CertiBuild, ship, shift
- CodePipeline the stages
- CodeBuild the test and the artifact
- CodeDeploy the revision
- Canary a small share first
Study guide · Flashcards & memory notes
AWS DevOps Flashcards & Memory Notes
50 recall cards for the distinctions DOP-C02 keeps testing: which stage owns the artifact, which ceiling limits an account, and which recovery pattern matches the objective.
How to use these cards: Say the answer out loud before you flip the card, and mark it honestly. Revisit the cards you missed tomorrow rather than rereading them right away. Progress is kept only while this page is open. For the full explanations behind each card, see the core notes.
Study mode
Choose a deck, flip each card, and mark what you already know.
You marked every card in this deck as known. Shuffle and run through it again, or choose another deck.
All flashcards
Select a question to reveal its answer.
Deck 1 · Pipelines
Stages, artifacts, and the shift that can roll back.
1.1What does CodePipeline own?
The sequence of stages. CodeBuild compiles and tests. CodeDeploy ships a revision that already exists.
1.2Where does a rotating build password belong?
AWS Secrets Manager. A repository file or an AMI exposes the password. Parameter Store fits a static secret.
1.3What does CodeArtifact store?
Language packages. Amazon ECR stores the container image. They are not the same repository.
1.4What does a canary shift do?
It sends a small share of traffic first. Blue/green keeps the old copy until you move traffic, so rollback moves it back.
1.5What is an immutable deployment?
A new copy, then a cutover. A mutable deployment changes instances that are already in service.
1.6What fails a CodeBuild test?
A non-zero process exit code. A dashboard that stays green does not fail the build.
1.7What must an EC2 instance have for an in-place CodeDeploy?
The CodeDeploy agent. The agent runs the AppSpec hooks. A load balancer does not.
1.8What should the pipeline record for a container?
The image digest it just pushed. A tag named latest can move and is a poor rollback point.
1.9How does a pipeline deploy into another account?
It assumes a role in that account. Copying root keys into the build is not the cross-account path.
Deck 2 · Infrastructure as code
Templates, accounts, and desired state.
2.1What previews a stack update?
A change set. Drift detection is the later check that the live resource still matches the template.
2.2What deploys one template to many accounts and Regions?
CloudFormation StackSets. AWS RAM shares a resource such as a subnet. It does not deploy the template.
2.3What does a service control policy do?
It sets the maximum permissions for member accounts. It does not grant access, and it does not constrain the management account the way it constrains members.
2.4What reapplies a file after someone deletes it?
A State Manager association. One Run Command does not notice a later deletion.
2.5What is AWS AppConfig for?
Application configuration, with a validator and a gradual release. It is not the VPC and it is not an AMI pipeline.
2.6What vends a new account with a baseline?
AWS Control Tower. A checklist after the account is already in production leaves a gap.
2.7What does the AWS CDK deploy through?
CloudFormation. The CDK synthesizes a template. It does not skip the stack events.
2.8What blocks a Region before the resource exists?
An SCP deny on that Region. A Config rule reports the resource after it exists.
Deck 3 · Resilience
Availability, scale, and the recovery number.
3.1What does RPO measure?
How much data loss, in time, you can accept. RTO is how long you can take to restore service.
3.2Why is Multi-AZ not a Regional disaster plan?
The standby is in the same Region. A Regional failure needs a cross-Region copy and a recovery pattern.
3.3Which pattern has the lowest standing cost?
Backup and restore. Active/active costs the most and recovers the fastest.
3.4What is warm standby?
A scaled-down full copy that you scale out before shifting traffic. Pilot light keeps critical data live and starts the fleet later.
3.5What does a load balancer health check do?
It stops sending traffic to a target that fails the probe. It does not heal an entire Region.
3.6What meets a 15-minute RPO?
A continuous or frequent copy. A nightly snapshot misses that objective.
3.7What does RDS storage autoscaling change?
The allocated disk. It does not add a reader or a second Region.
3.8What is a single NAT gateway across two zones?
A single point of failure for private egress. A gateway VPC endpoint is how S3 can leave that NAT path.
Deck 4 · Monitoring
Metrics, traces, and the alarm that pages.
4.1What does a metric filter produce?
A CloudWatch metric from log lines that match a pattern. It does not page anyone until an alarm or a workflow does.
4.2What collects operating-system memory?
The CloudWatch agent. Basic EC2 monitoring does not include that metric.
4.3What does X-Ray add that a CPU graph does not?
The hop that was slow inside one request. CloudTrail still records who called the API.
4.4What is a metric stream?
An export of metrics, for example to Kinesis Data Firehose or S3. It is not an alarm.
4.5What encrypts a log group with a key you manage?
AWS KMS. The writer needs permission to use the key or new events fail.
4.6What is anomaly detection?
An alarm band learned from the metric's history. A composite alarm evaluates other alarms instead.
4.7What does Amazon Inspector find?
A vulnerable package on an instance or image. Amazon Macie finds sensitive data in S3. GuardDuty finds threats.
4.8What does Logs Insights do?
It queries log groups. It does not notify you until you publish a metric or start a workflow.
Deck 5 · Incident response
Events, queues, and the failed release.
5.1What matches an event and invokes a target?
Amazon EventBridge. AWS Health can send events there. A dashboard does not route them.
5.2What fans one notification out to several subscribers?
Amazon SNS. Amazon SQS buffers work so a slow consumer does not drop it.
5.3What keeps records you can read again while they are retained?
Amazon Kinesis Data Streams. An SNS publish with no queue does not keep the event.
5.4What owns a multi-step remediation with a catch?
AWS Step Functions. A single graph does not retry and branch.
5.5What should a poison queue message hit?
A dead-letter queue after a limited receive count. Retrying it forever blocks the rest of the queue.
5.6What is the first log you open after a failed release?
The failed pipeline stage or the stack events. A random production instance is the second place, not the first.
5.7What does OpsCenter track?
The operational item and the runbooks related to it. An image digest is not an incident record.
5.8What should an EventBridge target have when the consumer can fail?
A retry policy and a dead-letter queue. A shorter timeout only drops the event faster.
Deck 6 · Security
Ceilings, findings, and the exposed key.
6.1What does a permissions boundary limit?
The maximum permissions of one IAM principal. An SCP limits member accounts. Neither one grants access by itself.
6.2How does EC2 get temporary credentials?
An instance profile that delivers a role. An access key in user data is a leaked long-term secret.
6.3What rotates a database password?
AWS Secrets Manager. An AMI and a public object freeze or expose the password.
6.4What finds sensitive data in S3?
Amazon Macie. Inspector finds a vulnerable package. GuardDuty finds threats such as an unusual API call.
6.5What flags a resource shared outside the zone you trust?
IAM Access Analyzer. A CPU alarm does not read the resource policy.
6.6How do security groups differ from network ACLs?
Security groups are stateful. Network ACLs are stateless. An ACL needs an explicit allow for return traffic.
6.7What filters an HTTP request pattern?
AWS WAF. Shield is DDoS protection. Network Firewall sits on the VPC path, not on the HTTP rule.
6.8What is the first step when an access key is exposed?
Disable the key, then review CloudTrail. Deleting the trail hides what the key already did.
6.9Which trail can a member account not turn off?
An organization trail. A trail the member account owns can be stopped by that account.
Memory notes
Groupings that make the highest-yield DOP-C02 distinctions easier to recall.
Preview, then ceiling
A change set previews one update. StackSets lands it in many accounts. An SCP limits member accounts and does not grant. State Manager puts a file back.
Loss versus downtime
RPO is data you can lose. RTO is time you can be down. Multi-AZ is a same-Region failover. A Regional disaster needs backup and restore, pilot light, warm standby, or active/active.
Count, then page
A metric filter makes a number. An alarm pages. Logs Insights only queries. X-Ray names the slow hop. CloudTrail names the API caller.
Keep the event
EventBridge routes it. SNS notifies. SQS or a dead-letter queue keeps a failure. Step Functions owns the sequence. Roll back the revision the stage actually shipped.
Allow versus ceiling
IAM can allow. A boundary limits one principal. An SCP limits member accounts. Disable an exposed key before you read the trail. A finding stays open until you remediate it.
Continue the AWS DevOps study path
Test what you have learned with a timed practice exam.
Overview
Exam format, the 750 passing score, domain weights, and a study plan.
Core Notes
Reference notes for pipelines, infrastructure as code, recovery, monitoring, and security.
Flashcards & Memory Notes
50 recall cards in six decks, plus memory notes for releases, accounts, recovery, and guardrails.
Practice Exams
200 original questions with custom exams, explanations, and a score report by domain.
Related Tools
Useful companions while you study.
JSON YAML Converter
Convert structured data between JSON and YAML with formatting and validation.
Base64 Converter
Encode text and files to Base64 or decode Base64 data with UTF-8 support.
Diff Checker
Compare two text blocks and highlight added, removed, and changed content.
CSV JSON Converter
Convert CSV spreadsheet data to JSON or turn JSON arrays into downloadable CSV files.
Legal Disclaimer
Certicab provides general informational, educational, and convenience resources. Calculations, conversions, estimates, and learning materials may contain errors or become outdated. Financial, tax, medical, legal, and travel information is not professional advice. Verify important results and current requirements with qualified professionals or authoritative sources. Protect sensitive files and personal information, review each tool’s privacy limitations, and use only content you are authorized to process. You are responsible for how you use and share results. Study resources are independent and do not guarantee exam success or imply certification-provider endorsement. Amazon Web Services, AWS, and related marks are trademarks of Amazon.com, Inc. or its affiliates. Certicab is not affiliated with, endorsed by, or sponsored by Amazon.