AWS Certified CloudOps Engineer - Associate Complete Study Guide 2026

The AWS Certified CloudOps Engineer - Associate (SOA-C03) validates whether you can deploy, manage, operate, monitor, secure, and troubleshoot workloads on AWS. This is an operations exam. AWS wants proof that you can keep workloads healthy after deployment, not just design them on a whiteboard.

That distinction matters. If Solutions Architect Associate focuses on choosing the right architecture, CloudOps focuses on operating that architecture under real conditions: alarms, logs, remediations, scaling behavior, backups, IAM guardrails, CloudFormation, Systems Manager automation, VPC troubleshooting, and resilient networking.

A small but important detail: although the certification is now called CloudOps Engineer - Associate, AWS still hosts the official SOA-C03 exam guide under the legacy sysops-administrator-associate-03 documentation path. Use the current certification name, but trust the legacy URL for the official exam objectives.

Exam At a Glance

• Official certification page: AWS Certified CloudOps Engineer - Associate
• Official exam guide: AWS Certified CloudOps Engineer - Associate exam guide
• Official exam prep plan: AWS Skill Builder exam prep resources
• Official in-scope services reference: SOA-C03 in-scope AWS services

Official Exam Domains

1. Monitoring, Logging, Analysis, Remediation, and Performance Optimization (22%)
2. Reliability and Business Continuity (22%)
3. Deployment, Provisioning, and Automation (22%)
4. Security and Compliance (16%)
5. Networking and Content Delivery (18%)

The weights show why SOA-C03 feels broad. The first three domains carry two-thirds of the exam, which means you need practical confidence with operational tooling, failure handling, and provisioning automation before you worry about edge-case memorization.

1. Monitoring, Logging, Analysis, Remediation, and Performance Optimization

This domain is the operational center of the exam. AWS expects you to know how to collect signals, interpret them, trigger remediations, and improve performance across compute, storage, and databases.

• Metrics, alarms, dashboards, and log pipelines - Study CloudWatch metrics, alarms, dashboards, log groups, metric filters, and cross-account observability patterns. Official docs: SOA-C03 Domain 1 objectives, What is Amazon CloudWatch?.
• Agent-based observability and fleet visibility - AWS explicitly calls out the CloudWatch agent and monitoring on EC2, ECS, and EKS. Official docs: Task 1.1: Implement metrics, alarms, and filters, CloudWatch agent and infrastructure monitoring.
• Automated remediation and operational runbooks - Expect questions where CloudWatch or EventBridge identifies an issue and Systems Manager Automation or Lambda performs the response. Official docs: Task 1.2: Identify and remediate issues, What is AWS Systems Manager?.
• Performance tuning across storage and databases - Domain 1 includes EBS throughput choices, S3 transfer optimization, shared storage, RDS metrics, and EC2 performance analysis. Official docs: Task 1.3: Implement performance optimization strategies, Amazon EC2 concepts, Amazon RDS User Guide.
• Operational thinking over raw memorization - The correct answer in this domain is usually the one that shortens detection time and reduces manual diagnosis, not the one with the most services in it. Official docs: CloudWatch overview, Systems Manager overview.

Exam tip: When you see alarms, incident response, or degraded performance, think in this order: signal -> diagnosis -> automated remediation -> long-term optimization.

2. Reliability and Business Continuity

This domain tests whether you can keep workloads available under scale, failure, and recovery requirements.

• Elasticity and scaling behavior - AWS wants you to understand scaling for compute, caching, and databases, including how scaling decisions interact with application resilience. Official docs: SOA-C03 Domain 2 objectives, What is Amazon EC2 Auto Scaling?.
• High availability design in live operations - Study Multi-AZ behavior, ELB health checks, Route 53 health checks, and how to detect and recover from unhealthy capacity. Official docs: Task 2.2: Implement highly available and resilient environments, Elastic Load Balancing User Guide.
• Backup and restore strategy - Domain 2 explicitly covers snapshots, PITR, versioning, AWS Backup, and disaster recovery procedures linked to RTO and RPO goals. Official docs: Task 2.3: Implement backup and restore strategies, What is AWS Backup?.
• Cross-account and cross-Region continuity - AWS Backup is especially worth understanding because it centralizes policy-based, cross-account, and cross-Region protection in a way the exam likes to test. Official docs: AWS Backup feature overview.
• Know the recovery objective behind the service choice - On SOA-C03, answers are often differentiated by whether they meet a stated RTO, RPO, or availability target with the least operational fragility.

Exam tip: If the prompt emphasizes resilience, availability, or restore requirements, do not default to monitoring tooling. Ask which scaling, health-check, or backup mechanism actually satisfies the objective.

3. Deployment, Provisioning, and Automation

This domain covers how AWS infrastructure is created, updated, standardized, and automated across environments.

• Provisioning through infrastructure as code - Study CloudFormation, CDK, StackSets, and the operational failure modes that happen when stacks, subnets, or permissions are wrong. Official docs: SOA-C03 Domain 3 objectives, What is AWS CloudFormation?.
• AMI, image, and deployment workflows - AWS expects you to understand how images are prepared and how deployments are maintained over time, including rolling changes and repeatability. Official docs: Task 3.1: Provision and maintain cloud resources, EC2 Auto Scaling features.
• Systems Manager automation - Domain 3 explicitly mentions using AWS services to automate operational processes, and Systems Manager is central to that. Official docs: Task 3.2: Automate the management of existing resources, AWS Systems Manager tools.
• Event-driven operations - You should be able to recognize when Lambda, EventBridge, S3 event notifications, or runbooks are better than manual admin work. Official docs: Domain 3 task statements, Amazon EventBridge, AWS Lambda.
• Provisioning discipline - The exam rewards maintainable automation that can be repeated across accounts and Regions, not just one successful deployment in one environment.

Exam tip: If the question asks how to enforce consistency, reduce manual steps, or repeat an operational action across many resources, suspect Domain 3 first.

4. Security and Compliance

This domain focuses on guardrails, access, encryption, findings, and operational security controls across live workloads.

• IAM, federation, and access troubleshooting - Study roles, policies, MFA, resource policies, policy conditions, and access auditing tools. Official docs: SOA-C03 Domain 4 objectives, What is IAM?.
• Encryption and secrets handling - Domain 4 explicitly covers encryption at rest, encryption in transit, certificate handling, and secure storage of secrets. Official docs: Task 4.2: Implement strategies to protect data and infrastructure, AWS Key Management Service, AWS Certificate Manager.
• Findings, compliance, and remediation - Expect questions that combine detection tools and operational response rather than asking about one standalone service. Official docs: Domain 4 task statements, AWS Security Hub, AWS Config.
• Multi-account operational security - This exam expects you to operate securely across accounts, not just inside one account. Look for patterns involving auditing, trusted boundaries, and central visibility.
• Operational security over policy trivia - The best answer is usually the one that both enforces the control and improves ongoing visibility or remediation.

Exam tip: On SOA-C03, security questions often have an operations flavor. AWS is not only asking which control exists, but which one can be monitored, enforced, and troubleshot in production.

5. Networking and Content Delivery

This domain covers the operational side of VPC networking, DNS, routing, private connectivity, and edge delivery.

• VPC configuration and connectivity - Study subnets, route tables, security groups, network ACLs, NAT gateways, internet gateways, egress-only internet gateways, and private connectivity models. Official docs: SOA-C03 Domain 5 objectives, What is Amazon VPC?.
• DNS and routing behavior - Domain 5 explicitly calls out Route 53 routing policies, Route 53 Resolver, query logging, and domain configuration. Official docs: Task 5.2: Configure domains, DNS services, and content delivery.
• CloudFront and content distribution - Understand distributions, origins, caching behavior, custom domains, and why CloudFront improves performance and resiliency at the edge. Official docs: Domain 5 task statements, What is Amazon CloudFront?.
• Troubleshooting network paths - You should be comfortable reading VPC Flow Logs, ELB access logs, WAF logs, CloudFront logs, and network monitoring signals to isolate failures. Official docs: Task 5.3: Troubleshoot network connectivity issues, CloudWatch network monitoring capabilities.
• Network cost and private access tradeoffs - AWS may test whether a proposed connectivity pattern is not only correct, but also cheaper, safer, or easier to operate.

Exam tip: For networking questions, map the packet path mentally. Most wrong answers fail because they miss a route table, gateway, resolver, security control, or logging layer.

Recommended 5-Week Study Plan

Last-Mile Exam Strategy

• Frame most questions as live-service operations scenarios. Ask what keeps the workload healthy, observable, recoverable, and compliant.
• Memorize the common operational pairings that AWS tests together: CloudWatch + Systems Manager, Auto Scaling + Load Balancing, AWS Backup + restore objectives, and VPC logs + connectivity debugging.
• Study the domain task pages directly because SOA-C03 is objective-driven and the wording of the exam often tracks the task language closely.
• Prefer automated, repeatable, low-manual-effort answers over ad hoc administration whenever the scenario allows it.
• Do not over-index on architecture theory. This exam rewards service operation, incident handling, and environment maintenance more than design elegance.

If you want scenario-based reinforcement after the official docs, use our AWS CloudOps Engineer Associate practice questions. If you want the architecture-side companion, pair this with our AWS Solutions Architect Associate study guide.

The fastest path to passing SOA-C03 is to study AWS as an operator: watch the system, automate the response, preserve resilience, lock down access, and troubleshoot network and workload behavior without guessing. That is exactly what the official blueprint measures.