SOA-C03

Exam Code: SOA-C03  |  Duration: 130 minutes  |  Questions: 65  |  Passing Score: 720/1000 (~72%)

Format: Multiple choice (1 correct out of 4) and multiple response (2+ correct out of 5) — includes exam labs

Cost: $150 USD  |  Validity: 3 years  |  Delivery: Pearson VUE (testing center or online proctored)

Domain Weights:

Study Tips:

• Hands-on labs matter — SOA-C03 includes exam labs; practice CLI and console operations
• Systems Manager is critical — Know SSM Agent, Run Command, Patch Manager, Parameter Store, Automation
• CloudWatch depth — Metrics, alarms, dashboards, Logs Insights, composite alarms, anomaly detection
• Multi-AZ vs Multi-Region — Know when to use each for HA and DR scenarios
• Cost optimization — Right-sizing, Reserved Instances, Savings Plans, S3 lifecycle policies

Question Strategy Tips:

• Time per question — ~2 minutes each (130 min / 65 questions), budget extra time for labs
• Unscored questions — 15 of the 65 are unscored pilot questions; you won\'t know which
• No penalty for guessing — Always answer every question
• Keywords to watch for — "least operational overhead," "most cost-effective," "automate," "remediate"
• Scenario-based — Most questions describe a real-world ops scenario and ask for the best solution

CloudWatch Key Limits & Features:

Remember: EC2 does NOT natively report memory or disk usage metrics. Use CloudWatch Unified Agent or custom metrics.

CloudTrail Event Types:

Key: CloudTrail logs are delivered to S3 within ~15 minutes. For real-time, send to CloudWatch Logs or EventBridge.

EventBridge vs CloudWatch Events:

• EventBridge — The evolution of CloudWatch Events; same underlying service and API
• Custom event buses — EventBridge supports custom and partner event buses (CloudWatch Events does not)
• Schema registry — EventBridge has schema discovery and code binding generation
• Archive & replay — EventBridge can archive events and replay them for debugging
• Cross-account events — Send events between accounts via event bus policies
• Rule targets — 100+ supported targets including Lambda, SQS, SNS, Step Functions, SSM Automation

Systems Manager (SSM) Capabilities:

Prerequisite: SSM Agent must be installed and running. IAM instance profile needs AmazonSSMManagedInstanceCore policy.

AWS Config Rules & Remediation:

• AWS Config — Records configuration changes to AWS resources over time
• Managed rules — Pre-built rules (e.g., s3-bucket-versioning-enabled, ec2-instance-no-public-ip)
• Custom rules — Lambda-based or Guard policy rules for custom compliance checks
• Auto remediation — Attach SSM Automation documents to non-compliant resources for auto-fix
• Manual remediation — Trigger remediation manually from Config console
• Conformance packs — Collection of Config rules and remediation actions as a single entity
• Aggregator — Multi-account, multi-region view of compliance data
• Configuration timeline — View history of configuration changes for any recorded resource

CloudWatch Logs Insights Query Patterns:

Performance Optimization Checklist:

• Enable detailed monitoring — 1-minute intervals for EC2 instances (vs 5-min basic)
• Use CloudWatch Unified Agent — Collect memory, disk, swap metrics not available natively
• Set up composite alarms — Reduce alert fatigue by combining related alarms
• Enable VPC Flow Logs — Troubleshoot network connectivity and security issues
• Centralize logs — Use CloudWatch Logs with cross-account subscriptions
• Use metric filters — Extract custom metrics from log data for alerting
• Config + SSM Automation — Auto-remediate non-compliant resources

DR Strategies Comparison:

Key: RTO = Recovery Time Objective (max downtime). RPO = Recovery Point Objective (max data loss). Lower RTO/RPO = higher cost.

Auto Scaling Policy Types:

Auto Scaling Key Concepts:

• Launch Template — Defines AMI, instance type, key pair, security groups, user data (preferred over Launch Config)
• Cooldown period — Default 300 seconds; prevents rapid scale in/out oscillation
• Warm pools — Pre-initialized stopped instances for faster scale-out
• Instance refresh — Rolling replacement of instances when launch template changes
• Lifecycle hooks — Pause instances in Pending:Wait or Terminating:Wait for custom actions
• Health check grace period — Time after launch before health checks start (default 300s)
• Termination policies — OldestInstance, NewestInstance, OldestLaunchConfiguration, ClosestToNextBillingHour, Default

RDS High Availability Options:

AWS Backup Key Features:

• Centralized backup — Single place to manage backups for EC2, EBS, RDS, DynamoDB, EFS, S3, FSx
• Backup plans — Define frequency, retention, lifecycle (cold storage transition)
• Backup vault — Storage container for backups; supports vault lock for WORM compliance
• Cross-region backup — Copy backups to another region for DR
• Cross-account backup — Share backups across AWS accounts via AWS Organizations
• Backup Audit Manager — Monitor backup compliance with frameworks
• Point-in-time recovery — Supported for RDS, Aurora, DynamoDB

Route 53 Health Check Types:

Key: Route 53 health checks operate from multiple global locations. An endpoint is healthy when ≥18% of health checkers report healthy.

Key Reliability Patterns:

• Multi-AZ deployments — Spread resources across AZs for fault tolerance within a region
• Auto Scaling — Automatically adjust capacity to maintain steady performance
• Elastic Load Balancing — Distribute traffic across healthy targets; automatic health checks
• S3 cross-region replication — Replicate objects to another region for DR or compliance
• DynamoDB global tables — Multi-region, multi-active tables with sub-second replication
• RDS automated backups — Daily snapshots + transaction logs; PITR within retention window (up to 35 days)
• Chaos engineering — Use AWS Fault Injection Simulator (FIS) to test resilience
• Decoupling — Use SQS, SNS, EventBridge to decouple components and handle failures gracefully

CloudFormation vs CDK vs Elastic Beanstalk:

Deployment Strategies Comparison:

CI/CD Pipeline Components:

Key CloudFormation Template Sections:

• AWSTemplateFormatVersion — Always "2010-09-09"
• Parameters — Input values at stack creation (AllowedValues, Default, Type constraints)
• Mappings — Static lookup tables (e.g., region → AMI)
• Conditions — Conditional resource creation (e.g., if env=prod)
• Resources — REQUIRED. The only mandatory section. Defines AWS resources
• Outputs — Return values; export for cross-stack references via !ImportValue
• Transform — Include macros (e.g., AWS::Serverless, AWS::Include)

CloudFormation Key Features for Ops:

• Stack sets — Deploy stacks across multiple accounts and regions from a single template
• Change sets — Preview changes before applying an update to a stack
• Drift detection — Detect resources that have been modified outside of CloudFormation
• Stack policies — Protect critical resources from unintentional updates
• DeletionPolicy — Retain, Snapshot, or Delete resources when stack is deleted
• UpdateReplacePolicy — Control behavior when resource must be replaced during update
• cfn-init — Install packages, write files, start services on EC2 during creation
• cfn-signal — Signal CloudFormation that instance setup is complete (used with WaitCondition/CreationPolicy)

EC2 Image Builder Pipeline:

• Image recipe — Base image + build components (install software, configure OS)
• Build components — YAML documents defining build/test/validate steps
• Infrastructure configuration — Instance type, VPC, security groups for build instances
• Distribution settings — Target regions and accounts for the output AMI
• Pipeline — Schedule or event-driven; orchestrates build, test, distribute
• Test components — Validate the image before distribution (reboot test, custom tests)

Systems Manager Automation Key Concepts:

• Runbooks — YAML/JSON documents defining automation steps (AWS-managed or custom)
• Common runbooks — AWS-RestartEC2Instance, AWS-StopEC2Instance, AWS-CreateSnapshot, AWS-ConfigureS3BucketVersioning
• Approval steps — Pause automation for manual approval before proceeding
• Rate control — Execute against multiple targets with concurrency and error thresholds
• EventBridge trigger — Start automation in response to events (e.g., Config non-compliance)
• Maintenance windows — Schedule automation during specific time windows

IAM Policy Evaluation Flow:

• Step 1: All requests start as implicitly denied
• Step 2: Evaluate all applicable policies (identity-based, resource-based, SCPs, permission boundaries, session policies)
• Step 3: Check for explicit DENY — if found, request is denied (always wins)
• Step 4: Check SCP (Organizations) — must allow the action
• Step 5: Check resource-based policies — if allows, request proceeds (cross-account: must be explicitly allowed by both)
• Step 6: Check permission boundaries — must allow the action
• Step 7: Check identity-based policies — must have explicit ALLOW
• Step 8: If no explicit ALLOW found, request is implicitly denied

Remember: Explicit Deny > SCP > Resource-Based Policy > Permission Boundary > Identity-Based Policy > Implicit Deny

KMS Key Types Comparison:

KMS Key Concepts:

• Envelope encryption — KMS generates data key; data key encrypts data; KMS encrypts data key
• GenerateDataKey API — Returns plaintext + encrypted data key for client-side encryption
• 4 KB limit — KMS Encrypt API can only directly encrypt up to 4 KB; use envelope encryption for larger
• Key policy — Resource-based policy required for all KMS keys; must explicitly allow key usage
• Grants — Temporary, fine-grained permissions for KMS keys; used by AWS services
• Multi-Region keys — Replicate keys across regions with same key material; useful for cross-region encryption

Security Services Comparison:

Encryption at Rest vs In Transit:

IAM Best Practices Checklist:

• Lock away root account — Enable MFA; do not use root for daily tasks
• Create individual IAM users — Never share credentials; use groups for permissions
• Grant least privilege — Start with minimum permissions; add as needed
• Use IAM roles — For EC2, Lambda, ECS tasks; avoid embedding access keys
• Rotate credentials — Enforce password policies; rotate access keys regularly
• Enable MFA — For all users, especially privileged accounts
• Use permission boundaries — Delegate admin tasks while limiting maximum permissions
• Use SCPs with Organizations — Apply guardrails across all accounts
• Review with Access Analyzer — Identify resources shared externally; validate policies
• Monitor with CloudTrail — Audit all API calls; send to CloudWatch for alerting

VPC Connectivity Options:

Security Groups vs NACLs:

Key: Security groups are the primary line of defense. Use NACLs for subnet-wide blocking (e.g., block a specific IP).

Route 53 Routing Policies:

CloudFront vs Global Accelerator:

VPC Endpoint Types:

Key: S3 supports both Gateway (free, route-table based) and Interface (cost, DNS-based) endpoints. Gateway is preferred for most use cases.

Elastic Load Balancer Types:

Networking Troubleshooting Checklist:

• Cannot connect to EC2 — Check security group inbound rules, NACL rules, route table, Internet Gateway, public IP
• Timeout errors — Usually security group or NACL issue (not application error; that gives connection refused)
• Cannot reach internet from private subnet — Check NAT Gateway in public subnet, route table 0.0.0.0/0 → NAT GW
• VPC peering not working — Check route tables on BOTH sides; verify no overlapping CIDRs; ensure peering is accepted
• DNS resolution failing — Enable DNS hostnames and DNS resolution in VPC settings
• Private endpoint not resolving — Enable Private DNS on interface endpoint; verify DNS settings
• Cross-AZ costs — Data transfer between AZs costs money; keep resources in same AZ when possible
• VPC Flow Logs — Enable flow logs to diagnose ACCEPT/REJECT at ENI, subnet, or VPC level