Domain 1: Monitoring, Logging, Analysis, Remediation, and Performance Optimization
- The CloudWatch unified agent must be installed on EC2 to collect OS-level metrics like memory utilization and disk space; these are NOT available from the default hypervisor-level metrics.
- CloudWatch standard metric resolution is 60 seconds; publish with StorageResolution=1 (via PutMetricData) to enable 1-second high-resolution custom metrics.
- New CloudWatch Logs log groups default to 'Never expire'; use aws logs put-retention-policy --retention-in-days 30 to set retention explicitly.
- A CloudWatch Logs metric filter scans log streams for a pattern (e.g. 'ERROR') and converts matches into a custom metric that can drive an alarm.
- CloudWatch Logs Insights queries large log volumes interactively; the two CLI calls are aws logs start-query (returns a queryId) and aws logs get-query-results.
- aws cloudwatch put-metric-alarm needs --namespace, --metric-name, --period (e.g. 300), and --evaluation-periods (e.g. 2); aws cloudwatch put-metric-data --namespace --metric-name --value publishes a single custom data point.
- Configure how an alarm treats missing data (notBreaching, breaching, ignore, missing) to stop it from flipping to INSUFFICIENT_DATA unexpectedly.
- A CloudWatch anomaly-detection alarm builds a trained band from historical data and handles seasonality without a fixed static threshold.
- A composite alarm combines multiple child alarm states with AND/OR logic and notifies only on the composite condition, reducing alarm noise.
- AWS Config rules can trigger Systems Manager Automation documents to auto-remediate non-compliant resources; EventBridge rules can target Lambda or SSM Automation for event-driven remediation.
- An EventBridge rule matching a specific CloudTrail API event (e.g. AuthorizeSecurityGroupIngress) with a Lambda target gives near-real-time remediation of risky changes.
- Common reasons an EventBridge rule does not fire: missing S3 event notification configuration and a missing Lambda resource-based policy granting EventBridge invoke permission.
- For cost-effective long-term log retention and analysis, export CloudWatch Logs to S3 via a subscription filter and query with Amazon Athena rather than keeping everything in CloudWatch Logs.
- Enable CloudTrail log file integrity validation and deliver logs to a separate restricted logging account for tamper-evident auditing; use AWS X-Ray distributed tracing to find latency bottlenecks across microservices.
- Right-size over-provisioned instances (consistently low CPU/memory) to a smaller, cheaper instance type to cut hourly cost while keeping adequate performance.
- AWS Compute Optimizer analyzes CloudWatch CPU, memory, network, and disk metrics with ML to recommend right-sizing; fetch results with aws compute-optimizer get-ec2-instance-recommendations.
- S3 Lifecycle policies transition objects to cheaper classes (Standard-IA, Glacier Instant Retrieval, Glacier Deep Archive) on a schedule; apply with aws s3api put-bucket-lifecycle-configuration.
- S3 Intelligent-Tiering automatically moves objects between access tiers based on usage patterns, avoiding retrieval-fee surprises when access is unpredictable.
- Put Amazon ElastiCache (Redis/Memcached) in front of RDS to cache hot reads, reducing database load and read latency for read-heavy workloads.
- EBS performance: gp3 lets you provision IOPS and throughput independently of size; on gp2 you must increase volume size to raise baseline IOPS. io1/io2 Provisioned IOPS SSD gives consistently high, low-latency IOPS for critical databases.
- Configure dynamic scaling with a target-tracking policy via aws autoscaling put-scaling-policy --policy-type TargetTrackingScaling and inspect with describe-policies.
- T3/T2 burstable instances earn CPU credits; in unlimited mode, sustained high CPU after credits are exhausted incurs surcharges and (in standard mode) throttling - choose a non-burstable family for steady high load.
- Match storage and compute to the workload: right-sizing and Compute Optimizer for compute, lifecycle and tiering for storage, and caching or a CDN to offload origins. Then confirm the change worked in CloudWatch, because an optimisation nobody measured is a guess.
Domain 2: Reliability and Business Continuity
- RTO (Recovery Time Objective) is the maximum acceptable time to restore service; RPO (Recovery Point Objective) is the maximum acceptable data loss measured in time.
- An EC2 Auto Scaling Group monitors instance health via EC2 status checks or ELB health checks, terminates unhealthy instances, and maintains desired capacity across AZs.
- Spanning an ASG across at least two AZs with an ALB targeting subnets in each AZ provides high availability against an AZ failure.
- Increase the ASG health check grace period so it covers full application startup time; otherwise instances are killed before they finish booting.
- ASG rebalancing first terminates instances in the AZ with the most instances, then applies the default termination policy (e.g. oldest launch template/configuration).
- RDS Multi-AZ provisions a synchronous standby in another AZ with automatic failover and no data loss; it is for availability, not read scaling, and is enabled with aws rds create-db-instance --multi-az.
- RDS point-in-time recovery uses automated backups plus transaction logs; a cross-Region read replica can be promoted to a standalone primary, but promotion is irreversible and stops replication permanently.
- DynamoDB global tables provide multi-active, eventually consistent replication across Regions and resolve conflicts with last-writer-wins; back up a table with aws dynamodb create-backup.
- Create an EBS snapshot with aws ec2 create-snapshot --volume-id; copying an encrypted snapshot to another Region requires re-encryption with a KMS key available in the destination Region.
- S3 Cross-Region Replication only replicates objects created or updated AFTER the rule is enabled; replicate pre-existing objects with S3 Batch Replication.
- For SQS reliability, set a dead-letter queue with a maxReceiveCount and a visibility timeout longer than the maximum message processing time to avoid duplicate processing.
- Route 53 failover routing serves a Primary record while its health check passes and automatically returns the Secondary when the primary fails, enabling active/passive HA.
- AWS Backup centrally schedules and monitors backups across EBS, RDS, DynamoDB, EFS, and more, with retention rules and cross-Region/cross-account copies.
- A warm-standby DR strategy continuously replicates the database to the DR Region and pre-creates core infrastructure with minimal compute, scaling up only at failover to balance cost and RTO.
Domain 3: Deployment, Provisioning, and Automation
- AWS CloudFormation is the native IaC service: JSON/YAML templates managed as stacks with dependency ordering, automatic rollback on failure, and drift detection.
- aws cloudformation deploy creates or updates a stack idempotently in one command; use create-change-set + describe-change-set to preview exactly which resources will be modified, replaced, or deleted before applying.
- Recover a stack stuck in UPDATE_ROLLBACK_FAILED with ContinueUpdateRollback, optionally skipping problematic resources via --resources-to-skip.
- DeletionPolicy: Retain preserves (orphans) a resource in your account after the stack is deleted - useful for databases and S3 buckets you must not lose.
- CloudFormation StackSets deploy resources consistently across multiple accounts and Regions; with AWS Organizations auto-deployment, new accounts automatically receive the baseline stack.
- An ASG uses a launch template (the modern, versioned successor to the deprecated, immutable launch configuration) specifying AMI, instance type, security groups, IAM instance profile, and user data; create-launch-template-version registers a new version.
- Systems Manager Session Manager gives browser/CLI shell access to instances with no SSH keys, open inbound ports, or bastion hosts, with full session logging.
- SSM managed-instance prerequisites: the AmazonSSMManagedInstanceCore policy on the instance role and a running SSM Agent are the two most common missing pieces.
- Run shell commands on managed instances with aws ssm send-command --document-name AWS-RunShellScript; State Manager and Automation handle ongoing configuration and runbook automation.
- Store config and secrets in SSM Parameter Store; use --type SecureString --key-id for KMS-encrypted parameters via aws ssm put-parameter.
- AWS Secrets Manager supplies secrets at runtime and supports automatic rotation (e.g. RDS credentials) without code changes - prefer it over Parameter Store when rotation is required.
- Blue/green deployment with CodeDeploy shifting the ALB target group enables zero-downtime cutover and instant rollback by routing back to the old target group.
- Immutable infrastructure means replacing instances and baking golden AMIs rather than patching in place; CodeDeploy auto-deploys the current target revision to new ASG instances during scale-out.
- CloudFormation and CDK cover declarative provisioning, while Systems Manager (Run Command, State Manager, Automation, Patch Manager) covers ongoing operations automation.
Domain 4: Security and Compliance
- Attach an IAM role via an instance profile to grant EC2 AWS permissions through temporary, auto-rotated IMDS credentials - never embed long-term access keys in code or config.
- Security Groups are stateful and operate at the instance/ENI level (return traffic auto-allowed); Network ACLs are stateless at the subnet level and require explicit rules for BOTH directions.
- In IAM policy evaluation an explicit Deny always overrides any Allow, regardless of which policy granted the Allow.
- AWS Config continuously records resource configurations and evaluates them against managed/custom rules for compliance and drift, and can trigger SSM Automation remediation.
- Amazon GuardDuty uses ML, anomaly detection, and threat intelligence over CloudTrail events, VPC Flow Logs, and DNS query logs to detect compromised credentials and malicious activity.
- AWS CloudTrail records every API call (caller identity, timestamp, source IP, parameters); aws cloudtrail create-trail --is-organization-trail plus aws cloudtrail start-logging enable and activate an org-wide trail.
- Secure an S3 bucket by enabling all four S3 Block Public Access settings (BlockPublicAcls, IgnorePublicAcls, BlockPublicPolicy, RestrictPublicBuckets), enforcing default encryption, and applying least-privilege policies.
- Enforce KMS encryption on a bucket with aws s3api put-bucket-encryption using SSEAlgorithm aws:kms; SSE-KMS with a customer managed key gives you key rotation control and detailed CloudTrail access logging.
- Retrieve temporary cross-account credentials with aws sts assume-role --role-arn --role-session-name; for cross-account S3, attach an IAM role to the instance and scope the target bucket policy to that role.
- Add an inbound SSH rule with aws ec2 authorize-security-group-ingress --group-id --protocol tcp --port 22 --cidr; attach a managed policy with aws iam attach-role-policy --role-name --policy-arn.
- Enforce EBS encryption account-wide by enabling EBS encryption by default in EC2 settings and using an AWS Config rule (encrypted-volumes) to detect non-compliant volumes.
- AWS WAF with AWS-managed rule groups protects web apps from common exploits (SQL injection, XSS) at the ALB, API Gateway, or CloudFront layer.
- Use AWS IAM Identity Center or SAML federation to provide workforce users temporary role-based credentials instead of long-lived IAM users.
- IAM roles eliminate static secrets; combine with permission boundaries and least privilege so each principal can only perform required actions.
Domain 5: Networking and Content Delivery
- A subnet is public if its route table has a 0.0.0.0/0 (or ::/0) route to an Internet Gateway; a private subnet has no such IGW route.
- Private-subnet instances reach the internet via a NAT gateway placed in a public subnet PLUS a 0.0.0.0/0 route in the private subnet's route table pointing to that NAT gateway.
- Provisioning a NAT gateway requires two steps: aws ec2 allocate-address for an Elastic IP, then aws ec2 create-nat-gateway referencing that EIP and a public subnet.
- Create core VPC plumbing with aws ec2 create-vpc --cidr-block 10.0.0.0/16 and aws ec2 create-route --route-table-id --destination-cidr-block 0.0.0.0/0 --gateway-id.
- Gateway VPC endpoints (S3 and DynamoDB only) route traffic privately at no extra cost; Interface endpoints (PrivateLink) use ENIs and are created with aws ec2 create-vpc-endpoint --vpc-endpoint-type Interface.
- If a PrivateLink interface endpoint's hostname resolves to public IPs, Private DNS is not enabled on the endpoint - enable it so the service's default hostname resolves to private addresses.
- VPC peering requires route table entries in BOTH VPCs pointing the peer's CIDR to the peering connection; missing routes are the most common cause of peering connectivity failures.
- AWS Transit Gateway is a regional hub connecting many VPCs, VPN, and Direct Connect attachments, avoiding the O(n^2) sprawl of full-mesh VPC peering.
- AWS Direct Connect provides dedicated, private, high-bandwidth connectivity with predictable latency, versus a Site-to-Site VPN over the public internet.
- Application Load Balancer (Layer 7) supports content-based routing on host header, URL path, query string, and HTTP method; Network Load Balancer (Layer 4) handles TCP/UDP at ultra-low latency and preserves the client source IP.
- To see the real client IP behind an ALB, read the X-Forwarded-For header; an NLB preserves source IP natively. Create a target group with health checks via aws elbv2 create-target-group --health-check-path /health.
- Amazon CloudFront caches content at 600+ points of presence (edge locations) worldwide to reduce latency; restrict origin access so the origin only accepts requests from CloudFront (OAC) to protect it.
- A Route 53 private hosted zone associated with your VPCs provides private internal DNS resolution for resources not exposed publicly.
- Security Groups vs NACLs is a frequent exam point: SG = stateful, instance-level, allow rules only; NACL = stateless, subnet-level, supports explicit deny and ordered numbered rules.
AWS CloudOps Engineer - Associate (SOA-C03) exam tips
- There are no exam labs. SOA-C03 is multiple-choice and multiple-response only, but the questions still turn on exact operational detail, so practise the CLI calls (put-metric-alarm, ssm send-command, create-flow-logs) rather than only reading about them.
- When a question asks for OS-level metrics (memory, disk) on EC2, the answer almost always involves installing the CloudWatch unified agent - default EC2 metrics never include these.
- Distinguish RTO vs RPO and map DR strategies (backup/restore, pilot light, warm standby, multi-site) to cost-versus-recovery-time tradeoffs; the cheapest option that meets the stated RTO/RPO is usually correct.
- For security questions, default to IAM roles over access keys, explicit Deny wins, S3 Block Public Access for exposure, and SSE-KMS with a customer managed key when key control or audit is required.
- Performance optimisation now lives inside domain 1 alongside monitoring, and pure cost analysis has left the exam - AWS lists analysing costs and managing billing as out-of-scope tasks. Read optimisation questions as "which change fixes the performance symptom", not "which is cheapest".
- Three domains are tied at 22% - monitoring and performance, reliability and business continuity, and deployment and automation - so two thirds of the exam sits in those three. Security is 16% and networking 18%.
Study guide FAQ
How many questions are on the SOA-C03 exam and what is the passing score?
The exam contains 65 questions, of which only 50 are scored; the other 15 are unscored trial questions that AWS does not identify, so answer every one. You need a scaled score of 720 out of 1,000 to pass, and scoring is compensatory across the five domains. The CertGrid bank is far larger than one exam form so you can practise repeatedly without seeing the same questions.
Which domain carries the most weight, and where should I focus?
Three domains are tied at the top on 22% each: monitoring, logging, analysis, remediation and performance optimisation; reliability and business continuity; and deployment, provisioning and automation. Networking and content delivery is 18% and security and compliance 16%. There is no cost optimisation domain in SOA-C03.
Do I really need to memorize CLI commands and flags?
Yes. Many questions present CLI snippets and ask which is correct or what flag is missing. Know the key calls and their required flags: put-metric-alarm, put-metric-data, ssm send-command/put-parameter, cloudformation deploy/create-change-set, ec2 create-snapshot, and s3api put-public-access-block.
How much hands-on experience is recommended before taking it?
AWS describes the audience as individuals with about one year of experience deploying, managing and operating workloads on AWS. The exam rewards practical operational knowledge: alarms, automation, failover, patching and troubleshooting.
What changed between SOA-C02 and SOA-C03?
The certification was renamed from SysOps Administrator to CloudOps Engineer, and the separate cost and performance optimisation domain was removed. Performance optimisation moved into the monitoring domain, whose name now ends "and Performance Optimization", and cost analysis left the exam altogether - AWS lists analysing costs and managing billing among the tasks a candidate is not expected to perform.
Official exam sources
The domain names and weightings on this page follow the published exam blueprint. Each source below records what it confirmed and when it was read, so the split can be checked rather than taken on trust.
- AWS Certified CloudOps Engineer - Associate exam pagelink and content verified 8 September 2026The certification formerly known as SysOps Administrator - Associate. Audience: individuals with about one year of experience deploying, managing and operating workloads on AWS. Domain weightings are in the downloadable exam guide, not on this page.