How to Pass the AWS CloudOps Engineer - Associate (SOA-C03) Exam in 2026

Updated August 2026: AWS retired the SysOps Administrator - Associate exam (SOA-C02) on September 29, 2025, and replaced it with the AWS Certified CloudOps Engineer - Associate (SOA-C03) the next day. This guide has been rewritten for the current exam — see our full breakdown of what changed if you started studying before the rename.

The AWS Certified CloudOps Engineer - Associate (SOA-C03) is widely considered the most operationally demanding of the three AWS associate-level certifications. While the Solutions Architect Associate (SAA-C03) tests design skills and the Developer Associate (DVA-C02) tests coding skills, the CloudOps Engineer exam tests your ability to deploy, manage, and operate workloads on AWS — including containers, automation pipelines, and infrastructure as code.

What Is the SOA-C03 Exam?

• Format: 65 questions, multiple choice and multiple response — 50 scored, 15 unscored (unscored questions are not identified during the exam)
• Duration: 130 minutes
• Cost: $150 USD
• Passing score: 720 out of 1000 (scaled)
• Recommended experience: About 1 year deploying, managing, and operating workloads on AWS, plus general operations experience (system administration or similar)

Unlike its predecessor, SOA-C03 has no hands-on lab component. AWS removed the timed console-lab section entirely when it retired SOA-C02 — every point on the current exam comes from multiple-choice and multiple-response questions.

The Five Domains

Content Domain 1: Monitoring, Logging, Analysis, Remediation, and Performance Optimization (22%)

This domain absorbed the old exam’s separate cost/performance domain and is the largest single content area.

CloudWatch mastery:

• CloudWatch Metrics — default, custom, and high-resolution metrics, metric math
• CloudWatch Alarms — threshold, anomaly detection, composite alarms, alarm actions
• CloudWatch Logs — log groups, retention, metric filters, subscription filters, Logs Insights queries
• Configuring the CloudWatch agent to collect metrics and logs from EC2, ECS, and EKS — new content added for SOA-C03
• CloudWatch Dashboards, Synthetics canaries, ServiceLens, and Application Insights
• CloudWatch network monitoring services — new content added for SOA-C03

Other monitoring services:

• CloudTrail — management events, data events, organization trails, CloudTrail Lake
• AWS Config — rules, conformance packs, remediation actions, aggregators
• Amazon EventBridge for event-driven automation
• AWS Health Dashboard and VPC Flow Logs

Remediation:

• Automated remediation with CloudWatch Alarms + Lambda
• Systems Manager Automation runbooks and Config auto-remediation rules

Content Domain 2: Reliability and Business Continuity (22%)

Weight increased from 16% on the old exam — study this domain harder than legacy material suggests.

• High availability: Multi-AZ deployments for RDS/ElastiCache/EFS; Auto Scaling groups (launch templates, target tracking/step/simple/scheduled policies, lifecycle hooks, warm pools); ALB vs NLB; Route 53 health checks and failover routing
• Backup and disaster recovery: AWS Backup plans and vaults (cross-Region, cross-account); RDS backups, snapshots, point-in-time recovery, read replicas; EBS snapshot lifecycle management; S3 cross-Region replication and Object Lock; DR strategies (backup/restore, pilot light, warm standby, multi-site active-active)

Content Domain 3: Deployment, Provisioning, and Automation (22%)

Weight also increased from 18%, and this is where the exam’s new container and IaC emphasis lives.

EC2 and containers:

• AMI management, instance types and sizing, placement groups
• ECS, EKS, ECR, and Fargate — explicitly in scope for SOA-C03, unlike the retired exam

Infrastructure as code:

• CloudFormation — stacks, change sets, drift detection, stack policies, rollback triggers, StackSets
• Creating and managing stacks of resources using CloudFormation and the AWS CDK — new content added for SOA-C03
• Service Catalog for approved templates

Automation:

• Systems Manager — Run Command, Patch Manager, State Manager, Session Manager, Parameter Store
• Systems Manager Automation for complex workflows, Elastic Beanstalk, AWS OpsWorks

Provisioning:

• AWS Organizations, SCPs, Control Tower landing zones and guardrails

Content Domain 4: Security and Compliance (16%)

Unchanged weight from the previous exam.

• Identity and access: IAM users/groups/roles/policies, permission boundaries, IAM Access Analyzer, Identity Center, cross-account STS AssumeRole
• Data protection: KMS, ACM, S3 bucket policies and Block Public Access, Secrets Manager rotation
• Compliance and auditing: AWS Config, CloudTrail, Trusted Advisor, Security Hub, GuardDuty, Inspector
• Enforcing compliance requirements such as Region and service selection restrictions — new content added for SOA-C03

Content Domain 5: Networking and Content Delivery (18%)

Unchanged weight. VPN configuration moved into this domain from security on the previous exam.

• VPC: subnets, route tables, internet/NAT gateways, security groups vs NACLs, VPC peering, VPC endpoints, Transit Gateway
• VPN and Direct Connect: site-to-site VPN, client VPN, dedicated/hosted Direct Connect
• DNS: Route 53 hosted zones, record types, routing policies (simple, weighted, latency, failover, geolocation, geoproximity, multivalue)
• Content delivery: CloudFront distributions/behaviors/cache policies, CloudFront Functions, Lambda@Edge, S3 Transfer Acceleration, Global Accelerator

Note: S3 static website hosting configuration was removed from the content outline for SOA-C03.

Your 6-Week Study Plan

Week 1: Monitoring and Logging

Study CloudWatch in depth, including the CloudWatch agent for EC2/ECS/EKS and CloudWatch network monitoring. Study CloudTrail, Config, and EventBridge. Hands-on: create CloudWatch alarms, configure the CloudWatch agent on an EC2 instance, write Logs Insights queries. 3 practice question sets.

Week 2: Reliability and Backup

Study Auto Scaling groups, ELB, Route 53 health checks, AWS Backup, and cross-Region DR strategies. Hands-on: create an Auto Scaling group with a target tracking policy, set up an AWS Backup plan. 3 practice question sets.

Week 3: Deployment, Containers, and Automation

Study CloudFormation, AWS CDK stack management, ECS/EKS/Fargate fundamentals, and Systems Manager. Hands-on: deploy a CloudFormation stack, run a container task on ECS Fargate, use Systems Manager to patch instances. 3 practice question sets.

Week 4: Security and Networking

Study IAM, KMS, Secrets Manager, Security Hub, and VPC design (subnets, routing, security groups, NACLs, endpoints, VPN). Hands-on: configure a VPC with public/private subnets and a VPC endpoint, set up a client VPN. 3 practice question sets.

Week 5: Content Delivery and Compliance

Study CloudFront, Route 53 routing policies, Global Accelerator, and compliance enforcement (Region/service restrictions, Config conformance packs). 3 practice question sets.

Week 6: Review and Exam Simulation

Full-length practice exam (65 questions, 130 minutes, timed). Targeted review of weak areas by domain. Second full-length practice exam — aim for 80%+ before sitting the real exam.

SOA-C03 vs SAA-C03: How They Differ

• SAA-C03 asks: “Which architecture would you design?”
• SOA-C03 asks: “How would you deploy, monitor, and maintain this architecture?”

If you already hold the SAA-C03, you have a head start on security, networking, and high-availability content. What is new is the deep focus on CloudWatch, Systems Manager, containers, and infrastructure-as-code automation.

What Comes Next

After SOA-C03, natural next steps include:

• AWS DevOps Engineer Professional (DOP-C02) — the professional-level certification building on both developer and operations skills
• AWS Solutions Architect Professional (SAP-C02) — for advanced architecture roles
• AWS Generative AI Developer Professional (AIP-C01) — to add generative AI implementation skills to your operations toolkit

The CloudOps Engineer certification validates practical operations skills that teams need every day, and the current exam reflects how those workloads actually run in 2026 — containers, automation, and infrastructure as code included. Study the current domains, use StudyKits for targeted practice, and earn it.