AWS Certified CloudOps Engineer - Associate (SOA-C03) Exam Prep

What's inside

1. Level 1: Exam Orientation: SOA-C03 Format and Exam CraftFree
   [Exam orientation and exam craft] Covers how the course maps to AWS's SOA-C03 exam guide: the guide is AWS's own document, it is not reproduced here, and it is free on AWS's site. You also learn the exam format (65 questions, 50 scored, 130 minutes, scaled pass mark 720), that this course is independent of AWS and cannot promise a pass, and how to work through scenario 'best answer' questions across the five weighted domains.
2. Level 2: CloudWatch Metrics: Namespaces, Dimensions, Custom DataFree
   [Monitoring, Logging, Analysis, Remediation, and Performance Optimization – Task 1.1] Covers how Amazon CloudWatch metrics work: namespaces, dimensions, statistics, periods, standard and high resolution, basic and detailed monitoring, and publishing custom metrics. This is the base that later alarms, dashboards and remediation build on.
3. Level 3: The CloudWatch Agent on EC2
   [Monitoring, Logging, Analysis, Remediation, and Performance Optimization – Task 1.1] Covers deploying and configuring the CloudWatch agent on EC2 instances to collect memory, disk and process metrics and to ship log files. The agent configuration is kept in Systems Manager Parameter Store and the agent gets its permissions from an instance profile.
4. Level 4: Container Monitoring: ECS, EKS and Prometheus
   [Monitoring, Logging, Analysis, Remediation, and Performance Optimization – Task 1.1] Covers collecting metrics and logs from Amazon ECS and Amazon EKS with the CloudWatch agent and CloudWatch Container Insights. It also explains where Amazon Managed Service for Prometheus fits when a team already uses Prometheus metrics.
5. Level 5: CloudWatch Logs, Logs Insights and CloudTrail Logs
   [Monitoring, Logging, Analysis, Remediation, and Performance Optimization – Task 1.1] Covers configuring and analysing logs: CloudWatch Logs groups, retention and export, CloudWatch Logs Insights queries, subscription filters, and delivering AWS CloudTrail logs to CloudWatch Logs and Amazon S3 so you can investigate who did what.
6. Level 6: Metric Filters, Alarms and Composite Alarms
   [Monitoring, Logging, Analysis, Remediation, and Performance Optimization – Task 1.1] Covers turning log patterns into metrics with metric filters and building CloudWatch alarms: thresholds, evaluation periods, datapoints to alarm, missing-data handling, composite alarms to cut alert noise, and alarm actions that publish to Amazon SNS or EventBridge.
7. Level 7: Dashboards and Notifications at Scale
   [Monitoring, Logging, Analysis, Remediation, and Performance Optimization – Tasks 1.1-1.2] Covers building shareable CloudWatch dashboards that span accounts and Regions, and setting up notification paths: Amazon SNS, AWS User Notifications, and AWS Health events, so the right people hear about the right signals.
8. Level 8: EventBridge: Route, Enrich, Deliver, Troubleshoot
   [Monitoring, Logging, Analysis, Remediation, and Performance Optimization – Task 1.2] Covers using Amazon EventBridge to route, enrich and deliver events: event patterns, rules, targets, input transformers, scheduled rules, and fixing events that never reach their target.
9. Level 9: Automated Remediation with Systems Manager Runbooks
   [Monitoring, Logging, Analysis, Remediation, and Performance Optimization – Task 1.2] Covers automating remediation by running predefined and custom Systems Manager Automation runbooks, triggered from CloudWatch alarms or EventBridge rules, with AWS Lambda for custom logic and CloudTrail for auditing what ran.
10. Level 10: Compute and Amazon EBS Performance Optimization
    [Monitoring, Logging, Analysis, Remediation, and Performance Optimization – Task 1.3] Covers using performance metrics, resource tags and AWS tools such as AWS Compute Optimizer to right-size compute. It also covers analysing Amazon EBS metrics to troubleshoot throughput and IOPS limits and choosing the volume type (gp3, io2, st1, sc1) that balances performance and cost.
11. Level 11: S3, Shared Storage and Database Performance
    [Monitoring, Logging, Analysis, Remediation, and Performance Optimization – Task 1.3] Covers S3 performance strategies (multipart uploads, S3 Transfer Acceleration, AWS DataSync, S3 Lifecycle policies) and tuning shared file storage such as Amazon EFS and Amazon FSx. It also covers tuning Amazon RDS with Performance Insights and RDS Proxy.
12. Level 12: EC2 Auto Scaling Groups and Scaling Policies
    [Reliability and Business Continuity – Task 2.1] Covers managing Auto Scaling groups with launch templates and choosing dynamic scaling policies: target tracking, step and simple scaling, scheduled and predictive scaling. Also covers warm pools, lifecycle hooks and health check settings.
13. Level 13: Caching for Responsiveness: CloudFront and ElastiCache
    [Reliability and Business Continuity – Task 2.1] Covers using caching to improve responsiveness and take load off origins: Amazon CloudFront cache behaviours and TTLs at the edge, and Amazon ElastiCache (Redis OSS, Valkey, Memcached) with lazy-loading and write-through patterns in the data tier.
14. Level 14: Scaling Managed Databases: Aurora, RDS and DynamoDB
    [Reliability and Business Continuity – Task 2.1] Covers scaling managed databases: RDS read replicas, Aurora Replicas and Aurora Auto Scaling, Aurora Serverless v2 capacity, RDS storage autoscaling, and DynamoDB on-demand compared with provisioned capacity with auto scaling.
15. Level 15: Elastic Load Balancing and Health Check Troubleshooting
    [Reliability and Business Continuity – Task 2.2] Covers configuring Elastic Load Balancing for high availability: Application, Network and Gateway Load Balancers, target groups, cross-zone load balancing, connection draining (deregistration delay), and fixing failing ELB health checks.
16. Level 16: Route 53 Health Checks and Failover Routing
    [Reliability and Business Continuity – Task 2.2] Covers using Amazon Route 53 health checks (endpoint, calculated and CloudWatch alarm-based) with failover, weighted and latency routing policies to keep workloads available. Also covers fixing health checks that report the wrong state.
17. Level 17: Fault-Tolerant Multi-AZ Architectures
    [Reliability and Business Continuity – Task 2.2] Covers building fault-tolerant workloads with Multi-AZ deployments: RDS Multi-AZ DB instances and DB clusters, Aurora's storage and failover model, Auto Scaling groups spread across Availability Zones, and removing single points of failure.
18. Level 18: Automating Snapshots and Backups with AWS Backup
    [Reliability and Business Continuity – Task 2.3] Covers automating snapshots and backups with AWS Backup plans, vaults, resource assignments by tag, cross-Region and cross-account copies, and AWS Backup Vault Lock. Also compares Amazon Data Lifecycle Manager for EBS snapshots and AMIs.
19. Level 19: Point-in-Time Recovery to Meet RTO and RPO
    [Reliability and Business Continuity – Task 2.3] Covers database restore methods that meet stated recovery time objective (RTO) and recovery point objective (RPO) targets: RDS automated backups and point-in-time restore, manual snapshots, Aurora Backtrack, and DynamoDB point-in-time recovery.
20. Level 20: Versioning for Amazon S3 and Amazon FSx
    [Reliability and Business Continuity – Task 2.3] Covers protecting data with versioning: S3 Versioning and recovering deleted or overwritten objects, MFA Delete, S3 Object Lock, S3 replication, and backup and file-version recovery options for Amazon FSx file systems.
21. Level 21: Disaster Recovery Strategies: RTO, RPO and Trade-offs
    [Content Domain 2: Reliability and Business Continuity – Task 2.3] Learn the four disaster recovery strategies (backup and restore, pilot light, warm standby, and multi-site active-active) and how to pick the one that meets a stated RTO and RPO at the lowest cost.
22. Level 22: CloudFormation Templates, Stacks and Change Sets
    [Content Domain 3: Deployment, Provisioning, and Automation – Task 3.1] Learn how to write and run CloudFormation templates: parameters, mappings, conditions, outputs, cross-stack exports, change sets and drift detection.
23. Level 23: Troubleshooting CloudFormation Deployments
    [Content Domain 3: Deployment, Provisioning, and Automation – Task 3.1] Learn to find and fix deployment failures caused by service quotas, subnet sizing, permissions and template errors, and to protect resources with DeletionPolicy, stack policies and termination protection.
24. Level 24: Infrastructure as Code with the AWS CDK
    [Content Domain 3: Deployment, Provisioning, and Automation – Task 3.1] Learn how the AWS Cloud Development Kit (AWS CDK) builds CloudFormation from code: constructs, apps and stacks, bootstrapping, and the synth, diff and deploy workflow.
25. Level 25: Multi-Account and Multi-Region: StackSets and AWS RAM
    [Content Domain 3: Deployment, Provisioning, and Automation – Task 3.1] Learn to provision and share resources across AWS accounts and Regions using CloudFormation StackSets and AWS Resource Access Manager (AWS RAM).
26. Level 26: AMIs, Container Images and EC2 Image Builder
    [Content Domain 3: Deployment, Provisioning, and Automation – Task 3.1] Learn to create, maintain, share and distribute AMIs and container images, using EC2 Image Builder pipelines for automated, tested and patched images.
27. Level 27: Deployment Strategies: Rolling, Blue/Green, Canary
    [Content Domain 3: Deployment, Provisioning, and Automation – Task 3.1] Learn to compare deployment strategies (in-place/rolling, immutable, blue/green and canary) and how AWS services carry them out with low risk and fast rollback.
28. Level 28: Third-Party IaC: Terraform and Git
    [Content Domain 3: Deployment, Provisioning, and Automation – Task 3.1] Learn how to use and manage third-party tools such as Terraform and Git to automate resource deployment on AWS alongside native services.
29. Level 29: Systems Manager Basics: Run Command and Parameter Store
    [Content Domain 3: Deployment, Provisioning, and Automation – Task 3.2] Learn how AWS Systems Manager manages nodes: SSM Agent and instance profiles, Fleet Manager, Session Manager, Run Command, and Parameter Store for configuration data.
30. Level 30: Systems Manager Automation, Patch Manager and State Manager
    [Content Domain 3: Deployment, Provisioning, and Automation – Task 3.2] Learn to automate operational tasks with Systems Manager Automation runbooks, Patch Manager patch baselines and patch groups, maintenance windows and State Manager associations.
31. Level 31: Event-Driven Automation: Lambda, EventBridge, S3 Events
    [Content Domain 3: Deployment, Provisioning, and Automation – Task 3.2] Learn to build event-driven processes that manage existing resources, using Amazon EventBridge rules and schedules, AWS Lambda and Amazon S3 Event Notifications.
32. Level 32: IAM Policies, Roles, MFA and Federation
    [Content Domain 4: Security and Compliance – Task 4.1] Learn to set up IAM users, groups, roles and policies, enforce MFA, and use federated access through IAM Identity Center and identity providers.
33. Level 33: Troubleshooting Access and Auditing with IAM Tools
    [Content Domain 4: Security and Compliance – Task 4.1] Learn to troubleshoot and audit access using IAM policy evaluation logic, permissions boundaries, the IAM policy simulator, IAM Access Analyzer and CloudTrail records of denied calls.
34. Level 34: Multi-Account Governance: Organizations and SCPs
    [Content Domain 4: Security and Compliance – Task 4.1] Learn multi-account strategies using AWS Organizations, organizational units, service control policies (SCPs) and AWS Control Tower guardrails.
35. Level 35: Compliance Auditing: CloudTrail and AWS Config Rules
    [Content Domain 4: Security and Compliance – Tasks 4.1 and 4.2] Learn to enforce and audit compliance with CloudTrail trails and log file validation, AWS Config rules, conformance packs, aggregators and automatic remediation.
36. Level 36: Data Protection: KMS, ACM and Data Classification
    [Content Domain 4: Security and Compliance – Task 4.2] Learn to protect data with encryption at rest using AWS KMS, encryption in transit using AWS Certificate Manager (ACM), and data classification with Amazon Macie.
37. Level 37: Secrets Management with Secrets Manager
    [Content Domain 4: Security and Compliance – Task 4.2] Learn to manage secrets securely with AWS Secrets Manager, including automatic rotation, cross-account access and how it compares with Parameter Store SecureString.
38. Level 38: Security Hub, GuardDuty and Inspector Findings
    [Content Domain 4: Security and Compliance – Task 4.2] Learn to use and remediate findings from AWS Security Hub, Amazon GuardDuty, Amazon Inspector and AWS Config, routing them through EventBridge for automated response.
39. Level 39: VPC Design: CIDR, Subnets, Route Tables and NAT
    [Content Domain 5: Networking and Content Delivery – Task 5.1] Learn to design and configure a VPC: CIDR planning, public and private subnets across Availability Zones, route tables, internet gateways and NAT gateways.
40. Level 40: Security Groups vs Network ACLs
    [Content Domain 5: Networking and Content Delivery – Task 5.1] Learn to secure VPC traffic with stateful security groups and stateless network ACLs, including rule ordering, ephemeral ports and security group references.
41. Level 41: VPC Endpoints and AWS PrivateLink
    [Networking and Content Delivery – Task 5.1, Skill 5.1.2] Learn how to reach AWS services and partner services without using the internet. Covers gateway endpoints for S3 and DynamoDB versus interface endpoints, AWS PrivateLink endpoint services, endpoint policies, private DNS, and how to set these up with the AWS CLI and CloudFormation.
42. Level 42: Peering, Transit Gateway, VPN and Network Cost
    [Networking and Content Delivery – Task 5.1, Skills 5.1.2 and 5.1.4] Connect VPCs and on-premises networks with VPC peering, transit gateways and AWS Site-to-Site VPN, and cut network costs, such as NAT gateway data processing, cross-AZ traffic and data transfer.
43. Level 43: Auditing Network Protection Services
    [Networking and Content Delivery – Task 5.1, Skill 5.1.3] Audit the AWS network protection services in a single account: Route 53 Resolver DNS Firewall, AWS WAF web ACLs, AWS Shield Standard and Shield Advanced, and AWS Network Firewall. Learn what each one inspects and where it sits in the traffic path.
44. Level 44: Route 53 Resolver, Routing Policies and Query Logs
    [Networking and Content Delivery – Task 5.2, Skills 5.2.1 and 5.2.2] Configure DNS with Route 53 public and private hosted zones and Route 53 Resolver inbound and outbound endpoints and forwarding rules for hybrid DNS. Then set up Route 53 routing policies, alias records and query logging.
45. Level 45: CloudFront, Global Accelerator and Caching Fixes
    [Networking and Content Delivery – Task 5.2, Skill 5.2.3, and Task 5.3, Skill 5.3.3] Configure content and service distribution with CloudFront (origins, origin access control, cache and origin request policies, TTLs) and AWS Global Accelerator, then find and fix CloudFront caching problems.
46. Level 46: Troubleshooting Network Connectivity
    [Networking and Content Delivery – Task 5.3, Skills 5.3.1, 5.3.2, 5.3.4 and 5.3.5] Troubleshoot VPC, transit gateway, NAT gateway, hybrid and private connectivity problems. Use VPC flow logs, ELB access logs, AWS WAF web ACL logs, CloudFront logs and container logs, plus CloudWatch network monitoring services such as Network Monitor and Internet Monitor, and Reachability Analyzer.
47. Level 47: Timed Mock Exam: SOA-C03 (65 Questions, 130 Minutes) Timed mock
    [All five content domains] A timed 65-question, 130-minute mock exam with a 72% pass mark, made of original scenario questions in the exam's weighting (22% Domain 1, 22% Domain 2, 22% Domain 3, 16% Domain 4, 18% Domain 5).

Access

The first 2 levels are free with a free account. Every level, the podcast edition and the AI tutor come with All Access at £4.99/month or any Creator plan — see pricing.

Start free →