AWS SOA-C03 Certification Exam
AWS Certified CloudOps Engineer Associate SOA-C03
The AWS Certified CloudOps Engineer - Associate certification validates the ability to deploy, manage, and operate workloads on AWS. The exam covers five domains: Monitoring, Logging, Analysis, Remediation, and Performance Optimization; Reliability and Business Continuity; Deployment, Provisioning, and Automation; Security and Compliance; and Networking and Content Delivery. It draws on services such as CloudWatch, CloudTrail, Systems Manager, EC2 Auto Scaling, CloudFormation, IAM, Route 53, and AWS Backup. Candidates are tested on troubleshooting operational issues, automating routine tasks, and enforcing compliance rather than designing new architectures. This certification suits operations engineers and systems administrators with about a year of AWS experience.
Certification Overview
- Exam name: AWS Certified CloudOps Engineer - Associate (SOA-C03)
- Vendor: AWS
- Exam code: SOA-C03
- Duration: 130 minutes
- Total questions: 65
- Passing score: 72%
Who Should Take This Exam?
Cloud Operations Engineer, Systems Administrator, Site Reliability Engineer, DevOps Engineer, Cloud Support Engineer, Infrastructure Engineer, Monitoring Specialist
Prerequisites
No prior certification is required. AWS recommends about one year of hands-on experience deploying, managing, and operating workloads on AWS.
Topics Covered
- Monitoring, Logging, Analysis, Remediation, and Performance Optimization
- Reliability and Business Continuity
- Deployment, Provisioning, and Automation
- Security and Compliance
- Networking and Content Delivery
Question Types
- Multiple Choice (Single Answer)
- Multiple Choice (Multiple Answers)
AWS Certified CloudOps Engineer - Associate (SOA-C03) Practice Questions
Our question bank contains 850+ practice questions for this certification. Sample questions from each exam chapter. Expand a question to see the answer choices. With a subscription, you get unlimited practice exams with randomized questions from our full question bank.
Monitoring, Logging, Analysis, Remediation, and Performance Optimization
A cloud operations engineer creates a new CloudWatch Logs log group without specifying a retention setting. How long will the log events be kept by default?
- Events expire after 30 days
- Events expire after 1 year
- Events expire after 7 days
- Events are kept indefinitely (never expire)
A CloudWatch alarm has just been created for an EC2 instance's CPUUtilization metric, and no data points have been reported yet. What state will the alarm show?
- ALARM
- PENDING
- INSUFFICIENT_DATA
- OK
A systems administrator provisions a new Amazon EBS gp3 volume without changing any settings. Which baseline performance does the volume receive?
- Performance that scales only with volume size, no baseline
- 16,000 IOPS and 1,000 MB/s throughput
- 100 IOPS and 128 KB/s throughput
- 3,000 IOPS and 125 MB/s throughput
Reliability and Business Continuity
An Auto Scaling group just completed a scale-out activity and launched a new EC2 instance. During the cooldown period, what does the Auto Scaling group do?
- It terminates the newest instance automatically
- It doubles the maximum capacity for one hour
- It moves all instances to a new Availability Zone
- It suspends further scaling activities triggered by simple or step scaling alarms
A retail company runs an Amazon RDS Multi-AZ deployment for its order database. What is the purpose of the standby instance in a different Availability Zone?
- It stores nightly database exports in S3
- It provides automatic failover if the primary instance becomes unavailable
- It runs a separate, independently managed copy of the schema
- It serves read traffic to reduce load on the primary
A cloud operations engineer needs to understand how Amazon EBS snapshots are stored. After the first full snapshot of a volume, what do subsequent snapshots of that volume capture?
- A compressed archive stored on the instance's root volume
- Only the volume's file system metadata
- Only the blocks that changed since the last snapshot
- A complete copy of the entire volume each time
Deployment, Provisioning, and Automation
A systems administrator needs to provision a consistent set of AWS resources across multiple environments using a text-based template that can be version-controlled. Which AWS service should the administrator use?
- AWS Config
- Amazon Inspector
- AWS CloudFormation
- AWS Trusted Advisor
In an AWS CloudFormation template, which section defines the AWS resources that will be created when the stack is launched?
- Resources
- Mappings
- Outputs
- Parameters
A cloud operations engineer wants to run a predefined set of commands on a fleet of managed EC2 instances without establishing SSH sessions to each one. Which Systems Manager capability should the engineer use?
- Parameter Store
- Inventory
- Change Calendar
- Run Command
Security and Compliance
A systems administrator must grant an IAM role additional access without editing its existing identity-based policy, while still capping the maximum permissions the role can ever receive. What should the administrator attach to the role?
- A service control policy at the organization root
- A resource-based policy on the target resource
- A tag-based session policy passed at sign-in
- A permissions boundary
A cloud operations engineer wants to identify which IAM roles in an account grant access to resources outside the account. Which service should the engineer use?
- AWS Config
- IAM Access Analyzer
- Amazon Inspector
- AWS Trusted Advisor
What does AWS Key Management Service do when automatic key rotation is enabled on a customer managed symmetric key?
- It exports the key material to Secrets Manager
- It rotates the key policy attached to the key
- It deletes the key and forces re-encryption of all data
- It generates new key material each year
Networking and Content Delivery
A systems administrator manages a VPC where instances in a private subnet need outbound internet access to download software patches without accepting inbound connections initiated from the internet. Which component should the administrator deploy in a public subnet?
- NAT gateway
- VPC peering connection
- Internet gateway
- Virtual private gateway
A cloud operations engineer creates a new security group in a VPC and does not add any rules. Which outbound traffic does the security group allow by default?
- All outbound traffic
- Traffic only within the VPC CIDR
- Traffic only to the internet gateway
- No outbound traffic
An operations team wants to point a domain's root record at an Application Load Balancer using a record type that resolves directly to AWS resources instead of an IP address. Which Route 53 record type should they use?
- CNAME record
- Alias record
- NS record
- PTR record
Frequently Asked Questions
How many questions are on the exam?
The AWS Certified CloudOps Engineer - Associate (SOA-C03) exam contains 65 questions.
What is the passing score?
You need 72% to pass.
How long is the exam?
You have 130 minutes to complete the exam.
More AWS Practice Exams
Practice with realistic mock exams to prepare for your AWS certification.