CertiCaller, number, packet
- CloudTrail who called the API
- CloudWatch the metric or the log you shipped
- Flow Logs accept or reject
- Config what the resource looks like now
Study guide · Flashcards & memory notes
AWS CloudOps Flashcards & Memory Notes
50 recall cards for the distinctions SOA-C03 keeps testing: which signal names the fault, which recovery pattern matches the objective, and which hop dropped the packet.
How to use these cards: Say the answer out loud before you flip the card, and mark it honestly. Revisit the cards you missed tomorrow rather than rereading them right away. Progress is kept only while this page is open. For the full explanations behind each card, see the core notes.
Study mode
Choose a deck, flip each card, and mark what you already know.
You marked every card in this deck as known. Shuffle and run through it again, or choose another deck.
All flashcards
Select a question to reveal its answer.
Deck 1 · Monitoring
Alarms, logs, agents, and the metric that names the fault.
1.1What does CloudTrail record that a CPU graph does not?
The API call and the principal who made it. CloudWatch stores the metric. Flow Logs store accept or reject.
1.2Why is operating-system memory missing from default EC2 graphs?
Basic monitoring does not collect it. The CloudWatch agent publishes memory and disk, including on ECS and EKS in exam guide version 1.1.
1.3What is a composite alarm?
An alarm that evaluates other alarms. Use it to page only when several conditions are true, or to suppress actions during maintenance.
1.4Where does an alarm fan a notification out?
An Amazon SNS topic. Amazon SES sends application email. It is not the alarm action.
1.5What does a metric filter produce?
A CloudWatch metric from log lines that match a pattern. It does not create a VPC or an AMI.
1.6Which store holds Prometheus samples?
Amazon Managed Service for Prometheus. Amazon Managed Grafana is the dashboard, not the sample store.
1.7What do you add when object-level S3 reads must be audited?
S3 data events on the trail. Management events do not include GetObject by default.
1.8Which pair does version 1.1 add for metric analysis and automated remediation?
Kiro and AWS DevOps Agent. They sit beside CloudWatch, Lambda, Systems Manager, and CloudTrail. They do not replace the metric.
1.9A gp2 volume is slow and its burst balance is zero. What removes the burst dependency?
Move it to gp3 or provision IOPS that do not depend on burst credits. S3 versioning does not add IOPS.
1.10What does AWS Compute Optimizer recommend?
A smaller or better-fit size when the metric supports it. A second Region is not the first response to an oversized instance.
Deck 2 · Reliability
Scaling, failover, backups, and the recovery pattern.
2.1Which scaling policy holds a metric near a target?
Target tracking. Scheduled scaling is for a known clock, such as a daily peak.
2.2When should an Auto Scaling group use the load balancer health check?
When the application can be down while the EC2 status check is still green. The EC2 check does not see an HTTP failure.
2.3What does RDS Multi-AZ provide?
A synchronous standby and automatic failover to the same endpoint. A read replica scales reads. It is not that standby.
2.4Why is Multi-AZ not a Regional disaster plan?
The standby is in the same Region. A Regional failure needs a cross-Region copy and a recovery pattern.
2.5What is RPO?
How much data loss, in time, you can accept. RTO is how long you can take to restore service.
2.6Which pattern has the lowest standing cost and the longest restore?
Backup and restore. Active/active costs the most and recovers the fastest.
2.7What is warm standby?
A scaled-down full copy that you scale out before shifting traffic. Pilot light keeps critical data live and starts the fleet later.
2.8What does S3 versioning retain?
The prior object when you overwrite or delete. Turn it on before the bad write. It cannot invent a version you already lost.
2.9Where does an RDS point-in-time restore land?
A new database instance. It does not overwrite the original instance in place.
2.10Which cache engine fails over?
ElastiCache for Redis with a replica. Memcached does not provide that replica failover.
Deck 3 · Deployment
Images, stacks, shifts, and the fleet you already run.
3.1What does EC2 Image Builder produce?
A tested AMI or container image from a pipeline. Do not bake a password into the recipe. Read it from Secrets Manager at runtime.
3.2What does the AWS CDK deploy through?
CloudFormation. The CDK synthesizes a template. It does not skip the stack events.
3.3What previews a stack update?
A change set. Drift detection is the later check that the live resource still matches the template.
3.4What deploys one template to many accounts and Regions?
CloudFormation StackSets. AWS RAM shares a resource such as a subnet. It does not deploy the template.
3.5What is a blue/green shift?
The old copy keeps serving until you move traffic, so rollback moves it back. A canary sends a small share first.
3.6What should a failed rolling batch do?
Stop, and leave the remaining old tasks in service. Continuing until the old tasks are gone removes the rollback.
3.7What is Session Manager?
A shell through the Systems Manager agent and IAM. It does not need port 22 or an SSH key.
3.8What reapplies a file if an operator deletes it?
A State Manager association. One Run Command does not notice a later deletion.
3.9What does version 1.1 add beside Lambda and EventBridge for event-driven automation?
AWS DevOps Agent. S3 event notifications remain the way an object creation starts work.
3.10Which third-party tools does the exam guide name for deployment automation?
Terraform and Git. Run a plan and review the diff before you apply. Designing a pipeline from scratch is out of scope.
Deck 4 · Security
Ceilings, findings, encryption, and secrets.
4.1What does a service control policy do?
It sets the maximum permissions for member accounts. It does not grant access, and it does not constrain the management account the way it constrains members.
4.2What has to allow a cross-account read?
The bucket policy and the caller's IAM policy. An allow on only one side is a deny.
4.3Which condition key requires MFA?
aws:MultiFactorAuthPresent. A cost-allocation tag does not prove the caller used a second factor.
4.4What remediates a Trusted Advisor finding for port 22 open to the world?
Close the rule and use Session Manager or a tighter source. Turning off CloudTrail hides the evidence. It does not close the port.
4.5What blocks a Region before the resource exists?
An SCP deny on the Region. A Config rule reports the resource after it exists.
4.6How do you encrypt an existing unencrypted EBS volume?
Copy an encrypted snapshot and create a new volume. There is no in-place encryption toggle on the original volume.
4.7Where must an ACM certificate live for a Regional load balancer?
In the same Region as the load balancer. CloudFront is the service that wants the certificate in us-east-1.
4.8Where do you store a database password that must rotate?
AWS Secrets Manager. An AMI and a public object freeze or expose the password.
4.9Which service finds a vulnerable package on an instance?
Amazon Inspector. Amazon Macie finds sensitive data in S3. Amazon GuardDuty finds threats such as unusual API activity.
4.10Which tool does version 1.1 add beside Security Hub and GuardDuty for remediating findings?
AWS Security Agent. Deleting the detector is not remediation.
Deck 5 · Networking
Routes, DNS, delivery, and the log that shows the drop.
5.1What makes a subnet public?
A route to an internet gateway. A NAT gateway is how a private subnet reaches the internet without public addresses on the instances.
5.2Why must a network ACL allow ephemeral ports?
It is stateless. A security group is stateful, so return traffic is allowed after the request.
5.3How do private instances reach S3 without NAT charges?
A gateway VPC endpoint. An interface endpoint is a different ENI and has an hourly charge.
5.4What is true of VPC peering?
Both route tables need a route, and the CIDRs cannot overlap. Peering is not transitive.
5.5Which hub connects many VPCs?
AWS Transit Gateway. A RAM share makes it available. You still need an attachment and routes.
5.6Which in-scope tunnel connects a site?
AWS Site-to-Site VPN. Client VPN is for users. Direct Connect is not on the SOA-C03 in-scope list.
5.7What does a failover record need?
A health check on the primary. Equal weighted records split traffic. They do not fail over by themselves.
5.8When do you choose Global Accelerator instead of CloudFront?
Non-HTTP traffic that needs static anycast addresses. CloudFront caches HTTP. It is not that TCP path.
5.9A private bucket behind CloudFront returns 403. What do you add?
Origin access control and a bucket policy that allows the distribution. A public-read ACL is the exposure you were avoiding.
5.10Flow Logs show REJECT to an interface endpoint. What do you change?
The endpoint security group, so the clients can use port 443. Adding a public IP abandons the private path.
Memory notes
Groupings that make the highest-yield SOA-C03 distinctions easier to recall.
Loss versus downtime
RPO is data you can lose. RTO is time you can be down. Multi-AZ is a same-Region failover. A Regional disaster needs backup and restore, pilot light, warm standby, or active/active.
Preview, slice, shift back
- Change set the preview
- Canary a small share first
- Blue/green keep the old copy and move traffic
- Rollback move the pointer back
Allow versus ceiling
IAM can allow. An SCP can only limit member accounts. Both sides must allow a cross-account read. A finding is open until you remediate it.
Route, ACL, group, log
Check the route first. Then the stateless network ACL, including ephemeral ports. Then the stateful security group. Flow Logs confirm the REJECT. Do not open the world to test the path.
Cache versus anycast
CloudFront caches HTTP. Global Accelerator gives static anycast addresses for TCP and UDP. A gateway endpoint takes S3 off a NAT gateway. An interface endpoint is a paid ENI.
Continue the AWS CloudOps study path
Test what you have learned with a timed practice exam.
Overview
Exam format, the 720 passing score, domain weights, and a study plan.
Core Notes
Reference notes for monitoring, resilience, automation, security, and networking.
Flashcards & Memory Notes
50 recall cards in five decks, plus memory notes for alarms, recovery, guardrails, and routes.
Practice Exams
200 original questions with custom exams, explanations, and a score report by domain.
Related Tools
Useful companions while you study.
JSON YAML Converter
Convert structured data between JSON and YAML with formatting and validation.
Base64 Converter
Encode text and files to Base64 or decode Base64 data with UTF-8 support.
Diff Checker
Compare two text blocks and highlight added, removed, and changed content.
CSV JSON Converter
Convert CSV spreadsheet data to JSON or turn JSON arrays into downloadable CSV files.
Legal Disclaimer
Certicab provides general informational, educational, and convenience resources. Calculations, conversions, estimates, and learning materials may contain errors or become outdated. Financial, tax, medical, legal, and travel information is not professional advice. Verify important results and current requirements with qualified professionals or authoritative sources. Protect sensitive files and personal information, review each tool’s privacy limitations, and use only content you are authorized to process. You are responsible for how you use and share results. Study resources are independent and do not guarantee exam success or imply certification-provider endorsement. Amazon Web Services, AWS, and related marks are trademarks of Amazon.com, Inc. or its affiliates. Certicab is not affiliated with, endorsed by, or sponsored by Amazon.