AWS Certified CloudOps Engineer Associate (SOA-C03): Complete Exam Guide

SOA-C03 is an operations exam with a twist: roughly half the questions are multi-step scenarios where you have to read several AWS artefacts — a CloudWatch alarm, an IAM policy, a deployment configuration — and pick the correct operational response. It rewards the candidate who has actually operated AWS, not the one who has memorised the service list.

The SOA-C03 blueprint at a glance

Cost and Performance Optimisation is only 12% of the blueprint, and it is the domain most candidates over-study. It is also the domain where Certilum's scenario bank focuses, because it is where operational mistakes actually cost money.

What each domain really asks

Monitoring, Logging, and Remediation

The questions here give you an alarm, a metric or a log filter and ask what happens next. The recurring decisions are: which metric type answers the question (a custom metric versus a standard one, a percentile versus an average), whether an action should be a notification or an automated action, and whether a remediation should be handled by an EventBridge rule, an SSM Automation document, or a Lambda function. The trap is choosing a service that technically works but does not match the scenario's stated requirement.

Reliability and Business Continuity

Scenarios describe a workload that failed during a component outage and ask what should have been configured. Auto Scaling versus fixed capacity, Multi-AZ versus a single-AZ deployment, and RTO and RPO decisions all appear. The question that catches people: which service provides a regional failover with health-based routing, and the answer is Route 53 with health checks, not Elastic Load Balancing.

Deployment, Provisioning, and Automation

This is the domain where the certification renamed itself. CloudFormation is central: template structure, change sets, drift detection with CloudFormation Drift Detection, and the difference between UpdatePolicy and CreationPolicy. Expect questions on Elastic Beanstalk deployment strategies and on CI/CD services: CodePipeline orchestrates, CodeBuild compiles, CodeDeploy deploys. Systems Manager State Manager covers configuration compliance at scale.

Security and Compliance

IAM questions test least-privilege reasoning: an instance profile attached to an instance, a role versus a policy, and the boundary conditions of each. Encryption questions distinguish KMS (customer-managed keys) from ACM (certificate management) and S3 default encryption. Security Hub, GuardDuty and Config each appear as the answer to a detection, a finding and a compliance question respectively.

Networking and Content Delivery

VPC fundamentals, plus the decisions that matter operationally: route tables versus route propagation, network ACLs versus security groups in the order they are evaluated, and NAT gateways versus internet gateways for egress. Hybrid scenarios introduce Direct Connect and Site-to-Site VPN. CloudFront and WAF appear in the content-delivery half.

Cost and Performance Optimization

Cost Explorer and Budgets for visibility, Reserved Instances versus Savings Plans for committed spend, Spot for interruptible work, and Compute Optimizer and Trusted Advisor for rightsizing. The exam differentiates well between the discount model you should choose and the workload it fits, so know which purchase applies to which commitment shape.

How should you actually prepare?

Build the labs rather than reading the objectives. A CloudWatch alarm wired to an SSM Automation document, a CloudFormation stack with drift detection enabled, an Auto Scaling group behind an Application Load Balancer with Multi-AZ — those three exercises cover more of the blueprint than any amount of reading. Then use timed practice to fix your pacing: 65 questions in 130 minutes is two minutes each, which is comfortable right up until a multi-step scenario appears.

Run the full diagnostic on Certilum for the AWS Certified CloudOps Engineer – Associate, and work through the SOA-C03 question bank with explanations to see which domain you are actually losing points in.