Study guide · Exam overview
The format, passing score, and five content domains of the AWS Certified CloudOps Engineer – Associate exam, plus the operational choices worth practicing before you book SOA-C03.
Exam version notice: This overview follows the AWS Certified CloudOps Engineer – Associate Exam Guide (SOA-C03), version 1.1, published June 1, 2026. SOA-C03 replaced the SysOps Administrator – Associate exam (SOA-C02). SOA-C02 was in use through September 29, 2025, and SOA-C03 began on September 30, 2025. The credential name CloudOps Engineer applies when you pass SOA-C03. Domain weights are 22%, 22%, 22%, 16%, and 18%. The separate cost domain from SOA-C02 moved into performance optimization. Pricing, languages, and delivery options can change. Confirm them on the AWS certification site before you register. Items tagged Extra are useful context the guide places out of scope. If core service names are still new, start with the Cloud Practitioner overview.
SOA-C03 checks whether you can deploy, manage, and operate workloads on AWS. The exam guide describes the target candidate as a CloudOps engineer with at least one year of experience in deployment, management, troubleshooting, networking, and security, plus at least one year in a related operations role such as system administrator. The work is to keep a workload healthy, recover it, release changes without a big-bang outage, enforce the controls you were given, and explain a network path that failed.
A question usually gives a constraint: an alarm that pages on every blip, a database that must fail over inside the Region, a stack that must be previewed before it changes production, a member account that must stay inside two Regions, or a private subnet that cannot reach a peered VPC. Two options often both exist as real services. The better answer is the one that meets the constraint with the control the stem named. Read the noun the stem cares about: the metric, the recovery objective, the deployment, the permission ceiling, or the hop that rejected the packet.
The target candidate is not expected to design distributed architectures, design CI/CD pipelines, design hybrid and multi-VPC networks, develop software, define security and compliance requirements, develop a ransomware strategy, assess capacity, analyze total cost of ownership, or manage billing. You are expected to operate the stack you were given. Architecture-wide design questions belong on the Solutions Architect path. Application code belongs on the Developer path.
Figures below come from the AWS certification page and the SOA-C03 exam guide, version 1.1, reviewed in October 2026.
| Specification | SOA-C03 |
|---|---|
| Level | Associate. There is no required prerequisite certification. |
| Number of questions | 65. Fifty affect your score. Fifteen are unscored and are not identified on the exam. |
| Question types | Multiple choice (one correct answer and three distractors) and multiple response (two or more correct answers out of five or more options). |
| Length of test | 130 minutes. AWS offers an additional 30 minutes for eligible non-native English speakers who request the ESL accommodation before they register. |
| Passing score | 720 on a scaled range of 100–1,000. Scoring is compensatory: you pass the exam as a whole, not each domain. |
| Recommended experience | About 1 year deploying, managing, troubleshooting, networking, and securing workloads on AWS, plus at least 1 year in a related operations role. |
| Exam price | Associate exams are listed at 150 USD. Taxes and local-currency prices can differ. Confirm the current fee before you book. |
| Delivery | Pearson VUE, at a test center or with online proctoring. Languages listed by AWS include English, Japanese, Korean, and Simplified Chinese. AWS says the Korean and Simplified Chinese versions retire after November 19, 2026. |
| Validity | Three years. Recertify by passing the latest version of this exam, or by earning AWS Certified DevOps Engineer – Professional. |
Unanswered questions are scored as incorrect. There is no penalty for guessing, so answer every question. A scaled score of 720 is not the same thing as 72 percent of the questions. The exam uses official short names, and the in-exam Help lists the matching full service names.
These percentages are the share of scored content in exam guide version 1.1. The 200 practice questions on this site follow the same weights.
See the fault, then change the resource the metric names.
Scale the healthy path, and pick a recovery pattern that matches the objective.
Preview the change, keep the previous copy, and automate the fleet you have.
Limit what a member account can do, then remediate the finding.
Name the hop that dropped the packet before you open everything.
Learn the in-scope services from exam guide version 1.1. The same map is in the core notes and flashcards.
| Operational need | Prefer | Remember |
|---|---|---|
| Who called an API | AWS CloudTrail | CloudWatch is the metric. Flow Logs are accept or reject. Config is the resource configuration. |
| Memory or disk on an instance | The CloudWatch agent | Default EC2 metrics do not include operating-system memory. Version 1.1 also names the agent for ECS and EKS. |
| Page only when two alarms are both bad | A composite alarm and Amazon SNS | SNS fans the notification out. SES is not the alarm action. |
| Run a documented fix | Systems Manager Automation | EventBridge routes the event. Version 1.1 also names Kiro and AWS DevOps Agent for remediation. |
| Automatic database failover in one Region | Multi-AZ | A read replica scales reads. It is not the synchronous standby. Multi-AZ does not cover a Regional outage. |
| A 15-minute RPO | Point-in-time restore, not a nightly snapshot | RPO is data loss. RTO is downtime. Nightly snapshots miss a 15-minute RPO. |
| The same stack in many accounts | CloudFormation StackSets | A change set previews one update. RAM shares a subnet or Transit Gateway. It does not deploy the template. |
| A shell with no inbound SSH | Session Manager | Opening port 22 to the world is the Trusted Advisor finding you remediate, not the access path. |
| A ceiling on a member account | A service control policy | An SCP does not grant permission, and it does not constrain the management account the way it constrains members. |
| TLS on a load balancer | AWS Certificate Manager | The certificate must be in the load balancer's Region. CloudFront certificates come from us-east-1. |
| Private reach to S3 | A gateway VPC endpoint | It avoids NAT data-processing charges. An interface endpoint is a different, hourly-priced ENI. |
| Fixed IPs for non-HTTP traffic | AWS Global Accelerator | CloudFront caches HTTP. It is the wrong tool when the listener is raw TCP and the client needs a static address. |
| Extra Design the network or the pipeline | Leave the design to the architect path | Using a route, a canary, or an existing pipeline is in scope. Designing the network or creating the pipeline from scratch is not. |
| Extra S3 static website hosting | Do not treat it as a current SOA-C03 task | The comparison in the exam guide says this content was removed from SOA-C03. |
| Extra Billing, TCO, and capacity planning | Leave the study to finance and architecture | Savings Plans, Cost Explorer, and Compute Optimizer are in scope for operational choices. Managing invoices and analyzing total cost of ownership are out of scope. |
Multiple choice has one correct response and three distractors. Multiple response has two or more correct responses out of five or more options. The stem tells you how many to choose. Select every response that completes the statement, and nothing extra.
Distractors are real services that solve a nearby problem. If the need is “who called the API,” CloudWatch is the nearby wrong answer because it graphs a metric. If the need is “fail over inside the Region,” a read replica is the nearby wrong answer because it is not the synchronous standby. If the need is “private outbound IPv4,” an internet gateway on that subnet is the nearby wrong answer because it makes the subnet public.
Words such as MOST, BEST, and LEAST are the constraint. MOST cost-effective still has to meet the recovery number in the stem. LEAST operational overhead usually means a managed service. There is no published penalty for a wrong guess. A blank answer is incorrect.
A practical sequence once you can already find a metric and a route table.
Say whether you need the API caller, a metric, a log line, or an accept/reject. The service follows that sentence.
Write the RPO and RTO before you pick backup and restore, pilot light, warm standby, or active/active. Keep Multi-AZ in the availability column, not the Regional-disaster column.
Change set or Terraform plan, then a canary or blue/green shift. Roll back by moving traffic, not by editing the live resource by hand.
IAM allows. An SCP denies. A finding from GuardDuty, Inspector, Macie, or Config is not closed until you remediate it.
Route, stateless network ACL, stateful security group, then the flow log. Do not open the world because the first guess failed.
Use the five flashcard decks, then the original questions at about two minutes each. Review every explanation and return to domains below 75 percent. Aim for a steady 85 percent before you book.
The overview, core notes, flashcards, and practice exams are all published.
Exam format, the 720 passing score, domain weights, and a study plan.
Reference notes for monitoring, resilience, automation, security, and networking.
50 recall cards in five decks, plus memory notes for alarms, recovery, guardrails, and routes.
200 original questions with custom exams, explanations, and a score report by domain.
The current exam is SOA-C03, AWS Certified CloudOps Engineer – Associate. It replaced AWS Certified SysOps Administrator – Associate (SOA-C02) on September 30, 2025. SOA-C02 was available through September 29, 2025. This overview follows exam guide version 1.1, published June 1, 2026. Confirm the code on the AWS certification page before you book.
Results use a scaled score from 100 to 1,000. The minimum passing score is 720. You do not need a passing score in every domain. A scaled score is not the percentage of questions you answered correctly.
The exam has 65 questions and a 130-minute time limit. Fifty questions affect your score. Fifteen are unscored and are not labeled. Question types are multiple choice and multiple response.
There is no required prerequisite certification. AWS describes the candidate as someone with about one year of experience deploying, managing, and operating workloads on AWS. If you have no IT experience, AWS recommends AWS Certified Cloud Practitioner first.
The new name applies to people who pass SOA-C03. A SysOps Administrator – Associate credential you already hold keeps that name and stays valid for three years from the date you earned it. You are not required to take SOA-C03 to keep it. Passing the latest AWS Certified DevOps Engineer – Professional exam can recertify the Associate credential.
This certification is valid for three years. You can recertify by passing the latest version of this exam, or by earning AWS Certified DevOps Engineer – Professional. Confirm the current policy with AWS before your expiration date.
No. The practice questions on this site are original. They are not AWS exam items, and a practice score does not predict a result.
Service names and prices change. Use the current AWS exam guide and the AWS certification site as the authority when they differ from these notes.
Useful companions while you study.
Convert structured data between JSON and YAML with formatting and validation.
Encode text and files to Base64 or decode Base64 data with UTF-8 support.
Compare two text blocks and highlight added, removed, and changed content.
Convert CSV spreadsheet data to JSON or turn JSON arrays into downloadable CSV files.
Exam versions, objectives, prices, languages, and retirement dates can change. Verify the details on the AWS certification page before you register.
Certicab provides general informational, educational, and convenience resources. Calculations, conversions, estimates, and learning materials may contain errors or become outdated. Financial, tax, medical, legal, and travel information is not professional advice. Verify important results and current requirements with qualified professionals or authoritative sources. Protect sensitive files and personal information, review each tool’s privacy limitations, and use only content you are authorized to process. You are responsible for how you use and share results. Study resources are independent and do not guarantee exam success or imply certification-provider endorsement. Amazon Web Services, AWS, and related marks are trademarks of Amazon.com, Inc. or its affiliates. Certicab is not affiliated with, endorsed by, or sponsored by Amazon.
Certi