AWS Certified CloudOps Engineer - Associate (SOA-C03) Fact Sheet¶

Exam Overview¶

Exam Code: SOA-C03 Exam Name: AWS Certified CloudOps Engineer - Associate (formerly SysOps Administrator) Duration: 180 minutes (3 hours) Questions: 65 questions Question Format: Multiple choice, multiple response, and exam labs (hands-on) Passing Score: 720/1000 (scaled scoring, approximately 72%) Cost: $150 USD Valid For: 3 years Prerequisites: None required, but AWS Solutions Architect Associate recommended Language: Available in English, Japanese, Korean, Simplified Chinese Delivery: Pearson VUE (online proctored or testing center) Launch Date: September 30, 2025 (Registration opened September 9, 2025)

📖 Official Exam Page - Registration and details 📖 Exam Guide PDF - Detailed exam objectives 📖 Sample Questions - Official practice questions

Target Audience¶

This certification is designed for: - Cloud operations engineers managing AWS environments - System administrators transitioning to cloud operations - DevOps engineers focused on operations - Site reliability engineers (SREs) working with AWS - IT professionals operating production AWS workloads

Recommended Experience: - 1+ years hands-on AWS operations experience - Experience deploying and managing AWS resources - Understanding of AWS core services and architecture - Familiarity with automation and IaC tools - Knowledge of networking and security concepts

📖 CloudOps Engineer Role - Cloud operations overview 📖 AWS Operations - Management tools

What's New in SOA-C03¶

Major Changes from SOA-C02 (SysOps Administrator):¶

New Name: "CloudOps Engineer" reflects modern cloud operations practices

Domain Changes: Reduced from 6 domains to 5 domains, with reorganization: - Combined monitoring, logging, and performance into single domain - Increased focus on deployment and automation - Enhanced emphasis on reliability and business continuity

New Services in Scope: - Containers: ECS, EKS, ECR, Fargate - Modern Databases: Aurora Serverless v2, RDS Proxy, DynamoDB DAX - Infrastructure as Code: AWS CDK in addition to CloudFormation - Multi-account: AWS Organizations, Control Tower - Observability: Enhanced CloudWatch features, X-Ray

📖 Exam Updates - Official announcement 📖 What's New - Changes overview

Exam Domains¶

Domain 1: Monitoring, Logging, and Analysis (22%)¶

This is the largest domain, covering observability and troubleshooting.

1.1 CloudWatch Monitoring¶

CloudWatch Metrics: - Standard vs custom metrics - Metric dimensions and namespaces - High-resolution metrics (1-second) - Metric math and expressions - Cross-account and cross-region metrics

📖 Amazon CloudWatch - Monitoring service 📖 CloudWatch Metrics - Working with metrics 📖 Custom Metrics - Publishing custom metrics 📖 Metric Math - Metric calculations

CloudWatch Alarms: - Metric alarms and composite alarms - Alarm states and actions - SNS integration for notifications - Auto Scaling integration - EC2 actions (stop, terminate, reboot)

📖 CloudWatch Alarms - Creating alarms 📖 Composite Alarms - Complex alarm logic 📖 Alarm Actions - Automated responses

1.2 CloudWatch Logs¶

Log Management: - Log groups and log streams - Log retention policies - Metric filters - Log insights queries - Cross-account log aggregation

📖 CloudWatch Logs - Log service 📖 Log Groups - Organizing logs 📖 Metric Filters - Extract metrics from logs 📖 CloudWatch Logs Insights - Query and analyze logs

Log Collection: - CloudWatch Logs agent - Unified CloudWatch agent - Container logging (ECS, EKS) - Lambda function logs

📖 CloudWatch Agent - Agent installation 📖 Agent Configuration - Configure agent 📖 Container Logs - ECS/EKS logging

1.3 AWS X-Ray for Tracing¶

Distributed Tracing: - Service maps and trace analysis - X-Ray daemon configuration - X-Ray SDK integration - Trace sampling and filtering - Performance bottleneck identification

📖 AWS X-Ray - Distributed tracing 📖 X-Ray Concepts - Tracing concepts 📖 X-Ray Daemon - Daemon setup 📖 Service Maps - Visualizing services

1.4 CloudTrail for Auditing¶

API Auditing: - CloudTrail events (management, data, insights) - Trail configuration and logging - Log file integrity validation - CloudWatch Logs integration - EventBridge integration

📖 AWS CloudTrail - API logging 📖 Creating Trails - Trail setup 📖 Event Types - Management vs data events 📖 CloudTrail Insights - Anomaly detection

1.5 Systems Manager for Operations¶

SSM Features: - Session Manager for secure access - Run Command for remote execution - Patch Manager for OS patching - Parameter Store for configuration - OpsCenter for operational issues

📖 AWS Systems Manager - Operations hub 📖 Session Manager - Secure shell access 📖 Run Command - Remote commands 📖 Patch Manager - Patch management 📖 Parameter Store - Configuration management

Domain 2: Reliability and Business Continuity (20%)¶

Covers high availability, disaster recovery, and backups.

2.1 High Availability Architecture¶

HA Design Patterns: - Multi-AZ deployments - Load balancing (ALB, NLB, GLB) - Auto Scaling Groups - Route 53 health checks and failover - RDS Multi-AZ

📖 High Availability - HA patterns 📖 Elastic Load Balancing - Load balancers 📖 Auto Scaling - EC2 Auto Scaling 📖 Route 53 Failover - DNS failover 📖 RDS Multi-AZ - Database HA

2.2 Backup and Recovery¶

AWS Backup: - Centralized backup management - Backup plans and policies - Cross-region and cross-account backups - Backup vaults and lifecycle - Recovery testing

📖 AWS Backup - Backup service 📖 Backup Plans - Creating plans 📖 Backup Vaults - Backup storage 📖 Cross-Region Backup - DR backups

Service-Specific Backups: - EBS snapshots and lifecycle - RDS automated backups and snapshots - DynamoDB backups and PITR - S3 versioning and replication - EFS backups

📖 EBS Snapshots - Volume backups 📖 RDS Backups - Database backups 📖 DynamoDB Backups - NoSQL backups 📖 S3 Replication - Object replication

2.3 Disaster Recovery¶

DR Strategies: - Backup and restore (RPO/RTO hours) - Pilot light (RPO/RTO minutes-hours) - Warm standby (RPO/RTO minutes) - Multi-site active-active (RPO/RTO seconds)

📖 Disaster Recovery - DR patterns 📖 AWS Elastic Disaster Recovery - Application DR 📖 Pilot Light - Minimal DR

Domain 3: Deployment, Provisioning, and Automation (19%)¶

Covers infrastructure as code and automated deployments.

3.1 AWS CloudFormation¶

Infrastructure as Code: - CloudFormation templates (JSON/YAML) - Stacks and stack sets - Change sets for updates - Nested stacks - Custom resources and Lambda

📖 AWS CloudFormation - IaC service 📖 Template Basics - Template syntax 📖 Stack Sets - Multi-account deployment 📖 Change Sets - Preview updates 📖 Custom Resources - Extend CloudFormation

3.2 AWS CDK (NEW in SOA-C03)¶

Cloud Development Kit: - Define infrastructure using programming languages - CDK constructs and stacks - CDK synthesis to CloudFormation - CDK Pipelines for CI/CD

📖 AWS CDK - Infrastructure in code 📖 CDK Constructs - Reusable components 📖 CDK Stacks - Deployment units 📖 CDK Pipelines - CI/CD automation

3.3 Elastic Beanstalk¶

Platform as a Service: - Application deployment and management - Environment configuration - Blue/green deployments - Platform updates - Health monitoring

📖 AWS Elastic Beanstalk - PaaS overview 📖 Environments - Environment management 📖 Deployments - Deployment options 📖 Health Monitoring - Enhanced health

3.4 Container Services (NEW in SOA-C03)¶

Amazon ECS and Fargate: - ECS cluster management - Task definitions and services - Fargate launch type - Service auto scaling - Load balancer integration

📖 Amazon ECS - Container orchestration 📖 ECS Tasks - Task definitions 📖 ECS Services - Service management 📖 AWS Fargate - Serverless containers

Amazon EKS: - Managed Kubernetes service - Node groups and Fargate profiles - EKS add-ons - kubectl access configuration

📖 Amazon EKS - Kubernetes on AWS 📖 EKS Node Groups - Worker nodes 📖 EKS Fargate - Serverless pods

Amazon ECR: - Container image registry - Image scanning - Lifecycle policies - Cross-region replication

📖 Amazon ECR - Container registry 📖 Image Scanning - Vulnerability scanning 📖 Lifecycle Policies - Image cleanup

3.5 CI/CD Pipelines¶

AWS CodePipeline: - Pipeline stages and actions - Source, build, test, deploy stages - Integration with CodeCommit, CodeBuild, CodeDeploy - Third-party integrations (GitHub, Jenkins)

📖 AWS CodePipeline - CI/CD service 📖 Pipeline Structure - Pipeline concepts 📖 AWS CodeBuild - Build service 📖 AWS CodeDeploy - Deployment automation

Domain 4: Security and Compliance (18%)¶

Covers security best practices, access control, and compliance.

4.1 Identity and Access Management¶

IAM Best Practices: - Principle of least privilege - IAM roles vs users - MFA enforcement - Password policies - Access key rotation

📖 AWS IAM - Identity and Access Management 📖 IAM Best Practices - Security recommendations 📖 IAM Policies - Access control 📖 IAM Roles - Temporary credentials

Multi-Account Management (NEW focus in SOA-C03): - AWS Organizations - Service Control Policies (SCPs) - AWS Control Tower - Cross-account access

📖 AWS Organizations - Multi-account management 📖 Service Control Policies - Organization policies 📖 AWS Control Tower - Landing zones

4.2 Data Protection¶

Encryption: - Encryption at rest (EBS, S3, RDS) - Encryption in transit (TLS/SSL) - AWS KMS for key management - CloudHSM for compliance - Certificate Manager (ACM)

📖 Data Encryption - Encryption overview 📖 AWS KMS - Key management 📖 EBS Encryption - Volume encryption 📖 S3 Encryption - Object encryption 📖 ACM - SSL/TLS certificates

4.3 Network Security¶

VPC Security: - Security groups (stateful) - Network ACLs (stateless) - VPC Flow Logs - AWS WAF for applications - AWS Shield for DDoS protection

📖 VPC Security - Network security 📖 Security Groups - Instance firewalls 📖 Network ACLs - Subnet firewalls 📖 VPC Flow Logs - Network traffic logs 📖 AWS WAF - Web application firewall

4.4 Compliance and Governance¶

AWS Config: - Resource inventory and configuration history - Config rules for compliance - Conformance packs - Remediation actions

📖 AWS Config - Configuration management 📖 Config Rules - Compliance checks 📖 Conformance Packs - Compliance frameworks 📖 Remediation - Auto-remediation

AWS Trusted Advisor: - Cost optimization checks - Performance recommendations - Security best practices - Fault tolerance analysis

📖 AWS Trusted Advisor - Best practice checks

Domain 5: Networking and Content Delivery (16%)¶

Covers VPC, networking, and CloudFront.

5.1 VPC Architecture¶

VPC Components: - Subnets (public and private) - Route tables and routing - Internet Gateway and NAT Gateway - VPC endpoints (Gateway and Interface) - Transit Gateway

📖 Amazon VPC - Virtual private cloud 📖 Subnets - Subnet configuration 📖 Route Tables - Routing 📖 NAT Gateway - Outbound internet access 📖 VPC Endpoints - Private service access

5.2 Connectivity Options¶

Hybrid Connectivity: - Site-to-Site VPN - AWS Direct Connect - Transit Gateway for hub-and-spoke - VPC peering - AWS VPN CloudHub

📖 Site-to-Site VPN - VPN connections 📖 AWS Direct Connect - Dedicated connections 📖 Transit Gateway - Network hub 📖 VPC Peering - Connect VPCs

5.3 Route 53 DNS¶

DNS Management: - Hosted zones (public and private) - Record types (A, AAAA, CNAME, etc.) - Routing policies (simple, weighted, latency, failover, geolocation) - Health checks and monitoring

📖 Amazon Route 53 - DNS service 📖 Hosted Zones - DNS zones 📖 Routing Policies - Traffic routing 📖 Health Checks - Endpoint monitoring

5.4 CloudFront Content Delivery¶

CDN Configuration: - Distributions and origins - Cache behaviors and TTL - Origin failover - Lambda@Edge - CloudFront Functions

📖 Amazon CloudFront - Content delivery network 📖 Distributions - CDN setup 📖 Cache Behavior - Caching configuration 📖 Lambda@Edge - Edge computing

Domain 6: Cost and Performance Optimization (15%)¶

Covers cost management and performance tuning.

6.1 Cost Optimization¶

Cost Management: - AWS Cost Explorer - Budgets and alerts - Cost allocation tags - Reserved Instances and Savings Plans - Spot Instances for non-production

📖 AWS Cost Management - Cost tools 📖 Cost Explorer - Cost analysis 📖 AWS Budgets - Budget alerts 📖 Reserved Instances - Capacity reservations

6.2 Performance Optimization¶

EC2 Optimization: - Right-sizing instances - Enhanced networking - Placement groups - EBS optimization

📖 EC2 Performance - Network performance 📖 Placement Groups - Optimize placement 📖 Compute Optimizer - Right-sizing recommendations

Database Optimization: - RDS Proxy for connection pooling (NEW in SOA-C03) - DynamoDB DAX for caching (NEW in SOA-C03) - Aurora Serverless v2 (NEW in SOA-C03) - Read replicas

📖 RDS Proxy - Database proxy 📖 DynamoDB DAX - In-memory cache 📖 Aurora Serverless v2 - Auto-scaling database

Study Strategy¶

Recommended Timeline (6-8 weeks, 12-18 hours/week)¶

Weeks 1-2: Monitoring and Operations - CloudWatch metrics, logs, alarms - X-Ray and CloudTrail - Systems Manager - Study time: 15 hours/week

Weeks 3-4: Infrastructure and Automation - CloudFormation and AWS CDK - Elastic Beanstalk - Container services (ECS, EKS, ECR) - Study time: 18 hours/week

Weeks 5-6: Security and Networking - IAM and multi-account management - VPC architecture - Security best practices - Study time: 15 hours/week

Weeks 7-8: Review and Practice Labs - Hands-on exam labs practice - Full practice exams (aim for 75%+) - Review weak areas - Study time: 12-15 hours/week

Study Resources¶

Official AWS Training: 📖 AWS Skill Builder - Free AWS training 📖 CloudOps Learning Plan - Official study plan 📖 Exam Prep Course - Official exam prep

Hands-On Practice: - Complete AWS hands-on labs - Practice with exam lab scenarios - Build automated deployment pipelines - Configure multi-AZ architectures - Set up comprehensive monitoring

📖 Hands-On Tutorials - AWS tutorials 📖 AWS Well-Architected Labs - Best practice labs

Exam Day Tips¶

Preparation¶

• Review CloudWatch metrics and alarms
• Know CloudFormation syntax basics
• Understand container service differences (ECS vs EKS)
• Review multi-account management
• Practice exam labs thoroughly
• Get adequate rest before exam

During Exam¶

• Exam Labs: Complete hands-on labs first (20-40 minutes each)
• Read scenario questions carefully
• Look for keywords: "MOST operationally efficient", "LEAST cost"
• Eliminate wrong answers first
• Flag uncertain questions for review
• Manage time: ~2.8 minutes per question (plus lab time)

Common Question Patterns¶

• Troubleshooting monitoring and logging issues
• Choosing appropriate backup and DR strategies
• Selecting deployment automation approaches
• Multi-AZ and high availability scenarios
• Container deployment configurations
• Security and compliance requirements
• Cost optimization strategies

Exam Labs¶

• 2-3 hands-on scenario labs
• Use AWS Console to complete tasks
• Verify your work before submitting
• Time management is critical

📖 Exam Preparation - Official resources

After Certification¶

Career Benefits¶

• Validates cloud operations expertise
• Opens CloudOps and SRE roles
• Demonstrates automation skills
• Industry recognition

Next Certifications¶

📖 AWS DevOps Engineer Professional - Advanced DevOps 📖 AWS Security Specialty - Security focus 📖 AWS Solutions Architect Professional - Architecture mastery

Continuous Learning¶

• Follow AWS operations blog
• Experiment with new AWS services
• Attend re:Invent operations sessions
• Build automated workflows
• Join cloud operations communities

📖 AWS Operations Blog - Management & Governance updates

Quick Reference¶

Exam Details at a Glance¶

• 65 questions in 180 minutes = ~2.8 minutes per question (plus lab time)
• 720/1000 to pass = Approximately 72%
• 22% Monitoring & logging = ~14 questions
• 20% Reliability & business continuity = ~13 questions
• 19% Deployment & automation = ~12 questions
• 18% Security & compliance = ~12 questions
• 16% Networking = ~10 questions
• 15% Cost & performance = ~10 questions
• Plus 2-3 hands-on exam labs

Key Services to Master¶

New in SOA-C03¶

Good luck with your AWS Certified CloudOps Engineer - Associate exam! 🎉