AWSAWS Certified CloudOps Engineer - Associate
The AWS Certified CloudOps Engineer - Associate certification validates your ability to deploy, manage, and operate workloads on AWS. It is designed for individuals in cloud operations roles with about one year of hands-on experience. Earning it demonstrates practical skills in monitoring, security, networking, and cost optimization, and it is a strong stepping stone to Professional and Specialty certifications.
338 practice questions · Updated 2026-07-30
5Domains
13Objectives
124Concepts
338Questions
SOA-C03 Curriculum
Every domain, objective, and concept the SOA-C03 exam measures.
- CloudWatch Metrics and Alarms FundamentalsDefine CloudWatch metrics, namespaces, dimensions, and alarms, and explain how they are used to monitor AWS resources.
- CloudTrail Logging and AnalysisConfigure AWS CloudTrail to capture API activity, and use CloudTrail logs to audit and troubleshoot workload operations.
- Amazon Managed Service for Prometheus IntegrationSet up Amazon Managed Service for Prometheus to collect and query Prometheus-compatible metrics from workloads.
- CloudWatch Agent Installation and ConfigurationInstall and configure the CloudWatch agent on EC2 instances, ECS clusters, or EKS clusters to collect custom metrics and logs.
- CloudWatch Agent for ECS and EKSDeploy and manage the CloudWatch agent as a container or daemonset in ECS and EKS to gather metrics and logs from cluster workloads.
- CloudWatch Alarms Configuration and ActionsCreate CloudWatch alarms with appropriate thresholds and actions, including invoking AWS services directly or via Amazon EventBridge.
- Composite Alarms and TroubleshootingBuild composite alarms that combine multiple alarm states, and troubleshoot alarm states and invocations.
- CloudWatch Dashboards Creation and SharingCreate customizable CloudWatch dashboards that display metrics and alarms, and share them across accounts and Regions.
- Cross-Account and Cross-Region DashboardsConfigure CloudWatch dashboards to aggregate data from multiple accounts and Regions using cross-account observability features.
- Amazon SNS Notifications for AlarmsConfigure CloudWatch alarms to send notifications to Amazon SNS topics, and manage SNS subscriptions for alerting.
- EventBridge Integration for Alarm ActionsUse Amazon EventBridge rules to trigger actions based on CloudWatch alarm state changes, and troubleshoot event delivery.
- CloudWatch Metrics and AlarmsAnalyze CloudWatch metrics and create alarms to detect performance issues.
- Automated Remediation with LambdaTrigger Lambda functions from CloudWatch alarms to automate remediation actions.
- Systems Manager Automation for RemediationUse AWS Systems Manager Automation documents to remediate issues based on monitoring data.
- CloudTrail for Operational AuditingUse CloudTrail logs to identify API activity that may indicate issues or unauthorized changes.
- Kiro for Performance AnalysisLeverage Kiro to analyze performance metrics and identify bottlenecks.
- AWS DevOps Agent for MonitoringUtilize AWS DevOps Agent to monitor and remediate issues in development pipelines.
- EventBridge Event RoutingConfigure EventBridge rules to route events to appropriate targets.
- Event Enrichment and DeliveryEnrich events with additional data and deliver them to targets using EventBridge.
- Troubleshooting EventBridge RulesDiagnose and fix issues with EventBridge event bus rules, such as misconfigured targets or permissions.
- Predefined Systems Manager RunbooksExecute predefined Systems Manager Automation runbooks to automate common operational tasks.
- Custom Runbook CreationCreate custom Systems Manager Automation runbooks using AWS SDKs or scripts.
- Runbook Execution and MonitoringRun and monitor Systems Manager Automation runbooks to ensure successful execution and handle failures.
- Compute performance metrics and toolsIdentify and use CloudWatch metrics, EC2 instance metrics, and AWS tools like Compute Optimizer to monitor and remediate compute performance issues.
- Resource tags for performance optimizationApply and use resource tags to group, filter, and manage compute resources for performance analysis and cost optimization.
- EBS performance metrics and troubleshootingAnalyze EBS metrics such as IOPS, throughput, and latency to diagnose performance bottlenecks and troubleshoot issues.
- EBS volume types and optimizationSelect and optimize EBS volume types (e.g., gp3, io2, st1) based on workload requirements to improve performance and reduce cost.
- S3 performance strategiesImplement S3 performance enhancements including multipart uploads, S3 Transfer Acceleration, and DataSync to improve data transfer and access patterns.
- S3 lifecycle policies for performance and costConfigure S3 Lifecycle policies to transition objects to appropriate storage classes and expire data, optimizing storage efficiency and cost.
- Shared storage solutions evaluationEvaluate and select among Amazon EFS, FSx, and S3 File Gateway based on use case requirements such as protocol, performance, and cost.
- EFS lifecycle and performance optimizationImplement EFS lifecycle policies and performance modes (e.g., bursting, provisioned throughput) to optimize cost and performance for file workloads.
- RDS performance monitoringMonitor RDS metrics using CloudWatch and Performance Insights to identify performance bottlenecks and track database health.
- RDS configuration optimizationModify RDS configurations such as instance class, storage, and parameters, and use RDS Proxy and Performance Insights recommendations to increase efficiency.
- EC2 instance optimizationOptimize EC2 instance selection, sizing, and configuration based on workload patterns and performance metrics.
- EC2 storage and networking optimizationOptimize EC2 attached storage (EBS, instance store) and networking capabilities like enhanced networking and placement groups to improve performance.
- EC2 placement groupsImplement and use EC2 placement groups (cluster, spread, partition) to influence network performance and fault tolerance for specific workloads.
- Auto Scaling GroupsConfigure and manage Auto Scaling groups to automatically adjust EC2 instance capacity based on demand.
- Scaling PoliciesImplement and manage scaling policies (target tracking, step, simple) to control how Auto Scaling responds to CloudWatch alarms.
- Scheduled ScalingSet up scheduled scaling actions to anticipate predictable traffic patterns and adjust capacity at specified times.
- Elastic Load Balancing IntegrationIntegrate Auto Scaling with Elastic Load Balancing to distribute traffic and ensure healthy instances are in service.
- CloudFront CachingConfigure Amazon CloudFront distributions to cache content at edge locations, reducing origin load and improving scalability.
- ElastiCache CachingImplement Amazon ElastiCache (Redis or Memcached) to cache frequently accessed data, offloading database and enhancing scalability.
- Cache Invalidation and TTLManage cache invalidation and time-to-live (TTL) settings to ensure data freshness and optimal cache hit ratios.
- RDS ScalingConfigure Amazon RDS scaling mechanisms including read replicas, instance class changes, and storage autoscaling.
- DynamoDB ScalingConfigure DynamoDB capacity modes (provisioned and on-demand) and auto scaling to handle varying workloads.
- ELB Health Check ConfigurationConfigure Elastic Load Balancing health checks by setting the correct protocol, port, ping path, and healthy/unhealthy thresholds to match the application's requirements.
- ELB Health Check TroubleshootingTroubleshoot ELB health check failures by analyzing response codes, timeouts, and target registration states to identify and resolve misconfigurations.
- Route 53 Health Check TypesDistinguish between HTTP, HTTPS, TCP, and calculated health checks in Route 53 and select the appropriate type for different endpoint monitoring scenarios.
- Route 53 Health Check IntegrationIntegrate Route 53 health checks with DNS failover by associating them with records and configuring failover routing policies to redirect traffic away from unhealthy endpoints.
- Multi-AZ Deployment for RDSConfigure Multi-AZ deployments for Amazon RDS to provide automatic failover and enhance database availability across Availability Zones.
- Multi-AZ Deployment for EC2Design fault-tolerant EC2 architectures by distributing instances across multiple Availability Zones and using Auto Scaling groups to maintain capacity during failures.
- Fault-Tolerant Architecture PatternsApply fault-tolerant patterns such as active-passive and active-active configurations, and use services like ELB and Route 53 to route traffic to healthy resources.
- AWS Backup serviceAutomate snapshots and backups for EC2, RDS, EBS, S3, and DynamoDB using AWS Backup policies and plans.
- Manual snapshot and backup methodsCreate and manage manual snapshots and backups for AWS resources using native console, CLI, or SDK methods.
- Backup lifecycle policiesDefine retention and lifecycle rules for backups to balance cost and recovery requirements.
- Point-in-time recovery (PITR)Restore databases like RDS and DynamoDB to a specific point in time to meet RPO and RTO.
- Database restore methodsRestore databases from snapshots, automated backups, or PITR to new or existing instances, considering cost and downtime.
- S3 versioningEnable and manage S3 bucket versioning to protect against accidental deletion and overwrites.
- FSx versioning and backupsImplement versioning and backup strategies for Amazon FSx file systems.
- Disaster recovery strategiesCompare and apply backup and restore, pilot light, warm standby, and active/active DR patterns to meet RTO and RPO.
- DR best practicesFollow best practices for disaster recovery, including testing, automation, and multi-region replication.
- AMI Creation and ManagementCreate, manage, and deregister Amazon Machine Images (AMIs), including using EC2 Image Builder to automate image creation and maintenance.
- Container Image ManagementBuild, manage, and store container images using services like Amazon ECR and integrate with orchestration services.
- CloudFormation Template AuthoringAuthor CloudFormation templates to define AWS resources, including parameters, mappings, conditions, and outputs.
- CloudFormation Stack ManagementCreate, update, and delete CloudFormation stacks, and manage stack sets for multi-account and multi-region deployments.
- AWS CDK Application DevelopmentDevelop infrastructure as code using the AWS CDK, including defining constructs, stacks, and synthesizing CloudFormation templates.
- Deployment Issue IdentificationIdentify common deployment issues such as subnet sizing, CloudFormation errors, and permissions problems using logs and error messages.
- Deployment Issue RemediationRemediate deployment issues by adjusting resource configurations, fixing IAM policies, and correcting CloudFormation templates.
- Cross-Region Resource ProvisioningProvision resources across multiple AWS Regions using services like CloudFormation StackSets and custom scripts.
- Cross-Account Resource SharingShare resources across AWS accounts using AWS Resource Access Manager (RAM) and manage permissions for shared resources.
- Deployment StrategiesImplement various deployment strategies such as blue/green, canary, rolling, and immutable deployments using AWS services.
- Deployment Services UtilizationUtilize AWS deployment services like CodeDeploy, Elastic Beanstalk, and OpsWorks to automate application deployments.
- Third-Party Infrastructure as Code ToolsUse third-party tools like Terraform to define and manage AWS resources as code.
- Version Control IntegrationIntegrate Git and other version control systems with deployment pipelines to manage infrastructure and application code.
- AWS Systems Manager automationUse AWS Systems Manager to automate operational processes such as patch management, run command, and state management.
- Event-driven automation with LambdaImplement event-driven automation by using AWS Lambda to respond to events and perform automated actions.
- S3 Event NotificationsConfigure S3 Event Notifications to trigger automated workflows when objects are created, deleted, or modified in an S3 bucket.
- Amazon EventBridge rulesCreate EventBridge rules to route events from AWS services to targets for automated responses.
- AWS DevOps Agent integrationIntegrate AWS DevOps Agent with event sources to automate operational tasks in a DevOps pipeline.
- IAM Password PoliciesConfigure and enforce IAM password policies to meet organizational security requirements.
- Multi-Factor Authentication (MFA)Implement and manage MFA for IAM users and root accounts to add an extra layer of security.
- IAM RolesCreate and use IAM roles to delegate permissions to users, applications, or services securely.
- Federated IdentitySet up federated identity to allow users to access AWS resources using existing identity providers.
- Resource PoliciesWrite and attach resource-based policies to control access to AWS resources.
- Policy ConditionsUse policy conditions to restrict access based on context such as IP address, time, or MFA presence.
- AWS CloudTrail for AuditingUse CloudTrail to log and monitor API activity for auditing and troubleshooting access issues.
- IAM Access AnalyzerUse IAM Access Analyzer to identify resources shared with external entities and analyze access.
- IAM Policy SimulatorUse the IAM policy simulator to test and troubleshoot the effects of IAM policies.
- AWS OrganizationsImplement AWS Organizations to centrally manage multiple AWS accounts and consolidate billing.
- Service Control Policies (SCPs)Apply service control policies to restrict permissions across accounts in an organization.
- IAM Identity CenterUse IAM Identity Center to manage single sign-on and user access across multiple AWS accounts.
- Trusted Advisor Security ChecksInterpret Trusted Advisor security checks and implement remediation actions for identified risks.
- Remediation StrategiesDevelop and execute remediation plans to address security findings from Trusted Advisor.
- Region and Service SelectionEnforce compliance by selecting appropriate AWS Regions and services based on regulatory requirements.
- AWS Config Conformance PacksUse AWS Config conformance packs to enforce and monitor compliance rules across resources.
- Data Classification SchemeDefine and enforce a data classification scheme by categorizing data based on sensitivity and applying appropriate controls.
- Encryption at Rest with AWS KMSImplement and configure encryption at rest using AWS KMS, including creating and managing customer master keys (CMKs) and troubleshooting common issues.
- Encryption in Transit with ACMImplement and configure encryption in transit using AWS Certificate Manager (ACM) to provision, manage, and deploy SSL/TLS certificates, and troubleshoot related issues.
- Secure Secret StorageSecurely store and manage secrets using AWS services such as AWS Secrets Manager and AWS Systems Manager Parameter Store, including rotation and access control.
- Security Findings and RemediationConfigure reports and remediate findings from AWS security services including AWS Security Hub, Amazon GuardDuty, AWS Config, Amazon Inspector, and AWS Security Agent.
- VPC FundamentalsDefine a VPC, its CIDR blocks, and the default VPC components.
- Subnets and Route TablesCreate public and private subnets and configure route tables to direct traffic appropriately.
- Security Groups and Network ACLsConfigure security groups (stateful) and network ACLs (stateless) to control inbound and outbound traffic.
- Internet Gateway and NAT GatewaySet up an internet gateway for public subnets and a NAT gateway for private subnets to enable outbound internet access.
- Egress-Only Internet GatewayConfigure an egress-only internet gateway for IPv6 traffic from private subnets.
- VPC PeeringEstablish VPC peering connections between VPCs and configure routing for inter-VPC communication.
- VPC Endpoints and PrivateLinkImplement VPC endpoints (gateway and interface) and AWS PrivateLink to access AWS services privately without internet.
- Route 53 Resolver DNS FirewallConfigure Route 53 Resolver DNS Firewall to filter and monitor DNS queries.
- AWS WAFDeploy AWS WAF to protect web applications from common web exploits.
- AWS ShieldApply AWS Shield Standard and Advanced to protect against DDoS attacks.
- AWS Network FirewallSet up AWS Network Firewall to inspect and filter network traffic at the VPC level.
- Network Cost OptimizationIdentify and implement strategies to reduce network costs, such as using VPC endpoints, optimizing data transfer, and choosing appropriate gateway types.
- Route 53 Resolver configurationConfigure Route 53 Resolver for DNS resolution, including inbound and outbound endpoints, forwarding rules, and hybrid cloud DNS.
- Route 53 routing policiesImplement Route 53 routing policies such as simple, weighted, latency-based, geolocation, geoproximity, failover, and multi-value to route traffic effectively.
- Route 53 configurationsManage hosted zones, records, health checks, and traffic flow policies to ensure reliable DNS service.
- Route 53 query loggingEnable and analyze DNS query logs to monitor and troubleshoot DNS resolution activity.
- CloudFront distribution configurationConfigure CloudFront distributions, including origins, behaviors, cache policies, and SSL/TLS settings to deliver content efficiently.
- CloudFront content delivery optimizationImplement CloudFront features like signed URLs, field-level encryption, and Lambda@Edge to secure and customize content delivery.
- AWS Global Accelerator configurationConfigure AWS Global Accelerator to improve application availability and performance using static IP addresses and traffic management.
- VPC Configuration TroubleshootingDiagnose and resolve issues with subnets, route tables, network ACLs, security groups, transit gateways, and NAT gateways by analyzing their configuration and traffic flow.
- Networking Log Collection and InterpretationCollect and interpret VPC flow logs, ELB access logs, AWS WAF web ACL logs, CloudFront logs, and container logs to identify network issues.
- CloudFront Caching Issue Identification and RemediationIdentify and fix CloudFront caching problems by analyzing cache behavior, headers, and origin responses.
- Hybrid and Private Connectivity TroubleshootingTroubleshoot issues with hybrid connectivity (VPN, Direct Connect) and private connectivity (VPC peering, endpoints) by verifying configuration and routing.
- CloudWatch Network Monitoring Configuration and AnalysisConfigure and analyze CloudWatch metrics, alarms, and logs to monitor network performance and detect anomalies.
Ready to practice?Test your knowledge with exam-style questions or take an intelligent quiz tailored to your level.
Percentages reflect share of the current practice bank, not official exam weightings — no structured per-skill weight is published for SOA-C03, so none is invented.