SOA-C03 AWS Certified CloudOps Engineer - Associate Study Guide¶

Independent AI-assisted resource — SOURCES + OBJECTIVES CHECKED; HUMAN REVIEW PENDING. Objective coverage, citations, volatility labels, links, and exam-integrity compliance were reviewed on October 28, 2026, including all 53 numbered skills. This is not a guarantee that the guide is error-free or current after that date. See the sources-and-objectives record. The official SOA-C03 exam guide is authoritative.

Study guide at a glance

Start here

Report an issue with SOA-C03

Blueprint checked2026-10-28

Review stateSources + objectives checked — human review pending

Guide-only active reading45 min–1 hr 15 min

Prerequisites: No formal prerequisite; AWS targets candidates with about one year deploying, managing, and operating workloads. Practice console/CLI, scripting, operating systems, containers, CI/CD, IaC, monitoring/logging, networking, security, multi-account operations, incident response, backup/recovery and performance/cost troubleshooting.

Exam essentialsRead the objective map, key distinctions, and readiness checklist.

Deep understandingWork through every domain, including decisions, failure modes, and related items.

Hands-on labsBegin with Lab 1: Operational evidence map — 60–90 minutes, then use the remaining labs to produce evidence you can inspect and explain.

Official objective domains

See the objective map in this guide

The active-reading range uses 90–130 words per minute for technical material. Labs, troubleshooting, note-taking, spaced review, and prerequisite gaps add time; it is not a total preparation promise.

Current baseline: SOA-C03 revision 1.1 published June 1, 2026; five domains; 50 scored plus 15 unscored questions
Upcoming delivery change: AWS says the Simplified Chinese and Korean language versions retire after November 19, 2026. This is a language-specific delivery change; the SOA-C03 blueprint remains the current study baseline. Rechecked September 28, 2026; no additional overall exam retirement was found. See the deep-review report.
Important freshness boundary: SOA-C03 replaced SOA-C02 and renamed the credential from SysOps Administrator to CloudOps Engineer. It has five domains rather than the older six and explicitly includes container operations, multi-account/multi-Region work, CDK, Terraform/Git, Kiro, AWS DevOps Agent, AWS Security Agent, Amazon S3 Files, and expanded automation. Gap-check every SOA-C02 course.
Official source: AWS Certified CloudOps Engineer - Associate exam guide

The revision history dates the AI monitoring, agent and S3 Files additions to June 1, 2026. A course carrying the SOA-C03 title can still predate these changes.

Current guide watch — October 28, 2026¶

The official revision history lists revision 1.1, published June 1, 2026. The CloudOps exam continues to emphasize containers, multi-account and multi-Region operations, automation and infrastructure as code; these are in the C03 blueprint, not inferred from newer AWS service releases. Keep product examples versioned and confirm the in-scope list in the live guide. AWS SOA-C03 revision history

How to use this guide¶

SOA-C03 tests operational judgment: observe a workload, diagnose the actual fault, choose a safe remediation, automate repeatable work, preserve recovery, and verify the result. The target candidate has about one year deploying, managing, and operating AWS workloads and can use the console, CLI, infrastructure as code, monitoring/logging, networking, security, scripting, operating systems, containers, and CI/CD.

The certification page lists a 130-minute, 65-question, USD 150 exam delivered online or at Pearson VUE in English, Japanese, Korean, and Simplified Chinese. The detailed guide identifies 50 scored and 15 unidentified unscored multiple-choice or multiple-response items and a 720 minimum scaled score. Recheck the live certification page before scheduling; price, language, and delivery details are VERIFY CURRENT.

For each operational scenario, work in this order:

Define the expected state, symptom, scope, impact, timeline, and recent change.
Select the evidence that can distinguish hypotheses—metric, log, trace, event, configuration, audit record, health check, or network path.
Find the smallest causal layer: application, identity, quota, resource, storage, database, deployment, DNS, routing, filtering, dependency, or region.
Stabilize safely; preserve evidence; use a reversible, least-privilege remediation.
Verify customer and system recovery against a measurable signal.
Prevent recurrence with automation, guardrails, runbooks, tests, observability, capacity, or architectural change.

About related items: A Related item: callout adds prerequisite, operational, architectural, or adjacent context that makes the current topic easier to understand. It is useful supporting knowledge, not a claim that the item appears verbatim in the published exam objectives.

Objective map¶

Published domain	Weight	Central question
Monitoring, Logging, Analysis, Remediation, and Performance Optimization	22%	Which evidence isolates the problem, and how should it be remediated and optimized?
Reliability and Business Continuity	22%	How should capacity, failure, backup, recovery, and continuity requirements be implemented and tested?
Deployment, Provisioning, and Automation	22%	How are repeatable resources and operations deployed, changed, shared, and recovered safely?
Security and Compliance	16%	How are access, accounts, data, findings, and continuous controls implemented and troubleshot?
Networking and Content Delivery	18%	How are VPC, private/hybrid connectivity, DNS, edge delivery, protection, and network faults operated?

Three domains share the highest weight. Treat monitoring, reliability, and automation as one operating loop rather than separate memorization units.

1. Monitoring, Logging, Analysis, Remediation, and Performance Optimization — 22%¶

The official Domain 1 page covers workload signals, CloudWatch agents/alarms/dashboards, EventBridge and SNS, automated remediation, Systems Manager runbooks, and compute/storage/database optimization.

Build an evidence chain¶

Signal	Main operational question	Typical AWS source
Metric	How much, how often, and when did a numeric condition change?	CloudWatch metrics, service metrics, custom metrics, Prometheus
Log	What detailed event or application message occurred?	CloudWatch Logs, service/access/flow/container logs
Trace	Where did a distributed request spend time or fail?	AWS X-Ray or OpenTelemetry-compatible telemetry
Event	What state transition should trigger routing or action?	EventBridge and service events
Configuration	What should exist, what changed, and is it compliant?	AWS Config, IaC state, resource inventory
Audit record	Who or what called which API, from where, and with what result?	CloudTrail
Health signal	Should traffic or capacity be shifted?	ELB, Route 53, Auto Scaling, service health checks

CloudWatch collects and acts on metrics, logs, and related telemetry; CloudTrail records account activity and API calls. A metric shows that error rate rose; logs explain individual failures; CloudTrail can show a configuration change; a trace can identify the slow dependency. Choose evidence that tests a hypothesis rather than opening every console.

The CloudWatch agent collects additional host or application metrics and logs from EC2 and supported container environments. Confirm agent configuration, credentials/role, network reachability, destination region, log group/stream behavior, and time. Missing telemetry is not proof that the workload is healthy.

For AI workloads in skill 1.1.1, distinguish infrastructure health from acceptable answers. For a Bedrock-backed application, monitor user task success alongside invocation latency, first-token latency for streaming, input/output tokens, client/server errors and throttles. The runtime metric definitions state that Invocations counts successful requests; it is not a denominator containing every failed or throttled attempt. SDK retries can affect throttle counts. Use a consistent time window, endpoint, model and application request identifier before calculating a rate. Protect prompt/response logs and define retention.

The X-Ray SDK/daemon migration guidance places those instrumentation components in maintenance from February 25, 2026 and recommends OpenTelemetry. This is not a retirement of the X-Ray service. Check existing instrumentation, propagators and collectors before following an old lab.

Make alarms actionable¶

An alarm evaluates a metric/statistic against a threshold over periods. Understand evaluation periods, datapoints-to-alarm, missing-data treatment, dimensions, percentile/statistic choice, and the difference between OK, ALARM, and INSUFFICIENT_DATA. A composite alarm combines other alarm states to reduce noise or express dependencies; it does not repair weak underlying signals. Composite alarms can notify SNS or initiate supported investigation/operations workflows, but cannot directly execute EC2 or Auto Scaling actions. Select the supported action path and test the target separately. Most alarm actions run on a state transition; Auto Scaling actions are a documented repeated-action exception.

Use EventBridge for event pattern matching, routing, transformation/enrichment, and delivery. Use SNS when a publish/subscribe notification fan-out fits. Alarm actions and event targets must have appropriate permissions and failure handling. Test target delivery, retries, dead-letter behavior where supported, and the difference between an event being matched and a remediation succeeding.

Dashboards should connect customer symptoms, service-level indicators, resource saturation, dependency health, changes, and alarms. Cross-account/cross-Region views help central operations, but access, region, data delay, and dimension differences can mislead.

Automate bounded remediation¶

Systems Manager Automation runbooks can execute predefined or custom operational steps. A safe automation has a narrow trigger, least-privilege role, validated parameters, concurrency/error limits, idempotent behavior, audit trail, rollback or stop condition, and verification. Use Lambda or scripts when custom logic fits, but own packaging, timeout, retry, secrets, observability, and failure recovery.

Current blueprint examples have different operational purposes:

Tool	Useful role	Operational boundary
Kiro	Help develop/review scripts, code and infrastructure changes	Validate generated changes, tool permissions and tests
AWS DevOps Agent	Correlate telemetry, deployments and topology for investigations/release readiness	Agent Spaces define connected accounts, integrations and permissions; verify conclusions against evidence
AWS Security Agent	Design/security review, threat modeling and scoped application testing	Current docs call it part of AWS Continuum; scope any test explicitly and review findings/remediation

Product names in the exam can lag current documentation. Availability, Regions, pricing and allowed actions remain VERIFY CURRENT. Keep narrow credentials, explicit action approval where required, audit records and a way to stop automation.

Related item: Event-driven automation is not the same as closed-loop control. A complete loop detects, decides, acts, verifies, and escalates; otherwise the automation can repeatedly execute without proving recovery.

Optimize from the bottleneck¶

Compute: inspect utilization, throttling, queueing, memory, disk/network, load shape, instance family/size, containers/tasks, Lambda concurrency/duration, placement, Auto Scaling behavior, and quotas. Low average CPU does not rule out a short peak or memory constraint.
EBS: relate volume type, provisioned IOPS/throughput, instance limits, queue length, latency, burst balance, attachment, filesystem, and workload pattern. Changing volume size alone does not solve every bottleneck.
S3/data transfer: use multipart upload for suitable large objects, DataSync for managed transfers, Transfer Acceleration only when measured path benefit justifies cost, and lifecycle rules for retention/access economics—not application performance by default.
Shared file: select EFS, FSx variants, or S3 file capabilities from protocol, operating system, semantics, throughput, latency, availability, integration, and cost. Amazon S3 Files exposes linked general-purpose bucket data through a shared file system; account for its synchronization and access boundaries below.
RDS: connect CPU, memory, storage, connections, locks/waits, query behavior, replicas, failover, Performance Insights, recommendations, parameter changes, and RDS Proxy. A proxy can manage connections; it does not optimize inefficient SQL.

The exam still calls out Performance Insights. Its RDS documentation path now describes CloudWatch Database Insights, with DB load filtered by waits, SQL, hosts or users; the page still links the Performance Insights API. Recognize both names and verify engine/mode/retention support instead of assuming old console instructions remain exact.

Operate S3 Files with synchronization in mind¶

The April 7 launch article is a useful conceptual walkthrough of file access to bucket data. Pair it with the synchronization documentation:

The linked bucket requires versioning. Active data may be copied into high-performance file storage, with separate storage/request costs.
File changes export after 60 seconds of write inactivity; this starts the export, not a guarantee of completion in 60 seconds. Object-side updates also take time to appear through the file interface.
A conflicting bucket update takes precedence. The conflicting file is preserved in a file-system lost-and-found directory, which is not copied to the bucket and may be outside a restricted access-point root.
A directory rename translates into per-object work in S3. Temporary old/new prefixes, synchronization time and request charges matter; the file-side rename is not an atomic bucket-wide transaction.

Use a coordinated writer pattern and test conflict recovery before relying on simultaneous file/API writes. The article's claims about universal performance or eliminating every tradeoff are not operating guarantees.

Optimize only after measuring the limiting resource and checking downstream effects, availability, recovery, and cost.

2. Reliability and Business Continuity — 22%¶

The official Domain 2 page covers scaling, caching, managed-database capacity, load-balancer/Route 53 health, fault tolerance, backup/restore, storage versioning, and disaster-recovery patterns.

Separate scalability, elasticity, availability, and recovery¶

Scalability is the ability to meet increased demand; elasticity adjusts capacity with demand.
High availability reduces service interruption during component failure.
Fault tolerance continues operation through specified faults, usually at greater cost/complexity.
Disaster recovery restores service after a major event; it is not the same as routine high availability.
Durability is the likelihood that data remains intact; it does not guarantee immediate access.

EC2 Auto Scaling needs launch configuration/template, min/max/desired capacity, subnets, health checks, replacement behavior, and scaling policy. Target tracking maintains a target metric; step/simple scaling reacts to thresholds; scheduled scaling anticipates known demand; predictive options use forecast where supported. Include instance warmup and application readiness so new capacity is not counted too early. A group at maximum capacity cannot scale further even if an alarm fires.

Elastic Load Balancing distributes traffic and performs health checks. Route 53 health checks and routing can influence DNS answers. Diagnose the entire path: healthy target registration, listener/rule, target port, security, application health path, threshold, deregistration delay, DNS TTL, and client caching.

CloudFront caches content at edge locations; ElastiCache supplies application data caching. Both can improve performance and reduce origin/database load, but freshness, invalidation/TTL, cache-key design, failover, and cost must match the use case.

Design failure domains deliberately¶

Multi-AZ placement protects against an Availability Zone fault only when every dependency and routing path can operate across zones. RDS Multi-AZ primarily supports availability/failover; read replicas support read scaling and can have different recovery implications. DynamoDB capacity modes and auto scaling solve capacity differently from relational instances. Identify which layer is stateful, how writes are preserved, and what the application does during partial failure.

The AWS Reliability Pillar emphasizes foundations, architecture, change, and failure management. Quotas, dependency limits, controlled change, recovery testing, and learning from failure belong beside redundant architecture.

Make recovery measurable¶

RPO is the maximum acceptable data-loss interval; RTO is the maximum acceptable restoration time. Translate them into backup frequency, replication, architecture, procedure, staffing, test cadence, and cost. A backup existing is not evidence that it restores within RTO.

AWS Backup can centralize policies and supported resource protection. Understand vault/access controls, schedules, lifecycle, copies, cross-account/Region needs, retention lock where applicable, monitoring, and restore testing. Service-native snapshots, point-in-time recovery, S3 versioning, object protection, database backups, and file-service versioning have different semantics.

DR strategy	Typical readiness	Relative cost	Key operational requirement
Backup and restore	Resources recreated/restored after event	Lowest	Current IaC, protected backups, dependencies, and tested restoration
Pilot light	Critical core stays running; capacity expands	Low–medium	Automation and frequent scale-up tests
Warm standby	Reduced but functional copy operates	Medium–high	Data replication, traffic shift, capacity expansion, and consistency
Multi-site active/active	Multiple sites serve traffic	Highest	Conflict/consistency model, routing, isolation, observability, and complex testing

Select from business RTO/RPO and failure assumptions, not prestige. The AWS DR guidance provides the pattern context.

Related item: Backups must be isolated from the same credentials, account compromise, encryption-key loss, region event, or retention error they are intended to survive.

3. Deployment, Provisioning, and Automation — 22%¶

The official Domain 3 page covers AMIs/container images, CloudFormation/CDK, deployment diagnosis, cross-account/Region sharing, deployment strategies, Terraform/Git, Systems Manager, Lambda, S3 events, EventBridge, and agent examples.

Make artifacts reproducible¶

An AMI packages an EC2 launch baseline; EC2 Image Builder can automate image pipelines, component steps, tests, distribution, and lifecycle. Container images package application/runtime layers and should be versioned, scanned, signed or otherwise trusted as required, and promoted by immutable digest rather than a mutable tag alone. Keep credentials and environment-specific configuration outside images.

Record source, dependency versions, build steps, tests, approval, provenance, vulnerability state, owner, and retirement. An image that launches successfully can still be insecure, incompatible, or unobservable.

Treat infrastructure as reviewed state¶

CloudFormation manages stacks from templates. Know parameters, mappings/conditions, outputs/exports, dependencies/references, change sets, stack policies, rollback, termination protection, deletion/update-replace policies, nested stacks, drift detection, and failure events. Always read the failing resource event and underlying service error; a stack status alone is not root cause.

The AWS CDK defines infrastructure in supported programming languages and synthesizes CloudFormation templates. Review the synthesized change, asset publication, bootstrap roles, and environment context. CDK does not remove CloudFormation behavior.

StackSets deploy stacks across selected accounts and Regions with permission and rollout controls. AWS Resource Access Manager shares supported resources; it does not copy every resource or replace identity/network design. Use organization/account boundaries and failure tolerance deliberately.

Common deployment failures include missing IAM permission, unsupported region or quota, invalid parameter/reference, resource-name collision, insufficient subnet/IP capacity, unavailable instance type, dependency order, immutable-property replacement, failed custom resource, health check, and rollback failure. Preserve events and logs before forcing deletion.

Choose a deployment strategy from risk¶

Strategy	Strength	Tradeoff
In-place / rolling	Lower extra capacity and simple for tolerant change	Mixed versions, capacity reduction, rollback complexity
Immutable	New instances/images reduce configuration drift	Extra capacity and slower replacement
Blue/green	Fast traffic switch and rollback to separate environment	Duplicate resources, data/schema compatibility, routing control
Canary	Limits exposure while evidence accumulates	Requires segmented traffic, metrics, gates, and reliable rollback

Define pre-deploy validation, health/acceptance signals, bake time, maximum unavailable/error, database compatibility, traffic step, rollback trigger, and post-deploy verification. A successful pipeline is not proof that the customer outcome works.

Terraform and Git appear explicitly in the objective as third-party automation examples. Manage remote state, locking, provider/module versions, secrets, review, plan/apply separation, drift, import, and recovery. Do not let two IaC systems unknowingly own the same resource.

Automate operations, not surprises¶

Systems Manager supports inventory, patch/configuration, remote command, automation, session access, and other operations, subject to current service features. EventBridge and S3 event notifications can trigger Lambda, runbooks, workflows, or other targets. Design for duplicate/out-of-order delivery, retries, idempotency, concurrency, dead letters, poison events, partial failure, permission, and audit.

Related item: Git records desired-source history; CloudTrail records API activity; Config records resource configuration/compliance; CloudFormation records stack operation. Together they answer different parts of who intended, applied, and observed a change.

4. Security and Compliance — 16%¶

The official Domain 4 page covers IAM/federation, access troubleshooting, Organizations/SCPs/Identity Center, Trusted Advisor, continuous compliance, classification, encryption, certificates, secrets, findings, and remediation.

Evaluate access systematically¶

Start with caller and session, requested action/resource, identity policy, resource policy, permissions boundary, session policy, organization SCP/RCP where applicable, conditions, key policy/grant, endpoint policy, and service-specific authorization. An explicit deny wins. SCPs set maximum permissions for member accounts; they do not grant an action. A role trust policy controls who may assume it, while attached policies control what an assumed session may do.

Use federation and IAM Identity Center for workforce access rather than distributing long-lived IAM-user keys. Use roles for workloads, MFA for appropriate identities, conditions for context, and short-lived credentials. The IAM policy evaluation logic should drive troubleshooting before adding broad permissions.

CloudTrail can identify failed calls and caller context. IAM Access Analyzer identifies external/public access and can validate policies; the IAM policy simulator tests policy evaluation within its documented limitations. Verify which policy type or service layer produced a denial.

Operate multi-account guardrails¶

Organizations centralizes accounts and organizational units; SCPs constrain permissions; Identity Center manages workforce assignment; delegated administration and security-service organization integration can centralize operations. Preserve break-glass access, account ownership, logging, billing, region/service restrictions, exception handling, and rollout testing. A deny applied high in the OU tree can interrupt every child workload.

AWS Config records configuration and evaluates rules/conformance packs; Trusted Advisor produces recommendations/checks based on current entitlements; Security Hub aggregates/normalizes security findings and standards; GuardDuty detects threats from data sources; Inspector assesses supported workload vulnerabilities/exposure. A finding needs owner, severity/context, suppression standard, remediation, evidence, and closure validation.

AWS Security Agent remains the exam label; current documentation places it within AWS Continuum. Its application review/testing role complements the distinct configuration, audit, detection and vulnerability evidence from Config, CloudTrail, GuardDuty, Inspector and Security Hub.

Protect data from classification outward¶

Classification connects data sensitivity to allowed locations, identities, encryption, network paths, logging, retention, backup, sharing, and deletion. AWS KMS provides managed keys and cryptographic operations; distinguish key policy, grants, IAM permission, rotation, multi-Region behavior, aliases, deletion windows, and service integration. Losing key access can make otherwise intact backups unusable.

ACM manages supported public/private certificates and renewal in applicable integrations; diagnose domain validation, expiration, chain, hostname, listener, region, and private-key ownership. Encrypt in transit with the protocol and trust path the client actually uses.

Secrets Manager supports managed secret storage/rotation patterns; Systems Manager Parameter Store supports configuration and secure-string patterns. Choose from rotation, integration, size, hierarchy, access, audit, and cost. Never store secrets in templates, AMIs, container layers, repositories, logs, or user data.

Related item: Compliance is evidence that controls meet stated requirements over time. Encryption enabled at one layer is only one control, not a complete compliance outcome.

5. Networking and Content Delivery — 18%¶

The official Domain 5 page covers VPC components, private connectivity, protection services, cost, DNS/Route 53, CloudFront/Global Accelerator, and troubleshooting with network logs and monitoring.

Read a packet path in order¶

Within a VPC, route tables select the most specific matching route. An internet gateway permits internet routing for appropriately addressed resources; a NAT gateway supports outbound IPv4 from private subnets but not unsolicited inbound connections; an egress-only internet gateway serves outbound IPv6 patterns. Security groups are stateful and attach to supported resources; network ACLs are stateless subnet controls, so return traffic/ephemeral ports matter.

VPC endpoints keep supported service access on AWS networking. Gateway endpoints and interface endpoints/PrivateLink have different route, DNS, security-group, policy, availability, and cost behavior. VPC peering connects two VPCs without transitive routing. Transit Gateway supplies hub-style connectivity. Hybrid connectivity may use VPN or Direct Connect, but route propagation/advertisement, BGP, tunnels, prefixes, MTU, firewalls, DNS, and redundancy must align.

Use the Amazon VPC guide for current component behavior. For a failed connection, test:

DNS answer and resolver path.
source/destination address and port.
route in both directions, including propagated/static conflicts and longest-prefix match.
security group, NACL, firewall, endpoint policy, and on-premises control.
gateway/peering/transit/VPN/Direct Connect attachment and state.
target listener/application health and operating-system firewall.
flow, load-balancer, WAF, CloudFront, container, and application logs.
Network monitoring or Reachability Analyzer where applicable, remembering configuration analysis does not send packets or prove application behavior.

DNS and edge decisions¶

Route 53 provides authoritative DNS, health-check/routing features, and Resolver for VPC/on-premises resolution. Know simple, weighted, latency, failover, geolocation, geoproximity, and multivalue policies at the decision level; select from traffic goal and health behavior. TTL affects caching and failover observation. Resolver inbound/outbound endpoints and rules support hybrid DNS; query logging provides evidence but must be enabled and analyzed.

CloudFront is a content delivery network with caching and edge request features. Global Accelerator provides static anycast IP entry and directs TCP/UDP traffic through the AWS global network to healthy regional endpoints. DNS routing, CDN caching, and accelerator routing solve different problems.

Route 53 Resolver DNS Firewall filters DNS queries; AWS WAF filters supported web requests; Shield addresses DDoS protection tiers; Network Firewall provides managed VPC network filtering. Confirm attachment point, traffic visibility, rule order/action, logging, and cost.

Regional NAT gateways are another current option alongside zonal gateways. Automatic mode can expand to additional AZs, with a documented interval before local coverage is ready; manual mode requires explicit AZ configuration. Private NAT remains zonal. Check actual coverage, migration connection resets and route behavior before assuming every subnet immediately has a local path.

Network cost can be shaped by NAT processing, cross-AZ/Region transfer, internet egress, endpoint hourly/data processing, transit gateways, load balancers, accelerator/CDN, duplicated inspection, and chatty architecture. Use flow and billing evidence before redesigning; a cheaper path must still satisfy security, availability, and performance.

Related item: A VPC Flow Log ACCEPT means the recorded network interface traffic passed the evaluated security-group/NACL path represented by the record; it does not prove that the application completed the request successfully.

Integrated scenarios¶

Scenario 1: Silent order-processing backlog¶

An SQS-backed worker fleet is running, CPU is low, and orders are delayed. Start with customer latency/backlog, queue depth/age, receive/delete/error metrics, worker logs, dependency health, deployment/config changes, and scaling metric. Low CPU may mean blocked I/O or no messages received. Check IAM, visibility timeout, poison messages, max Auto Scaling capacity, warmup, and downstream throttling. Stabilize, verify backlog age falls, then add an actionable service-level alarm and an idempotent remediation/escalation runbook.

Scenario 2: Regulated multi-account service recovery¶

A production database in one account must meet a one-hour RTO and 15-minute RPO after a regional event. Map application, network, identity, keys, secrets, DNS, data, images, templates, and external dependencies. Configure protected and access-controlled backup/copies appropriate to each resource, ensure the recovery account/region can use keys and artifacts, deploy from reviewed IaC, and rehearse DNS/traffic change. Measure restored data point and full service time; a restored database alone does not meet service RTO.

Scenario 3: Private application cannot reach a partner¶

Instances in private subnets fail only for one partner endpoint after a network change. Confirm DNS answer, address family, target port, subnet routes, NAT/endpoint/transit/VPN path, SG/NACL/firewall, on-premises/partner allowlist, and return route. Compare flow logs and change/audit records. Avoid adding 0.0.0.0/0 permissions as diagnosis. Apply the smallest reversible route or control correction, test the application, then add configuration guardrails and path monitoring.

Worked operational checks¶

These original scenarios use hypothetical measurements. Eight local arithmetic/logic assertions passed; no AWS resources were deployed.

Read the alarm window: With three real one-minute datapoints of 6%, 2% and 7%, a static alarm requiring two of three values strictly above 5% has two breaches. This simplified case has no missing samples; missing-data handling and delayed datapoints require separate tests. A composite alarm can summarize the result, but cannot directly scale EC2.
Check a configured scaling ceiling: Arrivals are 120 jobs/minute and each healthy worker completes 15. At a configured maximum of six workers, completion is only 90/minute and backlog grows by 30/minute. If authorized capacity permits ten healthy workers, net drain is 30/minute and a 300-job backlog takes about ten minutes after readiness, assuming constant rates. Check dependencies, quotas and warmup before changing the limit.
Measure complete recovery: Detection takes 6 minutes, approval 4, restore 25, validation 8 and traffic/client convergence 7. Full recovery is 50 minutes, leaving ten minutes against a one-hour RTO. If restored committed data is 18 minutes behind the loss boundary, it misses a 15-minute RPO even though recovery time passes.
Wait for export evidence: A file is written every 30 seconds through minute five. With the documented 60-second inactivity trigger, export can start at minute six. Do not tell an API reader to trust minute-six completion; observe the synchronized object/version. If an API writer changes the same object first, inspect the conflict copy and deliberately reconcile it.

Practice labs¶

These eight labs remain proposed; no cloud execution was performed during this review. Use an AWS Builder Lab, organization-approved sandbox, or disposable personal training account. Set a budget/alarm, avoid production data, use least privilege, record created resources, and remove billable resources after validation. Current prices and free-tier coverage are VERIFY CURRENT.

Lab 1: Operational evidence map — 60–90 minutes¶

Select a small web workload. Define customer indicators, resource metrics, logs, audit/config records, health checks, dashboards, alarms, owners, and retention. For four symptoms, identify the minimum signal set that distinguishes likely causes.

Lab 2: Alarm-to-verified-remediation loop — 90–150 minutes¶

Create a metric/alarm in a sandbox, route notification, and invoke a safe Systems Manager Automation or Lambda action against a tagged disposable target. Test missing data, repeated events, denied permission, concurrency, failure, audit, and post-action verification. Include a manual stop.

Lab 3: Scaling and health failure drill — 120–180 minutes¶

Deploy a minimal Auto Scaling group behind an Application Load Balancer from IaC or use a guided lab. Break the health path or security rule, inspect target/ASG/CloudWatch evidence, restore it, then test target tracking/max capacity and instance warmup. Clean up all resources.

Lab 4: Backup restore evidence — 90–180 minutes¶

Protect a small supported resource, record recovery point and key/access dependencies, restore to a separate name/location, validate data/application access, measure achieved RPO/RTO, and delete test resources. Document what cross-account/Region failure would change.

Lab 5: CloudFormation change, drift, and rollback — 120–180 minutes¶

Deploy a small stack, inspect a change set, apply a safe update, create controlled drift, detect it, and reconcile through the template. Trigger a disposable failure and use stack events to find the underlying cause. Record rollback and deletion-policy behavior.

Lab 6: Identity and continuous-control diagnosis — 90–150 minutes¶

Build two roles/policies in a sandbox or reason from supplied JSON. Predict outcomes with explicit deny, permissions boundary, resource policy, condition, and SCP. Verify with policy tools where safe. Add a Config-style control/finding workflow and document remediation/exception evidence.

Lab 7: VPC path troubleshooting — 120–180 minutes¶

Deploy or use a guided two-subnet lab. Break one layer at a time—route, SG, NACL, DNS, endpoint, or application listener. Predict the symptom and expected flow/path evidence before testing. Restore from IaC and compare Reachability Analyzer with a real application check.

Lab 8: Integrated game day — 150–240 minutes¶

Have a partner introduce one reversible fault in a disposable monitored workload. Follow detect, triage, scope, stabilize, remediate, verify, communicate, and learn steps. Produce a timeline, evidence links, root/contributing causes, control gap, automation improvement, and recovery proof.

Knowledge checks¶

Metric versus log? A metric is a numeric time series; a log is a detailed event/message record.
Does missing telemetry prove health? No; collection, permission, network, region, or configuration may be broken.
Why use a composite alarm? To combine alarm states and reduce noise or express dependency, not to fix poor signals.
EventBridge versus SNS? EventBridge matches/routes events; SNS provides publish/subscribe fan-out. Select by event and subscriber contract.
What completes automated remediation? Verification and escalation after a bounded, auditable action.
Why can low CPU coexist with poor service? The workload may wait on I/O, locks, network, queue delivery, throttling, or another dependency.
EBS queue length alone enough? No; relate it to latency, IOPS/throughput, burst state, instance limits, filesystem, and workload.
Does RDS Proxy fix slow queries? No; it manages connection patterns, while query/index/schema/resource problems need separate diagnosis.
Scalability versus elasticity? Scalability meets growth; elasticity adjusts resources with demand.
What prevents an ASG from scaling despite an alarm? Maximum capacity, policy/configuration, cooldown/warmup, permission, or quota may constrain it.
Multi-AZ versus read replica? Multi-AZ targets availability/failover; read replicas primarily scale reads, with engine/topology-specific recovery behavior.
RPO versus RTO? RPO limits acceptable data loss; RTO limits acceptable restoration time.
Why test restores? Backup success does not prove decryptable, complete, dependency-aware restoration within RTO.
Lowest-cost DR pattern? Typically backup and restore, with the longest recovery and strongest dependence on automation/testing.
What can invalidate backup isolation? Shared compromised identity, account, region, key, retention control, or deletion authority.
AMI versus container image? Both are immutable artifact patterns; AMIs launch instances, while container images package container layers/runtime content.
What is a CloudFormation change set? A preview of proposed stack changes; review replacements and impact before execution.
What does drift detection show? Supported resource properties that differ from the stack's expected configuration; it does not automatically reconcile them.
CDK deployment ultimately uses what? Synthesized CloudFormation templates/assets and CloudFormation behavior.
StackSets versus RAM? StackSets deploy stack instances; RAM shares supported existing resource types.
Why can blue/green still fail? Data/schema, dependencies, identity, traffic, or observability may be incompatible despite separate environments.
What makes event automation idempotent? Repeating the same event/action produces the intended state without harmful duplicate effects.
Why avoid two IaC owners? They can fight over configuration and make drift/recovery ambiguous.
What wins IAM evaluation? An applicable explicit deny.
Does an SCP grant access? No; it limits the maximum permissions available in affected accounts.
Trust policy versus role permission policy? Trust controls assumption; role permissions control actions after assumption.
CloudTrail versus Config? CloudTrail records API/account activity; Config records resource configuration/compliance over time.
GuardDuty versus Inspector? GuardDuty detects threat activity; Inspector assesses supported vulnerabilities/exposure.
Security Hub's role? Aggregate/normalize/prioritize security findings and standards, not replace source controls.
Why protect KMS access in DR? Encrypted backups are unusable if recovery principals cannot use the required key.
Secret in an AMI acceptable? No; use a governed secret store and runtime identity/access.
Security group versus NACL? Security groups are stateful resource controls; NACLs are stateless subnet controls.
NAT gateway used for inbound publishing? No; it supports outbound IPv4 translation from private resources, not unsolicited inbound access.
Is VPC peering transitive? No.
Endpoint policy alone grants service access? No; applicable identity/resource/key and other policies still matter.
Route 53 failover affected by what client behavior? DNS TTL and resolver/client caching can delay observed changes.
CloudFront versus Global Accelerator? CloudFront caches/serves content at edges; Global Accelerator routes TCP/UDP through AWS global networking to endpoints.
What does a Flow Log REJECT help locate? A network-interface path rejected by recorded controls; correlate with routes, NACLs, SGs, and application context.
Does Reachability Analyzer send test packets? No; it analyzes configuration reachability and does not prove application success.
First response to a connectivity issue? Define source, destination, protocol/port, DNS result, scope, timing, and recent change before broadening access.
Can a composite alarm directly scale EC2? No; use supported alarm actions or a separately governed automation path.
Does a successful model invocation prove useful output? No; API health and task/answer quality need separate evidence.
Does a file rename immediately rename every S3 object? No; bucket synchronization performs per-object work with temporary intermediate states.
Which copy wins an S3 Files conflict? The bucket copy; the file-side conflicting version is kept in lost-and-found for deliberate recovery.
Does an Agent Space authorize every remediation? No; connected scope, credentials, tool permissions and approval rules constrain allowed work.

Places to learn¶

This is not a complete list, and it is not meant to be consumed in full. Choose one primary explanation route, spend substantial time operating and breaking disposable workloads, then use practice results to select remediation. Confirm every course uses the current five-domain SOA-C03—not the retired six-domain SOA-C02—and gap-check newly named agent and service content.

Resource	Access	Estimated time
Official guide and exam-prep plan	Public/free-account/subscription mix	20–35 hours selected study
Hands-on operating practice	Sandbox or subscription	25–45 hours
Pluralsight SOA-C03 path	Paid	17 hours plus review
O'Reilly/Sybex current study guide	Paid	Plan 25–40 hours with labs
Udemy/Neal Davis current course	Paid	Plan 20–35 hours with labs
Tutorials Dojo practice route	Paid	10–18 hours with rationale review
Whizlabs course/lab/practice route	Paid	15–30 hours estimated

Official route: AWS certification page and four-step plan plus the SOA-C03 Skill Builder exam-prep category (about 20–35 hours selected, plus hands-on work). It includes the official question set, pretest, courses, Builder Labs, Cloud Quest/Jam/SimuLearn options, and official practice exam; entitlement and duration vary.
Current modular course/labs: Pluralsight SOA-C03 path (17 hours, five domain courses, four listed labs, and a practice exam as of review).
Current detailed reference: O'Reilly/Sybex AWS Certified CloudOps Engineer Study Guide (plan 25–40 hours with exercises). The public body was blocked on this review; page count, publication date and runtime estimate were not reverified. Inspect the June 2026 revision coverage before purchase.
Current long-form course: Udemy/Neal Davis SOA-C03 (plan 20–35 hours with exercises/practice). The public body was blocked; runtime, update date and lesson-level coverage were not reverified. Check the actual current outline.
Course and practice route: Tutorials Dojo SOA-C03 video course and practice exams (about 18–30 hours total estimated; the practice product lists randomized, six timed, six review, and five section-based sets). The video page lists 13.8+ hours, but public outlines do not establish every June addition. The practice page advertises actual-exam feedback; avoid recalled questions and use independently authored practice with documentation-based rationales.
Lab/sandbox alternative: Whizlabs SOA-C03 path (about 15–30 hours estimated across current video, practice, guided labs, and sandbox options). Live counts were not consistently exposed publicly; inspect before purchase.
Practice boundary: no exact current MeasureUp SOA-C03 product was verified in this review. Use official AWS practice first, and verify every third-party rationale against current AWS documentation.

Suggested preparation: spend roughly one-third of time on structured scope, one-half operating/troubleshooting disposable systems, and the remainder on timed diagnosis and rationale review. Someone already operating AWS may need 45–70 hours; a candidate new to production operations may need 80–130 hours including prerequisites.

Source map and freshness notes¶

The official root and five domain pages define scope. The certification page defines live delivery, while the in-scope service list and SOA-C02/SOA-C03 comparison define transition boundaries. AWS service documentation supports behavior; vendor learning pages support only their own current catalog claims.

VERIFY CURRENT: Kiro, AWS DevOps Agent, AWS Security Agent, Amazon S3 Files, service features, release states, regions, quotas, prices, console flows, and training metadata.
VERIFY CURRENT: certificate behavior, routing/health options, DR feature coverage, backup support, deployment integrations, and organization features before production use.
Stable reasoning pattern: symptom → evidence → causal layer → bounded remediation → verification → prevention.

This guide uses no recalled exam questions or restricted content. The knowledge checks are original and test published concepts rather than reproducing vendor items.