In this article
How the questions are ordered
The official exam guide from Amazon Web Services for the exam with the code DOP-C02 lists six domains with these weights: software delivery automation 22 percent, configuration management and infrastructure as code 17 percent, resilient cloud solutions 15 percent, monitoring and logging 15 percent, incident and event response 14 percent, and security and compliance 17 percent. They add up to 100, and the first two together are 39.1
The sections below follow that order, except that the two network-security questions sit under security. The guide describes an exam, not any employer's interview, so treat the weights as a map of what AWS considers core DevOps skill, not as a prediction of what one company asks. Interview questions in this list are written in our own words. For the study order across the whole topic, see DevOps interview questions: what to learn, in what order.
Text description of the diagram
- Software delivery automation is 22 percent, configuration management and infrastructure as code 17 percent.
- Resilient cloud solutions and monitoring and logging are 15 percent each, incident and event response 14 percent, security and compliance 17 percent.
Software delivery and pipelines
What is CI/CD, and how do you build it on AWS?
Continuous integration (CI) and continuous delivery (CD) together form a pipeline that builds and tests every code change and then releases it in repeatable stages. On AWS, AWS CodePipeline runs the stages, AWS CodeBuild compiles and tests the code, and AWS CodeDeploy rolls the release out; the exam guide names all three under pipeline skills (AWS exam guide, read October 2026). Note that CD can mean continuous delivery, where a manual approval gate precedes release, or continuous deployment, where every passing change ships automatically. Say what triggers the pipeline and what stops a bad build.
Why it is asked: it shows whether you can describe delivery as stages with gates. Read the full explanation: What is a CI/CD pipeline, and how does it work?
How do you keep secrets out of a pipeline?
Store them in a managed secret store and fetch them at run time, never in the repository or in plain build settings. The exam guide names AWS Secrets Manager and AWS Systems Manager Parameter Store for this (AWS exam guide, read October 2026). Give the build role permission to read only the secrets it needs, and mention rotating a secret that has leaked.
Why it is asked: leaked credentials are a routine pipeline failure. Source: Security best practices in AWS Identity and Access Management (IAM).
What deployment strategies would you use with CodeDeploy?
CodeDeploy deploys to Amazon Elastic Compute Cloud (EC2) and on-premises instances, Lambda functions and Amazon Elastic Container Service (ECS) services (CodeDeploy guide, read October 2026). On EC2 it runs in-place deployments, a few instances at a time, or blue/green deployments to a replacement fleet; the guide says blue/green works with EC2 instances only. On Lambda and ECS it shifts traffic by a canary or linear configuration, in increments. Choose by how fast you need rollback and how much spare capacity you can afford.
Why it is asked: it tests release risk thinking. Source: CodeDeploy user guide.
Knowing it is half the job. Saying it is the other half.
Interview Clozo is an AI interview copilot for real interview rounds: it hears the question and puts a strong answer on your screen, and you say it in your own words. See the features or how it works.
Start Free Trial →Infrastructure as code and configuration
What is CloudFormation, and what do change sets and StackSets add?
Infrastructure as code (IaC) is the practice of describing cloud resources in files that tools create and update, and CloudFormation is the AWS service that does it from templates written in JavaScript Object Notation (JSON) or YAML, or generated with the AWS Cloud Development Kit (CDK). A change set previews what an update will change before it runs, and StackSets deploy resources across several accounts and regions (AWS DevOps Blog, CloudFormation 2025 review).
Why it is asked: it separates people who click in the console from people who version infrastructure. Read the full explanation: How does Terraform work, and why does state matter?, which explains the same infrastructure-as-code idea with a different tool.
What is configuration drift, and how do you handle it?
Configuration drift is a mismatch between what your template says and what the live resources are, usually because someone edited a resource by hand. AWS explains that drift can cause unexpected changes in later infrastructure-as-code deployments and can leave resources out of compliance (AWS DevOps Blog, read October 2026). Detect it, then fix the template or the resource, and review drift-aware change sets before deploying.
Why it is asked: it tests whether you treat templates as the source of truth. Read the full explanation: How does Terraform work, and why does state matter?, where the gap between recorded and real state is the central idea.
What does a drift-aware change set compare?
A drift-aware change set compares three things before deployment: the new template, the previous template and the actual state of the resources. That lets you see an out-of-band edit that the next deployment would overwrite, instead of discovering it afterwards (AWS DevOps Blog, read October 2026). Say the practical rule: review the change set, never apply an update blind.
Why it is asked: it checks that you know how to deploy safely over a drifted stack. Source: Safely handle configuration drift.
Resilient cloud solutions
How does EC2 Auto Scaling keep an application available?
Amazon EC2 Auto Scaling launches or terminates instances automatically based on policies you define, health checks and schedules (Amazon EC2 Auto Scaling guide, read October 2026). An unhealthy instance is replaced, and a scaling policy adds capacity as load grows. For resilience, spread the group across several Availability Zones, which are separate locations inside a region, so one failure does not take everything down.
Why it is asked: it tests whether you design for failure, not for the happy path. Read the full explanation: AWS interview questions on EC2, with answers.
Monitoring and logging
What is the difference between CloudWatch and CloudTrail?
Amazon CloudWatch collects metrics, logs and alarms about how your systems are running (CloudWatch guide, read October 2026). AWS CloudTrail records actions taken in your account as events, so it answers who changed what and when (CloudTrail guide, read October 2026). Console actions are recorded too, because the console makes application programming interface (API) calls on your behalf. Use CloudWatch to notice a problem and CloudTrail to trace a change that may have caused it, such as a console edit that created drift.
Why it is asked: it separates performance monitoring from audit. Source: the CloudWatch and CloudTrail guides linked above.
How do you design alerts that people do not ignore?
Alert on symptoms users feel, such as error rate or slow responses, not on every internal metric, and attach each alert to a clear action. Route urgent alerts to a person and the rest to a ticket queue. A strong answer also names how you retire an alert that never leads to action, because noisy alerts train people to ignore the real one.
Why it is asked: it tests judgement about on-call load. Related reading: DevOps interview questions: what to learn, in what order.
Incident and event response
A deploy has caused an outage. What do you do first?
Restore service first and investigate second: stop the rollout and roll back to the last good version, or shift traffic back if you used blue/green. Then check what changed, using deployment history and the audit trail, and look for manual edits that created drift. Communicate status while you work, and write down what you saw for the review afterwards.
Why it is asked: it shows whether you put recovery ahead of curiosity. Read the full explanation: What to do when a deploy broke production.
What goes into a good post-incident review?
A timeline of events, the impact, the contributing causes and the follow-up actions with owners. A strong answer focuses on how the system and process allowed the failure, not on who made the mistake, and ends with a change that would catch it earlier, such as a pipeline gate or an alert. Keep the review short enough that people actually read it.
Why it is asked: it tests whether you turn incidents into prevention. Read the full explanation: What to do when a deploy broke production, which covers what follows the fix.
Security and compliance
Why use IAM roles instead of long-lived access keys?
Roles give temporary credentials that expire, so a leaked one has a short useful life; a stored key stays valid until someone rotates it. AWS Identity and Access Management (IAM) guidance recommends roles with temporary credentials for both human users and workloads (IAM User Guide, read October 2026). An instance or a build job should assume a role instead of holding a key.
Why it is asked: embedded keys are a common cause of breaches. Source: Security best practices in IAM.
What is least privilege, and how do you apply it?
Least privilege is granting only the actions needed, on specific resources, under specific conditions. In practice, start from no access and add what a job proves it needs, rather than starting broad and trimming. AWS lists IAM Access Analyzer, permissions boundaries and removing unused credentials among its recommended practices (IAM User Guide, read October 2026).
Why it is asked: it tests whether you can name concrete controls. Source: Security best practices in IAM.
When must you require multi-factor authentication?
Wherever an IAM user or the root user cannot be avoided, AWS recommends requiring multi-factor authentication (MFA), and it recommends phishing-resistant MFA, such as passkeys and security keys, wherever possible (IAM User Guide, read October 2026). Better still, reduce the number of such users by using roles and a central sign-in for people.
Why it is asked: it checks that you protect the most powerful credentials first. Source: Security best practices in IAM.
What is the difference between a security group and a network ACL?
A security group attaches to a resource, is stateful and has allow rules only (Amazon Virtual Private Cloud (VPC) security groups guide, read October 2026). A network access control list (ACL) sits at the subnet, is stateless, has allow and deny rules, and evaluates its rules in numbered order, lowest first, stopping at the first match (Amazon VPC network ACLs guide, read October 2026). Stateful means a reply to allowed traffic is let through automatically; stateless means it is not.
Why it is asked: it is the standard network-layers question. Source: the two VPC guides linked above.
The security group allows the traffic, but it still fails. Why?
A subnet network ACL can still block it. Because network ACLs are stateless, they need explicit rules in both directions: if you allow inbound Transmission Control Protocol (TCP) traffic on a web port, you must also allow the outbound reply on the high-numbered ephemeral ports, which the client chooses from a high-numbered range, or the response is dropped. A security group needs no matching outbound rule for a reply. Check both the security group and the network ACL, and the subnet's route table too.
Why it is asked: it tests a real debugging order. Source: Amazon VPC network ACLs guide.
Follow-up questions
What do AWS DevOps interview questions and answers cover?
They cover the same six areas as the certification guide: delivery pipelines, infrastructure as code, resilience, monitoring, incident response and security. Expect to explain a trade-off, such as blue/green against an in-place deployment, and not only name a service. The learning path for DevOps and cloud interviews shows the order to study them in.
What is the difference between mutable and immutable deployments?
A mutable deployment updates the existing servers in place; an immutable deployment replaces them with new ones built from a fresh image, so no server is changed after it starts. The exam guide names both strategies. Immutable makes rollback simple and avoids drift on servers, at the cost of more capacity during the switch.
How should I practise answering AWS DevOps questions?
Say each answer aloud in under a minute: definition, then the trade-off, then one failure you have seen or can reason about. Practise the design-style questions with the system design guide and prepare the opening motivation question with why you chose DevOps.
What should I learn after AWS for a DevOps interview?
Container orchestration and the command line are the usual next topics. Work through the Kubernetes interview questions and the Linux commands guide.
- The official exam guide has six domains, with software delivery automation the largest.
- Prefer IAM roles with temporary credentials, least privilege and MFA over long-lived keys.
- Templates are the source of truth; drift from console edits is reviewed through change sets.
- Security groups are stateful and allow-only; network ACLs are stateless and need rules both ways.
- In an outage, restore service first, then find the change.
Sources
- AWS Certified DevOps Engineer - Professional Exam Guide (DOP-C02) — Amazon Web Services, 26 Oct 2026
- Security best practices in IAM — AWS IAM User Guide, 26 Oct 2026
- Safely Handle Configuration Drift with CloudFormation Drift-Aware Change Sets — AWS DevOps & Developer Productivity Blog, 26 Oct 2026
- AWS CloudFormation 2025 Year In Review — AWS DevOps & Developer Productivity Blog, 26 Oct 2026
- Control traffic to your AWS resources using security groups — Amazon VPC User Guide, 26 Oct 2026
- Control subnet traffic with network access control lists — Amazon VPC User Guide, 26 Oct 2026
- What is Amazon CloudWatch? — Amazon CloudWatch User Guide, 26 Oct 2026
- What is AWS CloudTrail? — AWS CloudTrail User Guide, 26 Oct 2026
- What is CodeDeploy? — AWS CodeDeploy User Guide, 26 Oct 2026
- What is Amazon EC2 Auto Scaling? — Amazon EC2 Auto Scaling User Guide, 26 Oct 2026
