ExamPark
Course menuSOA-C03

Exams / SOA-C03 / Study guide

AWS Certified CloudOps Engineer – Associate (SOA-C03) study guide

What the SOA-C03 exam tests, domain by domain, and how to tell the right answer from the nearly right one. Each topic links to fuller study notes and free practice questions.

Last checked against the official exam guide and AWS documentation · How we write our content

About the SOA-C03 exam

The AWS Certified CloudOps Engineer – Associate exam (the successor to SysOps Administrator – Associate, and still coded SOA) checks whether you can run workloads on AWS day to day: watch them, fix them, keep them available, deploy and automate changes, secure them, and troubleshoot the network. AWS aims it at people with a year of hands-on AWS operations experience and a year in a related role such as system administrator.
Questions 65: 50 scored and 15 unscored, which aren’t marked
Time 130 minutes
Question types Multiple choice (one answer from four) and multiple response (two or more from five or more); no hands-on labs
Score Scaled from 100 to 1,000; 720 to pass
Scoring model Compensatory: you need to pass overall, not in each domain
Guessing An unanswered question counts as wrong, and there is no penalty for a wrong answer, so answer everything

Check the official certification page for the current price, languages and booking options before you book.

What the exam really tests

Where the Solutions Architect exam asks “what should we build?”, this exam asks “it’s running, and something is wrong or needs changing: what do you do?”. Expect questions that start with a symptom (an alarm stuck in INSUFFICIENT_DATA, a stack in UPDATE_ROLLBACK_FAILED, an instance that can’t reach S3) and ask for the cause or the fix.

Patterns that come up again and again:

  • Automate it. If a task is repeated or a fix should happen without people, the answer usually chains a CloudWatch alarm or EventBridge rule to Systems Manager Automation or Lambda.
  • Use the built-in feature. Managed runbooks, AWS Backup, Config remediation and Patch Manager beat custom scripts on “least operational overhead”.
  • Read the error. Timeouts point to the network (routes, security groups, NACLs, endpoints); “access denied” points to policies. Don’t fix permissions for a network problem.
  • Know the defaults. Many questions turn on a default you might not have noticed: EC2 doesn’t report memory, ALB health checks expect 200, CloudTrail event history keeps 90 days.

How to read a question

  1. Identify whether it’s a symptom question (find the cause) or a requirement question (choose a setup).
  2. For symptoms, place the problem in a layer: permissions, network, configuration, capacity or application.
  3. Note the qualifier: least effort, fastest recovery, lowest cost, most secure.
  4. Eliminate options that fix a different layer, then compare the rest on the qualifier.

How the domains add up

The first three domains carry the same weight, and networking and security together make up about a third. There is no small domain to skip: troubleshooting questions mix all five.

Domain 1: Monitoring, Logging, Analysis, Remediation, and Performance Optimization 22%

This domain covers seeing what is happening and acting on it: CloudWatch metrics, alarms, dashboards and the agent, CloudWatch Logs and CloudTrail analysis, EventBridge rules, automated remediation with Systems Manager, and tuning the performance of EC2, EBS, S3, shared file systems and RDS. Expect “the metric is missing” and “the alarm didn’t fire” questions as well as “choose the right volume type”.

Automatic remediation with EventBridge and Systems Manager An AWS Config rule that finds a noncompliant resource, or a CloudWatch alarm entering the ALARM state, sends an event to an EventBridge rule. The rule starts a Systems Manager Automation runbook, which fixes the resource, and also publishes to an SNS topic to notify the team. Config rule noncompliant CloudWatch alarm state: ALARM EventBridge rule SSM Automation runs a runbook SNS topic notifies the team Resource fixed back in compliance
The usual auto-remediation chain. A Config rule or a CloudWatch alarm changes state, an EventBridge rule matches the event, and a Systems Manager Automation runbook makes the fix while SNS tells people what happened. Config can also start a runbook directly through a remediation action, which is the simplest answer when the trigger is a Config rule.

Domain 2: Reliability and Business Continuity 22%

Reliability questions ask how to keep workloads running and recover them when they fail: Auto Scaling policies and features, caching, scaling databases, health checks on load balancers and Route 53, Multi-AZ designs, AWS Backup and snapshots, restoring data to meet an RPO and RTO, and disaster recovery strategies.

The four disaster recovery strategies, from slowest and cheapest to fastest and most expensive Backup and restore keeps only backups in the recovery Region. Pilot light replicates data with core servers idle. Warm standby runs a scaled-down copy. Multi-site active/active runs a full copy that serves traffic. Moving down the list, recovery time and data loss shrink from hours to near zero, and cost rises. Backup and restore only backups in DR Region Pilot light data replicated, core idle Warm standby scaled-down copy running Multi-site active/active full copy serving traffic Downtime Cost hours seconds $ $$$$
Pick the cheapest strategy that meets the stated RTO and RPO. Backup and restore can take hours. Pilot light keeps data replicated with core servers switched off, warm standby runs a small copy that scales up, and multi-site active/active serves traffic from both Regions so recovery is almost instant.

Domain 3: Deployment, Provisioning, and Automation 22%

This domain is about creating and changing resources safely and repeatably: AMIs and EC2 Image Builder, CloudFormation and the CDK (and fixing failed stacks), StackSets and AWS RAM for many accounts, deployment strategies, Systems Manager for fleets (Run Command, Session Manager, Patch Manager, State Manager), and event-driven automation.

Domain 4: Security and Compliance 16%

Security questions focus on operating securely: writing and troubleshooting IAM policies, multi-account controls with Organizations, SCPs and IAM Identity Center, compliance monitoring with AWS Config, encryption with KMS and ACM, managing secrets, and acting on findings from Security Hub, GuardDuty and Inspector.

Domain 5: Networking and Content Delivery 18%

Networking questions test VPC configuration (subnets, route tables, gateways), private connectivity (endpoints, PrivateLink, peering, Transit Gateway), protection (WAF, Shield, Network Firewall), network costs, DNS with Route 53 and Resolver, content delivery with CloudFront and Global Accelerator, hybrid links, and above all troubleshooting why traffic doesn’t get through.

Each check inbound traffic passes on its way to an EC2 instance Traffic from the internet passes through the internet gateway, then the subnet route table, then the network ACL, then the security group, and finally reaches the EC2 instance. Notes beside each step say what must be configured. Internet Internet gateway attached to the VPC Route table subnet route 0.0.0.0/0 to the internet gateway Network ACL stateless: allow inbound and ephemeral ports out Security group stateful: replies are allowed automatically EC2 instance needs a public or Elastic IP address
When traffic doesn’t get through, check each hop in order. Network ACLs are stateless, so they also need a rule allowing return traffic on ephemeral ports (1024 to 65535). Security groups are stateful and need only the inbound rule. For a private instance the route points to a NAT gateway instead, which allows only connections the instance starts.

A 6-week study plan

This plan assumes about an hour on weekdays and a longer, hands-on session at the weekend. If you run AWS workloads every day, four weeks may be enough.

Week Focus Do this
1 Baseline and monitoring Take the free practice exam in timed mode. Then CloudWatch metrics, alarms (including missing data and composite alarms), the CloudWatch agent, Logs Insights, CloudTrail and EventBridge.
2 Remediation and performance Systems Manager Automation and runbooks, Config remediation, Compute Optimizer, EBS volume types, S3 transfer features, EFS and FSx, RDS Performance Insights and RDS Proxy.
3 Reliability Auto Scaling policies, warm pools and lifecycle hooks, load balancer and Route 53 health checks, Multi-AZ, AWS Backup and Vault Lock, restores and DR strategies.
4 Deployment and automation AMIs and Image Builder, CloudFormation (change sets, drift, policies, troubleshooting), StackSets, RAM, deployment strategies, Systems Manager fleet tools.
5 Security and networking IAM policy evaluation, Access Analyzer, SCPs, Config, KMS key sharing, secrets, Security Hub and GuardDuty. VPC routing, endpoints, Transit Gateway, Route 53 Resolver, CloudFront, troubleshooting.
6 Exam practice Full timed practice exams. Review every wrong answer and redo the hands-on tasks behind your weakest topics.

How to use practice questions well

  • Treat each wrong answer as a troubleshooting lesson. Ask which layer the problem was in and why the other fixes would not have worked.
  • Learn the defaults. Make a list of default values and behaviors that surprised you.
  • Don’t memorize questions. The real exam won’t reuse them.
  • Aim for 80% or more across a few full timed practice exams before you book.

Get hands-on

This exam rewards people who have operated AWS. In a personal account with a budget alert set: install the CloudWatch agent and graph memory; break and fix a CloudFormation stack; connect to a private instance with Session Manager; add a gateway endpoint and watch S3 traffic stop using the NAT gateway; restore an RDS instance to a point in time. Delete everything afterward.

Frequently asked questions

What’s the difference between SOA-C03 and the old SysOps exam?

AWS renamed the certification from SysOps Administrator to CloudOps Engineer with this version and updated the content to match how AWS workloads are run today. The exam code still starts with SOA, so check the exam guide (linked from the resources page) for the current task list.

Does the exam have labs?

No. The questions are all multiple choice or multiple response.

Should I take Solutions Architect – Associate first?

It isn’t required, and the two overlap a lot. Many people take SAA first because its design knowledge helps here, then find CloudOps easier to prepare for.

Are the practice questions the real exam questions?

No. Every question on this site is original, written from the public exam guide and checked against AWS documentation. Using real exam questions breaks the AWS Certification Program Agreement.

Test yourself

The free SOA-C03 practice exam has 65 questions with an explanation for every option. No sign-up needed.

Take the free practice examReview questions untimed

Want to be sure you're ready? The 5 full-length practice sets add 325 new questions, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets