SOA-C03
AWS Certified CloudOps EngineerAssociate
SOA-C03 Exam Guide: AWS Certified CloudOps Engineer – Associate
SOA-C03 validates that you can deploy, manage, and operate workloads on AWS, including monitoring, troubleshooting, security, networking, reliability, automation, and incident remediation. It is aimed at CloudOps engineers and candidates with practical AWS operations experience. This guide helps you decide whether your current experience is suitable, which domains deserve the most study time, how SOA-C03 differs from the older SOA-C02 exam, and what to do before scheduling.
What does SOA-C03 validate?
SOA-C03 tests operational judgment rather than isolated service recognition. AWS describes the exam as validating the ability to deploy, manage, and operate workloads on AWS, support workloads according to the AWS Well-Architected Framework, use the Management Console and AWS CLI, troubleshoot systems, apply networking concepts, implement security controls, and handle business continuity and incidents.
The exam is intended for CloudOps engineers. Its practical scope includes monitoring and logging, troubleshooting, high availability, performance and capacity requirements, disaster recovery, security and compliance controls, networking, and incident classification and remediation. AWS also identifies cloud financial management, hybrid and multi-VPC operations, compute, database, storage, and container solutions as relevant knowledge areas.
This means preparation should focus on selecting and operating an appropriate solution under stated requirements. A candidate who can name many AWS services but cannot explain how a metric leads to an action, how a failure is contained, or how access and network controls interact will have a weaker foundation than a candidate with narrower but hands-on operational experience.
Who is the intended candidate?
AWS recommends approximately 1 year of experience with AWS deployment, management, troubleshooting, networking, and security, plus at least 1 year in a related operations role such as system administration. Treat this as the benchmark for readiness, not as a claim that memorizing the outline substitutes for operational practice.
The recommended general IT background includes monitoring, logging, and troubleshooting techniques; DNS, TCP, IP, and firewall concepts; high availability, performance, and capacity requirements; one scripting language; one major operating system; cloud computing; containerization and orchestration basics; and CI/CD and Git.
AWS also recommends familiarity with the Well-Architected Framework, AWS storage and container solutions, monitoring tools, the Console, the CLI, infrastructure as code, CloudFormation, AWS networking and security services, security controls, compliance requirements, cloud financial management, hybrid and multi-VPC operations, databases, and compute services.
Use this list as a readiness filter. If you have never investigated an application failure, changed an AWS resource safely, interpreted a network path, or managed permissions, begin with foundational AWS and operations work before relying on exam-specific practice. If these activities are familiar, use the blueprint to close service and scenario gaps.
What changed from SOA-C02?
SOA-C03 is the AWS Certified CloudOps Engineer - Associate exam, formerly known as AWS Certified SysOps Administrator - Associate. AWS states that the new name applies to candidates who pass SOA-C03 and is not retroactive for holders of the earlier certification. SOA-C03 began being used on September 30, 2025, while SOA-C02 was listed as being used through September 29, 2025.
The most important study decision for a previous SOA-C02 candidate is to work from the SOA-C03 outline rather than simply reuse older notes. AWS added CloudFormation and AWS CDK stack management in Task 3.1, compliance requirements such as Region and service selections in Task 4.1, and CloudWatch network monitoring services in Task 5.3.
AWS also added or expanded skills involving event-driven automation, private networking connectivity, multi-account strategies, continuous compliance monitoring, security findings, disaster recovery best practices, and shared storage selection. VPNs were moved to Task 5.1, and content from the former Tasks 6.1 and 6.2 was moved to Task 1.3.
AWS removed configuring S3 static website hosting from Task 5.2. Do not interpret that deletion as a reason to ignore S3; S3 remains an in-scope service. It means your study notes should distinguish the service from the specific task statement being tested.
AWS says exam guides are periodically reviewed and that revisions are published at least 1 month before changes are reflected on the exam. Check the revisions page when planning a future test date, especially if your preparation spans a significant period.
A useful transition check for SOA-C02 holders
Read every SOA-C03 task statement and mark it as retained, expanded, moved, or new. Then create short operational exercises for the changed areas: deploy a small CloudFormation stack, inspect a private connectivity design, trace a network symptom with monitoring data, apply a compliance restriction, and compare disaster recovery approaches.
Do not spend equal time on every old practice question. First remove questions that depend on the former task structure or deleted S3 static website hosting content. Next verify that each remaining question tests an SOA-C03 domain and current service behavior. This is a practical recommendation, not an AWS exam requirement.
How is the exam organized?
SOA-C03 is an associate-level exam with 65 questions, 130 minutes, and multiple-choice or multiple-response formats. AWS states that 50 questions affect your score and that the exam includes 15 unscored questions. Each scored multiple-choice or multiple-response question counts as one scored opportunity.
The listed exam languages are English, Japanese, Korean, and Simplified Chinese. AWS lists the exam price as 150 USD and directs candidates to its exam-pricing information for foreign-exchange and other cost details. Confirm scheduling and pricing information with AWS before booking because operational details can change.
The exam is available through Pearson VUE testing centers or online proctoring. Choose the delivery option you can support reliably. A testing center may suit candidates who prefer a controlled physical setting; online proctoring requires you to satisfy the provider’s current technical and environmental requirements. Verify those requirements before selecting the appointment.
Results are reported as a scaled score of 100–1,000, and the minimum passing score is 720. Do not turn the passing score into a target percentage: AWS uses a scaled score, and the existence of unscored questions means that a raw-question calculation is not a reliable way to estimate readiness.
AWS cautions candidates when interpreting section-level feedback. Use a result report to identify study areas, but do not assume that a domain percentage directly reveals the number of questions you answered correctly or predicts performance on a future form.
Which domains should receive study time?
The five SOA-C03 domains are weighted 22%, 22%, 22%, 16%, and 18%, respectively, in AWS’s listed order. The first three domains therefore deserve early and sustained attention, while Security and Compliance and Networking and Content Delivery still require deliberate coverage because both contain scenario-heavy operational decisions.
Content Domain 1: Monitoring, Logging, Analysis, Remediation, and Performance Optimization accounts for 22% of scored content. Content Domain 2: Reliability and Business Continuity accounts for 22% of scored content. Content Domain 3: Deployment, Provisioning, and Automation accounts for 22% of scored content. Content Domain 4: Security and Compliance accounts for 16% of scored content. Content Domain 5: Networking and Content Delivery accounts for 18% of scored content.
Use the weights to allocate attention, not to abandon the smaller domains. A sensible sequence is to build monitoring and troubleshooting fundamentals first, connect them to reliability and recovery, then add deployment automation. Study security and networking in parallel because permissions, routes, endpoints, load balancers, and compliance constraints frequently shape the correct operational choice.
The official outline provides task statements and additional context for each task. Read those statements as capability descriptions: words such as configure, analyze, remediate, enforce, evaluate, select, and implement indicate the kind of decision you should be able to make. Avoid treating a service list as a complete study plan.
How should you study Domain 1?
Domain 1: Monitoring, Logging, Analysis, Remediation, and Performance Optimization is best prepared through diagnosis loops. Practice moving from a symptom to a relevant metric or log, from evidence to a likely cause, and from the cause to a safe remediation or automation action. AWS names CloudWatch, CloudTrail, and Amazon Managed Service for Prometheus among monitoring and logging services in scope.
Build a troubleshooting worksheet for compute, containers, databases, and serverless workloads. For each scenario, record the workload, expected behavior, signal, threshold or symptom, likely fault domain, confirmation step, remediation, and prevention measure. Include permissions and audit evidence rather than treating monitoring as a dashboard-only activity.
The SOA-C03 revisions specifically include using monitoring services for workloads such as serverless, compute, and AI; analyzing performance metrics and automating remediation with services such as CloudWatch, Lambda, Systems Manager, CloudTrail, and auto scaling; and evaluating shared storage such as EFS and FSx for use-case requirements.
A common mistake is choosing an automated response before establishing what the alert means. Another is confusing data collection with analysis: installing an agent or enabling a log destination does not by itself explain an outage. During practice, ask what evidence distinguishes a capacity problem from an application error, an access problem, or a network path problem.
How should you prepare for reliability and recovery scenarios?
Domain 2: Reliability and Business Continuity requires you to connect availability requirements with operating procedures. Study backup and restore, pilot light, warm standby, and active/active approaches as operational patterns, then ask what must be configured, monitored, tested, and restored for each pattern.
Practice with failure scenarios involving EC2, ECS, EKS, Lambda, RDS, DynamoDB, EBS, EFS, S3, and AWS Backup. For every scenario, identify the protected data, recovery objective implied by the question, dependency that could also fail, and the order in which services must be recovered. Keep the exercise focused on operations rather than designing a distributed architecture from scratch.
AWS specifically identifies following disaster recovery procedures and best practices as a SOA-C03 skill. It also expects candidates to implement architectural requirements such as high availability, performance, and capacity. Your notes should therefore connect configuration choices to consequences: replication, health checks, failover, backups, restoration validation, and operational ownership.
The most frequent preparation error is treating a backup as proof of recoverability. A stronger study exercise includes a restore path and a validation step. Also distinguish a mechanism that detects failure from one that prevents failure, and distinguish a highly available design from a complete business continuity plan.
How should you study deployment and automation?
Domain 3: Deployment, Provisioning, and Automation rewards repeatable operations. Be able to explain how infrastructure as code, CloudFormation, the AWS CDK, Systems Manager, Lambda, EventBridge, S3 Event Notifications, and related services support controlled provisioning, configuration, and event-driven remediation.
Create a small CloudFormation stack and manage its lifecycle: parameters, dependencies, outputs, updates, failure handling, drift awareness, and safe cleanup. If you use the AWS CDK, understand the relationship between code, synthesized infrastructure, deployment, and the resulting AWS resources. The aim is operational understanding, not mastery of application development.
The SOA-C03 outline adds creating and managing resource stacks with CloudFormation and the AWS CDK. It also includes implementing event-driven automation with services and features such as Lambda, S3 Event Notifications, EventBridge, and AWS DevOps Agent. Review how an event is emitted, filtered, delivered, authorized, and handled.
AWS lists CI/CD and Git as recommended knowledge, but the target candidate is not expected to design CI/CD pipelines. Keep your preparation aligned with that boundary. Focus on operating deployments, identifying failed changes, reviewing permissions and logs, and selecting a controlled automation response rather than building an elaborate delivery platform.
A common pitfall is memorizing which service can trigger another without checking the operational conditions. For each automation pattern, ask whether the event is reliable for the use case, whether the target has permission, whether retries or duplicate events matter, and how an operator observes failure.
What security and compliance decisions matter?
Domain 4: Security and Compliance is smaller by weighting but broad in operational scope. Prepare to apply IAM and resource controls, enforce compliance requirements, operate securely across accounts, and configure or remediate findings from services such as Security Hub, GuardDuty, Config, and Inspector.
The SOA-C03 skills include implementing multi-account strategies securely with AWS Organizations, service control policies, and IAM Identity Center; enforcing requirements such as Region and service selections; and configuring reports and remediating findings from AWS security services. Recent revisions also mention AWS Config conformance packs and AWS Security Agent in these areas.
Use least-privilege scenarios to test your reasoning. Identify the principal, resource, action, condition, account boundary, and network path before selecting a control. Then decide where continuous monitoring belongs and how a finding should be triaged. This prevents a common error: choosing a broad permission change when the requirement calls for a narrowly scoped control.
Do not treat compliance as a separate checklist from operations. Region restrictions can affect service selection, an SCP can limit an otherwise valid IAM permission, and a VPC endpoint or security group can affect whether a management action succeeds. Your study notes should show how these controls interact.
The official in-scope list is non-exhaustive and subject to change. Use it to identify services for review, but return to the current exam guide and revisions page before scheduling. Do not infer that every feature of an in-scope service has equal exam emphasis.
How should you approach networking and content delivery?
Domain 5: Networking and Content Delivery should be studied through traffic paths and failure isolation. Be prepared to reason about DNS, TCP/IP, firewalls, VPCs, subnets, route tables, security groups, network ACLs, gateways, load balancing, private connectivity, and monitoring evidence.
Draw a request path for each practice scenario: client, DNS, edge or content-delivery component, load balancer, subnet, target, and data service. Mark where routing, name resolution, security groups, network ACLs, endpoints, NAT, or firewall rules can block traffic. Then identify the AWS tool or log that would confirm the suspected fault.
SOA-C03 specifically includes configuring private networking connectivity, with examples including VPC endpoints, AWS PrivateLink, and VPC peering. It also adds configuring and analyzing CloudWatch network monitoring services. The in-scope services list includes Transit Gateway, Site-to-Site VPN, Client VPN, VPC Flow Logs, Reachability Analyzer, Route 53, CloudFront, Global Accelerator, and related networking services.
AWS recommends operations within hybrid and multi-VPC environments, while designing hybrid and multi-VPC networking is listed as out of scope for the target candidate. Study how to operate, inspect, and troubleshoot an existing design rather than spending most of your time inventing a new enterprise topology.
Avoid selecting a network service merely because it sounds more private or more highly available. Start with the required source, destination, protocol, name-resolution behavior, route, and access boundary. Then choose the smallest change that satisfies the requirement and can be monitored.
Which AWS services should be on your review list?
The official in-scope list includes services across compute, containers, databases, monitoring, automation, networking, security, storage, and cloud financial management. Review services in the context of the five domains and their operational relationships, rather than attempting to memorize an unconnected catalogue.
Important examples include EC2, ECS, EKS, Lambda, RDS, Aurora, DynamoDB, ElastiCache, CloudWatch, CloudTrail, CloudFormation, AWS CDK, Systems Manager, AWS Config, Auto Scaling, IAM, Organizations, IAM Identity Center, VPC, Elastic Load Balancing, S3, EBS, EFS, FSx, AWS Backup, Route 53, CloudFront, PrivateLink, and VPC endpoints.
The list also includes services such as EventBridge, SNS, SQS, Step Functions, X-Ray, Managed Grafana, Managed Service for Prometheus, GuardDuty, Inspector, Security Hub, KMS, Secrets Manager, WAF, Shield, Network Firewall, Cost Explorer, and Savings Plans. These examples are useful anchors for labs and comparison notes, not a promise that every listed feature will appear.
Organize your notes by operational question: How is the workload observed? How is access controlled? How does traffic reach it? How is it deployed? What happens when it fails? How is it restored? How is the result audited or optimized? This structure is more useful than one-page service definitions.
What is a practical study roadmap?
A practical roadmap has four passes: establish the blueprint, build service understanding, perform integrated troubleshooting, and validate readiness. The calendar length can vary with your experience; do not force a fixed schedule. Move forward when you can explain decisions and perform the relevant tasks, not simply when you have finished watching or reading material.
Pass 1: Read the official SOA-C03 exam guide, domain outline, in-scope services, comparison page, and revisions. Mark each task as strong, familiar, or weak. Record whether your weakness is a service gap, a networking or operating-systems gap, an automation gap, or a scenario-reasoning gap.
Pass 2: Build a small AWS lab or use an approved practice environment. Create and observe a workload, inspect logs and metrics, change access and network controls deliberately, deploy infrastructure as code, trigger an event-driven action, and test a backup or recovery procedure. Remove resources safely and document what each exercise demonstrated.
Pass 3: Study by incident. Mix domains instead of completing isolated service chapters forever. For example, investigate a failed deployment that produces an alert, requires a permission check, depends on a private endpoint, and needs a rollback or recovery action. Explain why each alternative is less suitable.
Pass 4: Use reputable practice questions only as a diagnostic tool. For every missed answer, write the requirement, decisive evidence, selected service or control, and reason the distractors fail. Do not use exam dumps or leaked questions; memorization does not establish the operational judgment SOA-C03 is designed to assess.
Schedule only after you can consistently explain your choices across all five domains, can work with both console-oriented and CLI-oriented operations, and have reviewed current AWS revisions. These are preparation recommendations, not AWS eligibility rules.
A repeatable weekly study session
Start with one task statement and its supporting AWS services. Perform or review one concrete configuration. Introduce a fault or requirement change. Observe the resulting evidence. Finish by writing a short runbook containing detection, diagnosis, action, validation, and rollback.
At the end of the session, label each note as official requirement, observed lab behavior, or personal study recommendation. This separation prevents a lab shortcut from becoming an assumed exam rule and makes later revision faster.
How should you handle questions during the exam?
Read the requirement before focusing on the service names. Identify the desired outcome, constraints, failure condition, and operational priority. Then eliminate answers that solve a different problem, add unnecessary complexity, weaken security, or require a capability the scenario does not provide.
For multiple-response questions, evaluate every option independently against the stated requirement. Do not select an option because it is generally useful. For multiple-choice questions, compare the remaining answers by operational fit: least privilege, reliability, observability, recovery behavior, maintenance burden, and alignment with the AWS service purpose.
If a question is unclear, note the decisive words and move on rather than spending disproportionate time. Return later with the scenario constraints fresh. Because AWS states that 50 questions affect your score and 15 are unscored, you cannot identify unscored content reliably; give every question a serious attempt.
Do not calculate a raw passing percentage from the 720 minimum passing score. AWS reports a scaled score of 100–1,000. Use the available time to demonstrate consistent reasoning, review flagged questions, and check that multiple-response selections satisfy the entire requirement rather than only one part.
What mistakes should you avoid before scheduling?
The most damaging mistake is scheduling from familiarity with AWS names rather than evidence of operational competence. A candidate may recognize CloudWatch, IAM, VPC, or CloudFormation yet still struggle to choose a diagnostic sequence or safe remediation. Test yourself with unfamiliar combinations of services and changing requirements.
Do not study only the largest-looking service categories. Content Domain 4: Security and Compliance accounts for 16% of scored content, and Content Domain 5: Networking and Content Delivery accounts for 18% of scored content; both can determine whether an operational solution is viable. Keep both in the roadmap while prioritizing the three 22% domains.
Do not rely on SOA-C02 material without checking the SOA-C03 comparison and revisions. In particular, review CloudFormation and CDK, private connectivity, compliance enforcement, network monitoring, event-driven automation, disaster recovery patterns, and the revised shared-storage examples.
Do not confuse out-of-scope job tasks with permission to ignore their surrounding concepts. AWS says the target candidate is not expected to design distributed architectures, design CI/CD pipelines, design hybrid and multi-VPC networking, develop software, define security or governance requirements, develop ransomware defense strategies, or assess and plan resource capacity. You still need enough knowledge to operate within architectures, pipelines, networks, controls, and capacity decisions described in the exam scope.
Finally, do not treat an official service list as a guarantee of question coverage, and do not treat practice-question scores as an AWS result. Use both as signals for further investigation, then verify the underlying task statement and service behavior in official documentation.
What should you do next?
Begin with the current AWS exam guide, map your experience against every domain, and choose a delivery option only after checking the current AWS and Pearson VUE information. Your immediate objective is not to collect more service names; it is to identify the few operational tasks you cannot yet explain, perform, troubleshoot, or validate.
If you are new to AWS operations, strengthen console and CLI fundamentals, networking, IAM, monitoring, and operating-system troubleshooting before intensive question practice. If you already operate AWS workloads, prioritize the SOA-C03 changes and build integrated incident exercises that combine observability, automation, security, networking, and recovery.
Before booking, check the revisions page for updates, confirm the listed language and delivery information for your appointment, review the current in-scope services, and create a final gap list. After each study session, close one gap with a lab, a runbook, or an evidence-based service comparison.
Conclusion
SOA-C03 is best approached as an operations decision exam: detect the condition, interpret the evidence, select a secure and proportionate action, and verify the result. Use the official domain weights to prioritize without neglecting smaller domains, update older SOA-C02 material against the SOA-C03 change history, and schedule when your practical reasoning is consistent across monitoring, reliability, automation, security, and networking.