AWS Certified CloudOps Engineer – Associate Cheat Sheet (SOA-C03)
Every CloudWatch alarm pattern, Systems Manager tool, DR strategy, and VPC diagnostic the SOA-C03 exam actually tests — organised the way operators work, not the way services are catalogued
About This Cheat Sheet
- 13 pages
- Every in-scope SOA-C03 service
- Formerly SysOps Administrator
- 19 sections
- Updated April 2026
Exam domains
Share of the scored SOA-C03 content
- Monitoring, Logging, Analysis, Remediation, and Performance Optimization22%
- Reliability and Business Continuity22%
- Deployment, Provisioning, and Automation22%
- Security and Compliance16%
- Networking and Content Delivery18%
Services covered
Monitoring & remediation
- CloudWatch
- Managed Grafana
- Managed Service for Prometheus
- X-Ray
- Systems Manager
- CloudTrail
- Config
Reliability & business continuity
- Auto Scaling
- AWS Backup
- Application Recovery Controller
Deployment & automation
- CloudFormation
- CDK
- Organizations
- Control Tower
- Service Catalog
- RAM
- IAM Identity Center
Security & compliance
- IAM
- KMS
- ACM
- Secrets Manager
- GuardDuty
- Inspector
- Macie
- Security Hub
- WAF
- Shield
- Firewall Manager
Networking & content delivery
- VPC
- Transit Gateway
- PrivateLink
- Reachability Analyzer
- Network Access Analyzer
- IPAM
- Route 53 Resolver DNS Firewall
- Network Firewall
- Route 53
- ELB
- CloudFront
Show 34 more servicesShow fewer
Compute & containers
- EC2
- EC2 Image Builder
- Lambda
- ECR
- ECS
- EKS
- Fargate
Storage
- S3
- EBS
- EFS
- FSx
- Storage Gateway
- DataSync
Database
- RDS
- RDS Proxy
- Aurora
Application integration
- SQS
- SNS
- EventBridge
- Step Functions
Analytics
- Athena
- Data Firehose
- SES
Audit & operations tools
- Audit Manager
- Trusted Advisor
- Health Dashboard
- CLI v2
- CloudShell
- Amazon Q Developer
Cost
- Cost Explorer
- Budgets
- Cost and Usage Report
- Savings Plans
- Compute Optimizer
Feature details
- CloudWatch
- Metrics · Alarms · Logs · Agent · Synthetics · ServiceLens
- Systems Manager
- The full suite: Session Manager, Run Command, State Manager, Patch Manager, Automation, Parameter Store, Inventory, OpsCenter, Change Manager, Distributor, Fleet Manager
- Config
- Auto-remediation
- Application Recovery Controller
- ARC readiness checks · Zonal shift
- CloudFormation
- Helper scripts
- Containers
- ECR/ECS/EKS with Fargate
Concepts covered
- Operations
- Lambda for operators · Observability stack · Threat detection · Network diagnostics · Edge/DNS/LB
- Reliability
- Four DR strategies with RPO/RTO tradeoffs · CloudTrail / CloudWatch / Config three-way pattern
Built from the official SOA-C03 exam guide for the renamed CloudOps Engineer Associate; every in-scope service is present, audited against the guide.
What's Inside
CloudOps Fundamentals & EC2
AWS Console, CLI v2, CloudShell, Amazon Q Developer. EC2 User Data, IMDSv2, instance profiles, AMIs with EC2 Image Builder, placement groups, Auto Scaling with launch templates, lifecycle hooks, warm pools, instance refresh, termination policies.
Amazon CloudWatch (deep)
Built-in vs. CloudWatch agent metrics (memory/disk need the agent), standard vs. high-resolution, metric math, metric alarms vs. composite alarms, EC2 recovery action, anomaly detection bands. Logs with retention, subscription filters, metric filters, Logs Insights, Contributor Insights. Synthetics Canaries, ServiceLens. EventBridge rules and EventBridge Scheduler.
Observability Stack
Amazon Managed Grafana, Amazon Managed Service for Prometheus, AWS X-Ray (segments/subsegments/annotations/metadata/sampling), VPC Flow Logs, CloudTrail Insights.
AWS Systems Manager (the full suite)
Session Manager (no SSH, port forwarding), Run Command, State Manager Associations, Patch Manager with baselines and patch groups, Maintenance Windows, Automation runbooks, Parameter Store, Inventory, OpsCenter, Change Manager, Distributor, Fleet Manager, Hybrid Activations.
Audit, Logging & Compliance
CloudTrail management vs. data events, CloudTrail Lake, AWS Config with rules and SSM Automation auto-remediation, conformance packs, Trusted Advisor (especially service-quota checks), Audit Manager, AWS Health Dashboard. The CloudTrail / CloudWatch / Config three-way pattern.
Reliability, Backup & DR
AWS Backup with Backup Vault Lock and cross-Region/cross-account copy, RDS Multi-AZ vs. Multi-AZ Cluster vs. Read Replicas, Aurora HA, Route 53 failover routing. Application Recovery Controller (readiness checks, routing controls, safety rules, zonal shift). The four DR strategies with RPO/RTO tradeoffs.
Storage & Database Operations
S3 lifecycle rules, Replication (including RTC 15-min SLA), Object Lock, Storage Lens, Access Points, Block Public Access. EBS types with IOPS/throughput tradeoffs, Data Lifecycle Manager, Fast Snapshot Restore. EFS, FSx variants, Storage Gateway, DataSync. RDS parameter/option groups, RDS Events, Performance Insights, RDS Proxy, Aurora operational features.
Deployment & Multi-Account Governance
CloudFormation with change sets, drift detection, stack sets, helper scripts (cfn-init/signal/hup), CreationPolicy/UpdatePolicy/DeletionPolicy. AWS CDK workflow. Organizations with SCPs and tag policies, Control Tower landing zone and Account Factory, Service Catalog, Resource Access Manager, IAM Identity Center.
Identity, Encryption & Threat Detection
IAM policy evaluation order, IAM Access Analyzer. KMS key types, envelope encryption, multi-Region keys. Secrets Manager vs. Parameter Store. GuardDuty, Inspector, Macie, Security Hub, WAF, Shield Standard vs. Advanced, AWS Network Firewall for deep-packet inspection in a central inspection VPC, Firewall Manager for org-wide policy.
Networking & Edge
VPC components (subnets, IGW, Egress-only IGW, NAT, SG, NACL, route tables), Transit Gateway, PrivateLink, VPC Endpoints (Gateway vs. Interface). Network diagnostics: Flow Logs, Reachability Analyzer, Network Access Analyzer, IPAM, Route 53 Resolver DNS Firewall. Route 53 routing policies, ELB types with sticky sessions and cross-zone tradeoffs, CloudFront with OAC.
Cost Management
Cost Explorer, AWS Budgets with actions, Cost and Usage Report with Athena/QuickSight, Savings Plans (especially Compute), Reserved Instances, Compute Optimizer, Trusted Advisor cost checks.
Why This Cheat Sheet Helps
SOA-C03 is the only AWS associate exam whose whole shape is operational rather than architectural or developer-focused. Questions test the muscle memory of an operator in a running account — which alarm action to wire up, which SSM tool to reach for, how to patch a fleet on a schedule, how to detect DR drift before it bites you. This cheat sheet puts those decisions side by side with the specific language examiners use.
It assumes you have about a year of hands-on AWS operations experience. Use it as a final-week review to reinforce patterns you already recognise, fill gaps surfaced by practice exams, and prime yourself for the phrasings the exam uses.
How to Use It
Skim the whole sheet end to end to see the shape of the exam. Then use CloudNinja's free SOA-C03 practice exam to find your gaps. When you miss a question, jump to the relevant section — most likely CloudWatch (3), Systems Manager (5), Reliability & Backup (7), or Networking (13), since those carry the most exam weight.
On exam day minus three, go through every Exam Tip call-out. Those are the decision rules distilled — they're the pattern-match you need on test day.
Frequently Asked Questions
Is this AWS CloudOps Engineer cheat sheet free?
Yes, completely free with no signup required. Download the PDF directly from CloudNinja and use it as a study reference for the SOA-C03 exam.
Why is the exam called CloudOps Engineer instead of SysOps Administrator?
AWS rebranded the SysOps Administrator Associate exam to CloudOps Engineer Associate to better reflect the modern role — operations work is now about automation, observability, and reliability rather than traditional systems administration. The new name came with a new exam version: SOA-C03 replaced SOA-C02 on September 30, 2025. Most of the content carries over, but there are five domains instead of six, with cost and performance optimization folded into the monitoring domain.
How much AWS experience do I need before SOA-C03?
AWS recommends around one year of hands-on operations experience — deploying, managing, monitoring, and troubleshooting workloads on AWS. If you have less than that, consider starting with the Cloud Practitioner (CLF-C02). If you already hold the Solutions Architect Associate, most of the architectural concepts will transfer; the differences are the depth on CloudWatch, Systems Manager, and operational governance.
Is this cheat sheet updated for the renamed CloudOps Engineer exam?
Yes, it is built directly from the current SOA-C03 exam guide (sysops-administrator-associate-03) and uses the new CloudOps Engineer name while acknowledging the SysOps Administrator heritage. It covers the in-scope services AWS added to the renamed exam (Managed Grafana, Managed Prometheus, Application Recovery Controller, IPAM, Network Firewall) alongside everything carried over from SysOps.
Keep Studying
Recommended courses
Affiliate links — if you enrol through them, CloudNinja may earn a commission at no extra cost to you.