in the exam room.

⭐ Qualifiers (MOST/LEAST/cost-effective/automatically) break ties between options.

⭐ For domains with accuracy under 75%, reinforce with the day1-3 narrative before day5.

⭐ Narrow weaknesses down to "conceptual axes" (classification, structure, cost), not domains.

📌 Today's Summary

The real exam is 75 questions (including 10 unscored), 180 minutes, with a passing score of 750 (scaled), and the 50 mock questions here reflect the domain weighting.

Analyze the trap reason behind each wrong answer to train the ability to "narrow down to the last 2."

Identify weaknesses by per-domain accuracy but narrow them down by "conceptual axis."

Intensively reinforce domains under 75% with day1-3 before day5.

Next (day5) wraps up with a D-Day checklist and a short final mock.