AWS Certified CloudOps Engineer – Associate (SOA-C03) is the new name for the AWS SysOps Administrator – Associate certification. The SOA-C03 exam replaced SOA-C02 on 30 September 2025. It tests day-to-day AWS operations: monitoring and remediation, scaling and backups, deployment automation, security and compliance, and networking. For freshers and system administrators in India, it is the most practical AWS associate exam for operations, support and junior DevOps roles.
This guide follows AWS's official exam guide: all five domains with weights, what changed from SOA-C02, the commands to practise, a 6-week plan and 15 original scenario questions.
Quick facts (AWS, November 2026)
| Item | Detail |
|---|---|
| Exam code | SOA-C03 |
| Time | 130 minutes |
| Questions | 65 (50 scored, 15 unscored), multiple choice and multiple response |
| Passing score | 720 on a 100–1,000 scale |
| Fee | USD 150 (plus applicable taxes and exchange charges) |
| Delivery | Pearson VUE test centre or online proctored |
| Languages | English, Japanese, Korean, Simplified Chinese (the Korean and Simplified Chinese versions retire after 19 November 2026) |
| Valid for | 3 years; recertify with the latest SOA exam or by earning DevOps Engineer – Professional |
| Recommended experience | About 1 year operating workloads on AWS, plus 1 year in an operations role such as system administrator |
Read the official CloudOps Engineer – Associate page and SOA-C03 exam guide before booking.
Already hold SysOps Administrator – Associate? AWS says you don't need to retake anything: your certification stays valid for 3 years from the date you earned it. The new CloudOps name applies to people who pass SOA-C03.
SOA-C02 vs SOA-C03: what changed?
| SOA-C02 domain | SOA-C03 domain |
|---|---|
| Monitoring, Logging, and Remediation (20%) | Monitoring, Logging, Analysis, Remediation, and Performance Optimization (22%) |
| Reliability and Business Continuity (16%) | Reliability and Business Continuity (22%) |
| Deployment, Provisioning, and Automation (18%) | Deployment, Provisioning, and Automation (22%) |
| Security and Compliance (16%) | Security and Compliance (16%) |
| Networking and Content Delivery (18%) | Networking and Content Delivery (18%) |
| Cost and Performance Optimization (12%) | Removed; performance moved into Domain 1 |
New content includes the CloudWatch agent for ECS and EKS clusters, CloudFormation and the AWS CDK, enforcing Region and service restrictions, and CloudWatch network monitoring. S3 static website hosting was removed, and VPNs moved into networking. The guide also mentions monitoring AI workloads, containers, Terraform and Git, so expect a more modern exam than the old SysOps.
Domains and weights
| Domain | Weight |
|---|---|
| 1. Monitoring, Logging, Analysis, Remediation, and Performance Optimization | 22% |
| 2. Reliability and Business Continuity | 22% |
| 3. Deployment, Provisioning, and Automation | 22% |
| 4. Security and Compliance | 16% |
| 5. Networking and Content Delivery | 18% |
Domain 1: Monitoring, remediation and performance (22%)
- Metrics, alarms and filters: CloudWatch, CloudTrail and Amazon Managed Service for Prometheus; the CloudWatch agent on EC2, ECS and EKS; composite alarms; cross-account and cross-Region dashboards; SNS notifications.
- Identify and remediate: automated remediation with CloudWatch, Lambda and Systems Manager; EventBridge rules and event buses; Systems Manager Automation runbooks.
- Performance: right-sizing compute; EBS volume types and metrics; S3 performance (multipart upload, Transfer Acceleration, DataSync, lifecycle); EFS and FSx choices; RDS Performance Insights and RDS Proxy; EC2 placement groups.
# Install and start the CloudWatch agent on Amazon Linux with a config in Parameter Store
sudo dnf install -y amazon-cloudwatch-agent
sudo /opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-ctl \
-a fetch-config -m ec2 -s -c ssm:AmazonCloudWatch-linuxDomain 2: Reliability and business continuity (22%)
- Scalability: Auto Scaling policies; caching with CloudFront and ElastiCache; scaling RDS (read replicas, storage autoscaling) and DynamoDB (on-demand or auto scaling).
- High availability: ELB and Route 53 health checks; Multi-AZ deployments.
- Backup and restore: AWS Backup plans for EC2, RDS, EBS, S3 and DynamoDB; point-in-time restore; S3 and FSx versioning; backup and restore, pilot light, warm standby and active/active DR.
Domain 3: Deployment, provisioning and automation (22%)
- Provision and maintain: AMIs and container images with EC2 Image Builder; CloudFormation and CDK stacks; fixing deployment errors (subnet size, template errors, permissions); sharing with AWS RAM and StackSets; deployment strategies; Terraform and Git.
- Automate existing resources: Systems Manager (Run Command, Patch Manager, Automation); event-driven automation with Lambda, S3 Event Notifications and EventBridge.
Terraform appears by name in the guide. Brush up with Terraform interview questions.
Domain 4: Security and compliance (16%)
- Tools and policies: IAM password policies, MFA, roles, federation, resource policies and conditions; CloudTrail, IAM Access Analyzer and the policy simulator for access problems; Organizations, SCPs and IAM Identity Center; Trusted Advisor security checks; Config conformance packs; Region and service restrictions.
- Data and infrastructure protection: data classification; KMS encryption at rest; ACM certificates in transit; Secrets Manager; findings from Security Hub, GuardDuty, Config and Inspector.
Domain 5: Networking and content delivery (18%)
- VPC: subnets, route tables, NACLs, security groups, NAT and internet gateways, egress-only gateways; VPC endpoints, PrivateLink and peering; auditing WAF, Shield, Network Firewall and Route 53 Resolver DNS Firewall; network cost.
- DNS and delivery: Route 53 Resolver; routing policies (simple, weighted, latency, failover, geolocation) and query logging; CloudFront and Global Accelerator.
- Troubleshooting: VPC configuration including transit gateways; VPC Flow Logs, ELB, WAF and CloudFront logs; CloudFront caching problems; hybrid and private connectivity; CloudWatch network monitoring.
Practise with AWS VPC networking interview questions.
6-week study plan
| Week | Focus | Lab |
|---|---|---|
| 1 | CloudWatch metrics, agent, alarms, dashboards, EventBridge | Agent on EC2 sending memory and disk metrics; composite alarm to SNS |
| 2 | Systems Manager: Session Manager, Run Command, Patch Manager, Automation | Runbook that restarts a service when an alarm fires |
| 3 | Auto Scaling, ELB, Route 53 health checks, RDS Multi-AZ and read replicas | Two-AZ web tier behind an ALB with target tracking |
| 4 | AWS Backup, point-in-time restore, S3 versioning and lifecycle, EBS and S3 performance | Restore an RDS database to a time 10 minutes ago |
| 5 | CloudFormation, CDK, StackSets, Image Builder; IAM, KMS, ACM, Secrets Manager, Config | Deploy a VPC and web tier from a template; fix a deliberately broken stack |
| 6 | VPC troubleshooting, endpoints, CloudFront, Flow Logs; official practice questions | Diagnose a private instance with no internet access; book the exam |
15 scenario questions with answers
These are original scenarios written for this guide, not exam questions.
1. CloudWatch shows CPU for an EC2 instance but no memory or disk usage. Why, and what fixes it?
Memory and disk are OS-level metrics. Install and configure the CloudWatch agent.
2. You want one alarm that fires only when both CPU is high and latency is high. What do you create?
A composite alarm combining the two metric alarms.
3. A private-subnet instance cannot download updates from the internet. What do you check?
That its route table sends 0.0.0.0/0 to a NAT gateway in a public subnet, that the NAT subnet routes to the internet gateway, and that security groups and NACLs allow the traffic.
4. Instances in a private subnet must reach S3 without the internet or a NAT gateway. What do you add?
An S3 gateway VPC endpoint and a route-table entry for it.
5. You need to log in to instances without opening port 22 or managing SSH keys. What do you use?
Systems Manager Session Manager.
6. An RDS database must recover to the state 15 minutes before a bad deployment. How?
Point-in-time restore to a new DB instance from automated backups.
7. Read traffic is overloading a MySQL RDS instance. What helps first?
Read replicas for read traffic (and caching with ElastiCache where it fits).
8. Too many short-lived Lambda connections exhaust RDS connections. What do you add?
RDS Proxy.
9. A gp2 volume is hitting its IOPS limit. What is a cost-effective change?
Move it to gp3 and provision the IOPS and throughput it needs.
10. Users in India and the US should reach the nearest healthy Region. Which Route 53 policy?
Latency-based routing with health checks (or geolocation routing if the rule is by country).
11. Updated images on a website still show old versions through CloudFront. What do you do?
Create an invalidation for the paths, or use versioned file names and review the cache TTLs.
12. A user says they cannot start an EC2 instance. How do you find which policy denies them?
Look up the denied call in CloudTrail and test the permissions with the IAM policy simulator (also check SCPs).
13. Accounts in an organisation must only use approved Regions. How do you enforce it?
A service control policy that denies requests outside the approved Regions.
14. The same VPC, subnets and security groups must be created in 12 accounts. What do you use?
CloudFormation StackSets (or share central subnets with AWS RAM where that fits).
15. Large uploads to S3 from overseas offices are slow. What helps?
Multipart upload and S3 Transfer Acceleration.
After SOA-C03
- Move up to the DevOps Engineer – Professional (DOP-C02), which also renews this certification.
- Or add the Solutions Architect Associate for design depth.
- Prepare with Linux interview questions and SRE interview questions for AWS engineers, and see live jobs for freshers.
Cloud Soft Solutions in Ameerpet, Hyderabad trains AWS, Linux and DevOps with hands-on labs and real-time projects. See all courses and the APEX program.
📞 Call +91 96660 19191 · WhatsApp · Flat No. 513, 5th Floor, Nilagiri Block, Aditya Enclave, Ameerpet, Hyderabad
Frequently Asked Questions
Is SOA-C03 the same as AWS SysOps Administrator?
It is the new version. The certification was renamed AWS Certified CloudOps Engineer Associate, and SOA-C03 replaced SOA-C02 on 30 September 2025.
Do SysOps Administrator holders need to retake the exam?
No. AWS says an existing SysOps certification stays valid for 3 years from the date it was earned.
How long is the SOA-C03 exam?
130 minutes, with 65 questions: 50 scored and 15 unscored.
What is the passing score for SOA-C03?
720 on a scaled score of 100 to 1,000.
How much does SOA-C03 cost?
USD 150, plus applicable taxes and exchange charges.
What was removed from the old SysOps exam?
The separate Cost and Performance Optimization domain (performance moved into Domain 1) and S3 static website hosting.
