AWS 423: DOP-C02 final readiness review
Purpose
This board makes one of three evidence-based decisions: ready, ready after named remediation, or defer. Completing 423 lessons does not itself make someone an expert or guarantee certification. Readiness means the learner can independently design, implement, diagnose, secure, operate and explain AWS systems, knows the limits of evidence, and has a dated plan for remaining gaps.
Required portfolio
The learner presents cumulative architecture decisions, laboratories and operational evidence rather than screenshots alone. Every artifact identifies requirements, date/version, account/Region context, source references, assumptions, security/cost, failure tests, cleanup and what the evidence cannot prove.
| Portfolio area | Minimum decisive evidence |
|---|---|
| Foundations/architecture | Account, IAM, network, compute, storage, database and DNS designs with rejected alternatives |
| Delivery/IaC | Immutable pipeline, change plans, policies, progressive deploy and drift/recovery proof |
| Resilience/observability | SLI/SLO, capacity, RTO/RPO, restore/game-day and user-level verification |
| Incident operations | Evidence timeline, safe containment, communications, reconciliation and corrective-action tests |
| Security/compliance | Temporary identity, artifact/secret trust, coverage, guardrails and protected audit evidence |
| Economics/ownership | Workload cost model, budgets, tagging, retention and cleanup ledger |
AWS420 and AWS421 must pass independent review. The reviewer should be able to trace source to runtime bytes, request to dependency/data, alert to owner/action, backup to verified recovery and API event to protected audit object.
Certification evidence
Require two independently worded timed sets, not repeated memorization. Minimum course gate: 85% overall on each, at least 75% in every DOP-C02 domain, all safety-critical questions correct, no more than two high-confidence errors per set and at least 85% on changed remediation cases. This is a learning threshold, not AWS's scaled-score formula.
Review the current official exam guide, technologies/services list and logistics. The current public overview lists 75 multiple-choice/multiple-response questions in 180 minutes and a 300 USD fee, subject to current regional pricing/policy. Confirm directly before booking.
Map every wrong/uncertain answer to the exact domain task and earlier lesson. A gap is closed only after the learner explains the semantic rule, rejects distractors, solves a changed case and, for operational topics, produces practical evidence.
Oral architecture defense
Without notes, the learner receives an unfamiliar regulated web workload with growth, multi-account, hybrid connectivity, RTO/RPO, deployment-frequency, data-residency and budget constraints. In 45 minutes produce context/container/data/identity/network/deployment/telemetry/recovery views and five ADRs.
The panel challenges assumptions: one AZ/Region/control plane fails; identity provider unavailable; target writes occur after failover; KMS key disabled; quota exhausted; scan/telemetry coverage missing; security incident overlaps release. The learner must distinguish fact/assumption/unknown, request evidence, quantify tradeoffs, preserve safety and modify the design without hand-waving.
Practical defense
Using supplied policies, events, metrics/logs/traces and failed deployment histories, complete six tasks under review:
- Evaluate a cross-account request through trust, identity, resource, key, boundary/session and SCP controls.
- Trace source revision to signed runtime digest and detect substitution.
- Review an IaC change set for replacement, data and rollback risk.
- Diagnose a user-impact incident from competing evidence and choose containment.
- Calculate error budget, deployment capacity, queue drain and observed RPO/RTO.
- Validate audit coverage/integrity and write a corrective action with acceptance test.
The learner may consult official documentation as real architects do, but must explain why the source applies and what remains unproven. Unsafe mutation, invented evidence, exposed secrets or irreversible action without approval is an automatic defer.
Readiness rubric
| Dimension | Weight | Ready evidence |
|---|---|---|
| Architecture/tradeoffs | 20 | Requirements-led alternatives and failure-aware decisions |
| Implementation/delivery | 20 | Reproducible least-privilege source-to-runtime chain |
| Operations/recovery | 20 | Measured user/data outcomes and tested recovery |
| Security/governance | 20 | Effective-policy reasoning, coverage and protected evidence |
| Communication/growth | 10 | Clear diagrams, decisions, incidents and honest uncertainty |
| Certification scenarios | 10 | Timed/domain/retest gates met |
Ready requires 85/100 overall, at least 70% of each dimension, no automatic defer, AWS420/AWS421 accepted, both timed sets passed and all critical remediation closed. Reviewer and learner sign the evidence index and date the decision.
Ready after remediation lists exact gaps, owner, source lesson, required changed task/evidence and review date. Defer applies when foundational safety, independent practical work or repeated domain weakness remains. Do not book an expensive exam to discover gaps already visible in evidence.
First 90 days after the course
Expertise grows through operated systems. Build a 30/60/90-day plan: maintain one budgeted portfolio workload, run monthly releases and failure/recovery exercises, review cost/security/operational metrics, contribute runbook or IaC reviews, study release notes, and conduct a monthly architecture defense with changed constraints. Record decisions and incidents, including mistakes.
After certification, continue from workload responsibility rather than collecting credentials alone. Choose the next specialty or project based on job needs and portfolio gaps. Revalidate knowledge as AWS capabilities, exam guides and organizational controls change.
Final submission
Submit portfolio index, AWS420/421 dossiers, two timed-set reports, remediation evidence, oral/practical defense artifacts, rubric, exam-logistics verification and 90-day plan. The board decision must cite evidence for every gate. Production publication of this course remains a separate owner decision and is not authorized by learner completion.