AWS SOA-C03 CloudOps Engineer – Associate Practice Exam
Prepare for the AWS Certified CloudOps Engineer – Associate exam (SOA-C03) — the renamed, refreshed successor to SysOps Administrator – Associate — with scenario-based, source-cited practice questions across all five domains: monitoring, reliability, deployment and automation, security, and networking. Built for the day-to-day work of operating AWS at production scale. Includes Learn mode and full timed Exam mode.
Start 24-hour free trial →SOA-C03 exam at a glance
- Vendor
- Amazon Web Services (AWS)
- Exam code
- SOA-C03
- Certification
- AWS Certified CloudOps Engineer – Associate (formerly SysOps Administrator – Associate)
- Level
- Associate
- Format
- 65 questions (50 scored + 15 unscored); multiple choice and multiple response — no scored labs
- Duration
- 130 minutes
- Scoring
- Scaled 100–1000; passing score 720 (pass/fail, compensatory)
- Cost (USD)
- $150 (50% discount voucher available after any prior AWS certification)
- Delivery
- Pearson VUE test center or online proctored
- Prerequisites
- None required. AWS recommends ~1 year of AWS operations experience; Cloud Practitioner is a useful starting point for those new to IT
- Validity
- 3 years; recertify by passing the current version or a higher-tier exam
- Availability
- Live since September 30, 2025 (replaced SOA-C02 SysOps Administrator)
Sources: AWS — CloudOps Engineer – Associate certification · AWS Certification exam guides. Confirm the current exam guide revision and pricing with AWS before scheduling.
About the SOA-C03 certification
AWS Certified CloudOps Engineer – Associate (SOA-C03) validates the ability to deploy, manage, monitor, and operate workloads on AWS at production scale. In 2025 AWS renamed the former SysOps Administrator – Associate to CloudOps Engineer – Associate and refreshed the content to reflect modern operations — multi-account governance, infrastructure as code, observability, and containers (Amazon ECS, Amazon EKS, Amazon ECR, and AWS Fargate are now explicitly in scope). It is anchored in the AWS Well-Architected Framework and assumes you are comfortable with the AWS Management Console, the AWS CLI, and CloudFormation.
The questions are operational and scenario-driven: you diagnose a failing pipeline, an intermittent HTTP 504, a Multi-AZ failover, or a fleet-patching requirement and choose the right AWS tool or remediation. Route 53 routing-policy questions (simple, weighted, latency, geolocation, geoproximity, failover, multivalue) are nearly guaranteed, and connectivity-troubleshooting questions reward a layered checklist — security group, network ACL, route table, then internet or NAT gateway. There are no scored hands-on labs in SOA-C03; those skills are folded into scenario questions, so time in a real AWS account is essential. For the concepts behind these scenarios, see the AWS operations study guides in the Learning Hub.
SOA-C03 exam domains and weights
AWS publishes five scored content domains with the official weightings below (they sum to 100%). The top three domains — monitoring, reliability, and deployment/automation — are equally weighted at 22% each and together make up two-thirds of the exam. The exam uses compensatory scoring, so you only need to pass overall, not each domain.
Amazon CloudWatch metrics, alarms, and metric math; log analysis with CloudWatch Logs; tracing with AWS X-Ray; auditing with AWS CloudTrail; and performance optimization for compute, storage, and databases (including AWS Compute Optimizer).
Scaling with EC2 Auto Scaling and Elastic Load Balancing, fault-tolerant and Multi-AZ designs, Amazon RDS Multi-AZ, and centralized backup and cross-Region recovery with AWS Backup.
Provisioning with AWS CloudFormation (and AWS CDK), fleet automation and patching with AWS Systems Manager, image building, event-driven automation with AWS Lambda, and managing configuration drift.
Amazon VPC design and connectivity troubleshooting, Amazon Route 53 routing policies, hybrid connectivity, and content delivery with Amazon CloudFront.
AWS IAM policies, encryption with AWS KMS, threat detection with Amazon GuardDuty, and guardrails and compliance with AWS Config rules.
Source: AWS Certified CloudOps Engineer – Associate (SOA-C03) exam guide. AWS publishes five scored domains; cost and performance optimization is assessed within Domain 1 rather than as a standalone domain. Domains are shown top-weighted first; AWS numbers Security as Domain 4 and Networking as Domain 5.
Who SOA-C03 is for
This is AWS's benchmark operations credential, for practitioners who keep AWS workloads healthy day to day:
- Cloud operations and CloudOps engineers deploying, monitoring, and troubleshooting AWS workloads.
- Systems administrators and SREs moving operational skills to AWS or formalizing them.
- Cloud support and infrastructure engineers responsible for reliability, patching, and incident response.
- DevOps practitioners using SOA-C03 as the stepping stone toward the DevOps Engineer – Professional.
There are no mandatory prerequisites, but AWS recommends about a year of hands-on AWS operations experience; those new to IT often earn the Cloud Practitioner first. From here, the common next step is the DevOps Engineer – Professional, and many operators pair this with the Solutions Architect – Associate or the Security – Specialty. For where AWS operations skills lead, see the cloud operations career paths in the Career Hub.
What this SOA-C03 practice exam delivers
Learn mode
Get the correct answer, the operational reasoning, why each distractor fails, and a link to the exact AWS documentation right after each question — built for the diagnose-and-remediate scenarios SOA-C03 tests.
Exam mode
Rehearse on a 130-minute timer against 65-question sets that mirror the real SOA-C03 format, so you build the pacing to work through operations scenarios under time.
Source-linked explanations
Every answer cites official AWS documentation — CloudWatch, Systems Manager, RDS, VPC, and more — so you study from AWS's own material, not a mystery answer key.
Score by domain
Results break down across the five SOA-C03 domains, so practice tells you exactly which area — monitoring, reliability, automation, security, or networking — to sharpen next.
Sample SOA-C03 practice questions
Ten free questions across the five SOA-C03 domains, with full explanations and links to the relevant AWS documentation. The complete bank is available with the 24-hour trial.
A team needs a single CloudWatch alarm that triggers when CPU exceeds 80% for 5 minutes on any instance in a group of 50 EC2 instances. Which approach is most efficient?
- Create 50 individual alarms
- Use a metric math expression with MAX across all instance metrics in one alarm
- Manually check the console daily
- Use AWS Config
Show answer & explanation
Correct: B. A metric math expression (for example, MAX over the per-instance metric set) lets one alarm watch the worst case across all instances.
Why not the others: 50 individual alarms (A) are wasteful and noisy; manual checks (C) miss the SLA; and AWS Config (D) tracks configuration, not CPU metrics.
Source: AWS — Using CloudWatch metric math →A primary RDS Multi-AZ MySQL instance fails, and the application reconnects and resumes within seconds. What happened under the hood?
- Multi-AZ failover swapped the DNS endpoint to the standby
- The read replica was promoted
- EBS volumes were detached and reattached
- The instance was restored from the latest snapshot
Show answer & explanation
Correct: A. RDS Multi-AZ keeps a synchronous standby in another AZ, and failover updates the DNS CNAME to point at the standby — usually within 60–120 seconds.
Why not the others: read replicas (B) are asynchronous and not part of automatic failover; and detaching EBS volumes (C) or restoring from snapshot (D) describe slower, unrelated processes.
Source: AWS — RDS Multi-AZ deployments →An ops engineer must apply OS patches to 500 EC2 instances on a recurring schedule, with maintenance windows and compliance reporting. Which service is purpose-built for this?
- AWS CodeDeploy
- AWS Systems Manager Patch Manager with Maintenance Windows
- Amazon EventBridge alone
- AWS Backup
Show answer & explanation
Correct: B. Patch Manager with Maintenance Windows handles scheduled, audited patching at fleet scale, including reporting through Patch Compliance.
Why not the others: CodeDeploy (A) deploys application code; EventBridge alone (C) has no patch logic; and AWS Backup (D) is for data protection.
Source: AWS — Systems Manager Patch Manager → Further reading: PowerKram — fleet patching & automation →A security team needs to detect IAM credential exfiltration and unusual API patterns across all accounts in an AWS Organization. Which service should they enable?
- AWS Trusted Advisor
- Amazon GuardDuty enabled organization-wide
- Amazon Inspector
- AWS Cost Anomaly Detection
Show answer & explanation
Correct: B. GuardDuty applies machine learning to CloudTrail, VPC Flow Logs, and DNS logs to detect threats such as credential exfiltration, and its Organizations integration enables it across all accounts.
Why not the others: Trusted Advisor (A) has security checks but no anomaly detection; Inspector (C) scans hosts and containers for vulnerabilities; and Cost Anomaly Detection (D) is for spend.
Source: AWS — Amazon GuardDuty → Further reading: PowerKram — AWS Security – Specialty (SCS-C02) →Users in Asia report slow downloads of large files served from an S3 bucket in us-east-1. Which feature most directly improves their experience with minimal application change?
- Move the bucket to ap-northeast-1
- Use S3 Transfer Acceleration for downloads
- Switch to EC2 file servers
- Enable CloudFront in front of the S3 bucket as the origin
Show answer & explanation
Correct: D. CloudFront caches content at edge locations near users, reducing download latency globally with no application change.
Why not the others: moving the bucket (A) helps only that one Region; EC2 file servers (C) add operational overhead; and Transfer Acceleration (B) speeds uploads to S3, not downloads to end users.
Source: AWS — CloudFront distributions →A finance team wants to identify untagged resources to enforce a chargeback policy. Which tool reports tag coverage across the account quickly?
- AWS Shield
- Amazon CloudWatch Logs
- AWS Resource Groups & Tag Editor, with cost allocation tags activated
- AWS Outposts
Show answer & explanation
Correct: C. Tag Editor finds resources missing required tags, and activating cost allocation tags surfaces them in Cost Explorer and the Cost and Usage Report.
Why not the others: Shield (A) is DDoS protection; CloudWatch Logs (B) stores log data; and Outposts (D) is on-premises AWS hardware — none reports tag coverage.
Source: AWS — Tag Editor: find resources to tag → Further reading: PowerKram — tagging & cost allocation →An Application Load Balancer target group shows healthy targets, but users intermittently get HTTP 504 Gateway Timeout. What is the most likely cause?
- Missing IAM role on the ALB
- DNS misconfiguration
- Wrong AMI architecture
- Targets respond after the ALB idle/target timeout
Show answer & explanation
Correct: D. A 504 from an ALB means the target took longer than the ALB target (or idle) timeout to respond.
Why not the others: DNS problems (B) surface as different 5xx behavior; a wrong AMI architecture (C) causes boot issues, not 504s; and ALBs (A) do not use IAM roles for traffic forwarding.
Source: AWS — ALB troubleshooting → Further reading: PowerKram — load-balancer troubleshooting →Backups for EBS volumes, RDS, EFS, and DynamoDB tables need a single, central, policy-driven solution with cross-Region copy. Which service fits?
- A custom Lambda cron job
- AWS Snapshot Manager
- AWS Backup
- S3 Lifecycle policies
Show answer & explanation
Correct: C — AWS Backup. AWS Backup centralizes backup policies across many services with cross-Region and cross-account copy.
Why not the others: a custom Lambda cron (A) is high-maintenance; "AWS Snapshot Manager" (B) is not a real service; and S3 Lifecycle policies (D) apply only to S3.
Source: AWS — What is AWS Backup? →A VPC has private subnets that need outbound internet access (for example, to download patches) but must not accept inbound connections from the internet. Which component should be added?
- A NAT Gateway in a public subnet, with a route from the private subnet to it
- An Internet Gateway attached directly to the private subnets
- A Customer Gateway
- A Transit Gateway
Show answer & explanation
Correct: A. A NAT Gateway in a public subnet allows outbound-only internet access from private subnets while blocking inbound connections.
Why not the others: an internet gateway with public IPs (B) would also accept inbound traffic; a Customer Gateway (C) is for VPN; and a Transit Gateway (D) interconnects VPCs.
Source: AWS — NAT gateways → Further reading: PowerKram — AWS Solutions Architect Associate (SAA-C03) →An ops team wants to run a one-time interactive command across 200 EC2 instances without opening SSH ports. Which feature is appropriate?
- AWS Systems Manager Run Command (with Session Manager for interactive access)
- Open port 22 to 0.0.0.0/0 temporarily
- EC2 Instance Connect to each instance manually
- The EC2 console reboot button
Show answer & explanation
Correct: A. Run Command executes documents at fleet scale, and Session Manager provides interactive shells without inbound SSH.
Why not the others: opening port 22 to the world (B) is insecure; EC2 Instance Connect per instance (C) does not scale to 200; and the reboot button (D) does not run commands.
Source: AWS — Systems Manager Run Command →Keep going: Learning & Career resources
CloudOps – Associate anchors the AWS operations track and leads toward DevOps. Both PowerKram hubs back your next step.
Deep dive: the CloudOps rename, exam format, study path, and where to go next
The SysOps → CloudOps rename
In 2025 AWS renamed SysOps Administrator – Associate to CloudOps Engineer – Associate and refreshed the content. SOA-C03 went live on September 30, 2025, the day after SOA-C02 retired. The new name only applies to those who pass SOA-C03; existing SysOps Administrator – Associate holders keep that credential and are not required to retake. The refresh added modern operations scope — multi-account governance, infrastructure as code (CloudFormation and AWS CDK), event-driven automation, and containers (ECS, EKS, ECR, Fargate). AWS — CloudOps Engineer – Associate →
Exam format and scoring
SOA-C03 has 65 questions in 130 minutes: 50 are scored and 15 are unscored pretest items that do not affect your result (you cannot tell which are which). Questions are multiple choice (one correct answer) and multiple response (two or more). Scoring is scaled from 100 to 1000, and 720 is the minimum passing score. The exam uses a compensatory model, so you need to pass only the overall exam, not each domain. Unlike earlier SysOps versions, SOA-C03 has no scored hands-on labs — those skills are folded into scenario questions. Read the SOA-C03 format guide →
Realistic study path
This exam rewards habits, not memorization. A practical plan runs six to eight weeks: work the official exam guide domain by domain, then get hands-on in an AWS account — set up CloudWatch alarms with metric math, an RDS Multi-AZ failover test, a Systems Manager patch baseline and maintenance window, a CloudFront distribution over S3, and a VPC with a NAT gateway. Route 53 routing policies and the layered connectivity checklist (security group → NACL → route table → IGW/NAT) are near-guaranteed, so drill them. Start with the top-weighted domains (the three 22% domains), then rehearse in Learn mode and run full 65-question, 130-minute simulations in Exam mode once your Learn-mode accuracy passes ~85%. Read the SOA-C03 study plan →
Where to go next
The most common step up from CloudOps – Associate is the DevOps Engineer – Professional (DOP-C02), which builds on operations with CI/CD, automated deployment, and governance at scale. Many operators also pair this with the Solutions Architect – Associate (SAA-C03) for design breadth or the Security – Specialty (SCS-C02) for depth in Domain 4 material. See more AWS exams →
Cost, scheduling, and recertification
The exam costs $150 USD and is delivered at a Pearson VUE test center or online with a proctor. If you have earned any prior AWS certification, a 50% discount voucher is available in your AWS Certification account. If you do not pass, AWS requires a 14-day wait before retaking. The certification is valid for three years; recertify by passing the current version or a higher-tier exam before it expires. Career Hub — cloud operations roles →
Frequently asked questions
Is SOA-C03 the same as the SysOps Administrator exam?
SOA-C03 is the renamed and refreshed successor. AWS renamed SysOps Administrator – Associate to CloudOps Engineer – Associate, and SOA-C03 went live on September 30, 2025 (SOA-C02 retired the day before). Existing SysOps Administrator – Associate holders keep that credential name and are not required to retake.
What format is the SOA-C03 exam?
65 questions in 130 minutes — 50 scored and 15 unscored pretest items. Questions are multiple choice and multiple response, and there are no scored hands-on labs. Scoring is scaled from 100 to 1000, and the minimum passing score is 720. The exam uses compensatory scoring, so you pass on the overall exam, not each domain.
What does SOA-C03 cover?
Five domains: Monitoring, Logging, Analysis, Remediation and Performance Optimization (22%); Reliability and Business Continuity (22%); Deployment, Provisioning and Automation (22%); Security and Compliance (16%); and Networking and Content Delivery (18%). Cost and performance optimization is assessed within the monitoring domain rather than as a standalone domain.
How much does SOA-C03 cost, and are there prerequisites?
The exam costs $150 USD (a 50% discount voucher is available after any prior AWS certification). There are no mandatory prerequisites; AWS recommends about one year of hands-on AWS operations experience. Those new to IT often earn the Cloud Practitioner first.
What should I pursue after SOA-C03?
The most common next step is the DevOps Engineer – Professional (DOP-C02), which builds on operations with CI/CD and governance at scale. Many operators also pair SOA-C03 with the Solutions Architect – Associate (SAA-C03) or the Security – Specialty (SCS-C02).
Start your free 24-hour SOA-C03 practice trial
Full access to 1050+ questions, both study modes, source-linked explanations, and score-by-domain. No credit card required.
Start free trial →