Training course

This is a free, self-paced reading course for SOA-C03: AWS Certified CloudOps Engineer – Associate, the current version of AWS’s associate-level operations credential, which replaced the AWS Certified SysOps Administrator – Associate (SOA-C02) on September 30, 2025. The rename was not cosmetic. SOA-C03 expects less traditional systems administration and more automation-driven operations across accounts, Regions, and container platforms, and this course is written against that newer shape rather than the older SysOps one.

The course is organized as one module per official exam domain, in the order AWS publishes them in the exam guide, and each module carries that domain’s published weight. That matters more here than on most exams because SOA-C03 is unusually flat: three of the five domains sit at 22% each, so there is no single area you can lean on to carry a score. Reading in domain order and in domain proportion keeps you from over-investing in the monitoring material at the expense of deployment automation or networking. Every lesson closes with its key terms and suggested further reading, so the course stays useful as a reference after the first pass.

SOA-C03 Associate level 5 modules Domain-weighted Self-paced Free account

What the course covers

Monitoring, Logging, Analysis, Remediation, and Performance Optimization

Module 1 · 22%

CloudWatch metrics, logs, alarms, dashboards, and the CloudWatch agent across EC2, ECS, and EKS; routing events with EventBridge and driving automated remediation through Systems Manager Automation runbooks; and performance analysis for compute, EBS, S3, EFS and FSx, and RDS. This domain absorbed the separate cost and performance optimization domain that SOA-C02 carried, so right-sizing, workload metrics, and remediation playbooks all land here.

Reliability and Business Continuity

Module 2 · 22%

Scaling with EC2 Auto Scaling, ECS and EKS scaling, and managed database scaling across RDS, DynamoDB, ElastiCache, and CloudFront; building highly available architectures with Multi-AZ deployments and ELB and Route 53 health checks; and backup and restore strategy with AWS Backup, point-in-time restore, and versioning. The module works through the four standard disaster recovery patterns (backup and restore, pilot light, warm standby, and active/active) against stated RTO and RPO requirements, because the exam almost always frames the choice that way.

Deployment, Provisioning, and Automation

Module 3 · 22%

Provisioning with CloudFormation, the AWS CDK, StackSets, and EC2 Image Builder; shipping container images through ECR and managing golden AMIs; and automating operations with Systems Manager Automation, Maintenance Windows, Run Command, and Patch Manager alongside event-driven workflows built on EventBridge, Lambda, and S3 Event Notifications. Third-party tooling, Terraform and Git, is explicitly in scope. This is the clearest new emphasis in SOA-C03 relative to the older SysOps exam, so it is the module to read carefully if you are coming from SOA-C02 material.

Security and Compliance

Module 4 · 16%

IAM policies, roles, federation, MFA, resource policies, and conditions; auditing access with CloudTrail and IAM Access Analyzer; and multi-account control through AWS Organizations, service control policies, and IAM Identity Center. The module also covers data protection with KMS, ACM, and Secrets Manager, and continuous compliance monitoring with AWS Config and its conformance packs, Security Hub, GuardDuty, and Inspector.

Networking and Content Delivery

Module 5 · 18%

VPC construction (subnets, route tables, network ACLs, security groups, NAT and internet gateways) and private connectivity through VPC endpoints, PrivateLink, peering, and Transit Gateway; the network protection stack of WAF, Shield, Network Firewall, and Route 53 Resolver DNS Firewall; Route 53 routing policies and content delivery with CloudFront and Global Accelerator; and troubleshooting with VPC flow logs, ELB access logs, and Reachability Analyzer.

How to use it

Read the modules in order and build as you go. SOA-C03 is an operations exam, and the questions are written for someone who has already watched an alarm fire, chased it through a log group, and fixed the thing on the other end, so if you have never wired a CloudWatch alarm to an EventBridge rule to a Systems Manager runbook, or deployed the same CloudFormation stack into three accounts with StackSets, do that in a sandbox account alongside the reading. AWS’s own target candidate has about a year of hands-on AWS operations experience plus at least a year in a related on-premises operations role; the course is written to fill the AWS half of that, not to replace the hands-on half. The course modules themselves open once you are signed in to a free Certifym account.

For exam logistics (the item count, the 130-minute window, the 720-of-1000 scaled cut score, registration cost, and how long the credential stays valid) see the SOA-C03 certification guide. If the deployment and automation module is where you feel thinnest, the DOP-C02 training course covers the same CloudFormation, CDK, and pipeline material at professional depth and is worth reading against.

SOA-C03: AWS Certified CloudOps Engineer - Associate

One module per SOA-C03 exam domain, weighted the way AWS weights them.

A self-paced reading course for SOA-C03: AWS Certified CloudOps Engineer – Associate, the current version of AWS's associate-level operations credential. It replaced the AWS Certified SysOps Administrator – Associate (SOA-C02) on September 30, 2025, and the rename tracks a real change in the role: less traditional systems administration, more automation-driven operations across accounts, Regions, and container platforms.

The course is organized as one module per official exam domain, in the order AWS publishes them, and each module carries that domain's published weight. You work through monitoring and remediation with CloudWatch, EventBridge, and Systems Manager; reliability and business continuity from Auto Scaling through disaster recovery patterns; deployment and provisioning with CloudFormation, StackSets, the AWS CDK, and Image Builder; security and compliance from IAM policy evaluation to AWS Config and Security Hub; and networking from VPC design to CloudFront, Route 53, and packet-level troubleshooting. Every lesson ends with its key terms and further reading, so the material works as a reference after the first pass as well as a syllabus during it.

The course assumes you are comfortable with servers, networking, and monitoring in general terms. It does not assume you have already operated a multi-account AWS estate. Pair it with a sandbox account and build what you read about — SOA-C03 measures applied operational judgment, not service-name recall. Certifym is an independent study publisher and is not affiliated with, endorsed by, or sponsored by Amazon Web Services, Inc.

Module 1: Monitoring, Logging, Analysis, Remediation, and Performance Optimization 22% of exam

The largest single block of SOA-C03 work, and the one every other domain leans on. You start with the shape of the CloudWatch data plane — metrics, logs, and events as three separate stores with three separate query surfaces — then work through namespaces and dimensions, the CloudWatch agent, log groups and retention, metric filters, Logs Insights, and the full alarm model including composite alarms and anomaly detection.The second half is what operations actually does with that telemetry. You route signals with EventBridge, close the loop with Systems Manager Automation runbooks so remediation happens without a human, and then analyze performance across the tiers the exam asks about: EC2 and Auto Scaling, Lambda, EBS volume types and burst credits, S3 request patterns, EFS and FSx throughput modes, and RDS through Performance Insights. This domain absorbed the separate cost and performance optimization domain that SOA-C02 carried, so right-sizing questions land here too.

1.1 The CloudOps operations model and the CloudWatch data plane 5 min Free preview
1.2 Metrics, namespaces, dimensions, statistics, and resolution 5 min 🔒
1.3 The CloudWatch agent, custom metrics, and instance-level telemetry 5 min 🔒
1.4 CloudWatch Logs: groups, streams, retention, and delivery 5 min 🔒
1.5 Logs Insights queries and metric filters 5 min 🔒
1.6 Alarms: evaluation, missing data, composite alarms, and anomaly detection 5 min 🔒
1.7 Dashboards, cross-account observability, and container monitoring 5 min 🔒
1.8 EventBridge: buses, rules, patterns, targets, and scheduling 5 min 🔒
1.9 Automated remediation with Systems Manager Automation 5 min 🔒
1.10 Compute performance analysis and right-sizing 5 min 🔒
1.11 Storage and database performance: EBS, S3, EFS, FSx, and RDS 5 min 🔒

Module 2: Reliability and Business Continuity 22% of exam

Everything in this domain is a trade between how much downtime and how much data loss a workload can absorb, and how much you are willing to pay to reduce them. You start by fixing the vocabulary — RTO, RPO, availability, failure domains — because the exam frames nearly every question in it as a requirement stated in those terms and a set of candidate designs that meet it at different cost.From there you work through elasticity: Auto Scaling groups, launch templates, lifecycle hooks, and the full set of scaling policies; load balancer types, target groups, and health checks; scaling for containers on ECS and EKS; and scaling the data tier across RDS, Aurora, DynamoDB, and ElastiCache. Then availability: Multi-AZ and multi-Region patterns, and Route 53 health checks and failover. The module closes on backup and recovery — AWS Backup plans and vault lock, snapshots, versioning, replication, point-in-time restore — and the four disaster recovery patterns matched against stated RTO and RPO targets.

2.1 Reliability vocabulary: RTO, RPO, availability, and failure domains 5 min 🔒
2.2 Auto Scaling groups, launch templates, and lifecycle hooks 5 min 🔒
2.3 Scaling policies: target tracking, step, scheduled, and predictive 5 min 🔒
2.4 Elastic Load Balancing: types, target groups, and health checks 6 min 🔒
2.5 Scaling and availability for ECS and EKS 5 min 🔒
2.6 Scaling the data tier: RDS, Aurora, DynamoDB, and ElastiCache 5 min 🔒
2.7 Multi-AZ and multi-Region high availability patterns 5 min 🔒
2.8 Route 53 health checks, failover, and DNS-based resilience 6 min 🔒
2.9 AWS Backup: plans, vaults, vault lock, and cross-account copy 5 min 🔒
2.10 Snapshots, versioning, replication, and point-in-time restore 5 min 🔒
2.11 Disaster recovery patterns matched to RTO and RPO 5 min 🔒

Module 3: Deployment, Provisioning, and Automation 22% of exam

The clearest new emphasis in SOA-C03 relative to the older SysOps exam, and the module to read carefully if you are coming from SOA-C02 material. It opens with CloudFormation in depth — template anatomy, the stack lifecycle, intrinsic functions, conditions, change sets, drift detection, stack policies, and the specific reasons a stack fails and rolls back — then extends to nested stacks, cross-stack references, and StackSets for deploying the same template across many accounts and Regions.From there the module covers the AWS CDK and the third-party tooling AWS puts explicitly in scope, Terraform and Git; golden AMI pipelines with EC2 Image Builder; container image management in ECR; and the Systems Manager automation surface — Automation, Run Command, Maintenance Windows, State Manager, Patch Manager, and Parameter Store. It closes on event-driven automation built from EventBridge, Lambda, and S3 event notifications.

3.1 CloudFormation templates, stacks, and the deployment lifecycle 6 min 🔒
3.2 Intrinsic functions, parameters, mappings, and conditions 5 min 🔒
3.3 Change sets, drift detection, stack policies, and failed deployments 6 min Free preview
3.4 Nested stacks, cross-stack references, and template modularity 5 min 🔒
3.5 StackSets for multi-account and multi-Region deployment 5 min 🔒
3.6 The AWS CDK, Terraform, and Git-based workflows 5 min 🔒
3.7 Golden AMIs and EC2 Image Builder 5 min 🔒
3.8 Container images, Amazon ECR, and image lifecycle 5 min 🔒
3.9 Systems Manager: documents, Run Command, and Maintenance Windows 5 min 🔒
3.10 Patch Manager, State Manager, and Parameter Store 5 min 🔒
3.11 Event-driven automation with EventBridge, Lambda, and S3 notifications 5 min 🔒

Module 4: Security and Compliance 16% of exam

The smaller of the five domains by weight, but the one where a wrong answer in production is least forgiving. It starts with IAM at the level SOA-C03 actually tests — not just what a policy looks like, but how the evaluation logic resolves an explicit deny, an organizational service control policy, a permissions boundary, a resource policy, and a session policy against one another.From there it covers roles, federation, and temporary credentials; resource policies and cross-account access; the multi-account control plane of AWS Organizations, service control policies, and IAM Identity Center; auditing with CloudTrail and IAM Access Analyzer; data protection with KMS, ACM, and Secrets Manager; continuous compliance with AWS Config and conformance packs; and the detection stack of Security Hub, GuardDuty, Inspector, and Macie.

4.1 IAM identities, policies, and policy evaluation logic 6 min 🔒
4.2 Roles, federation, and temporary credentials 5 min 🔒
4.3 Resource policies, permissions boundaries, and delegation 5 min 🔒
4.4 AWS Organizations, service control policies, and IAM Identity Center 5 min 🔒
4.5 CloudTrail, auditing, and access analysis 5 min 🔒
4.6 Data protection: KMS, ACM, and Secrets Manager 6 min 🔒
4.7 AWS Config, conformance packs, and automated remediation 5 min 🔒
4.8 Threat detection: Security Hub, GuardDuty, Inspector, and Macie 5 min 🔒

Module 5: Networking and Content Delivery 18% of exam

Networking is where operational problems are hardest to diagnose, because a packet that does not arrive leaves no error message. The module builds the VPC from the ground up — CIDR planning, subnets, route tables, internet and NAT gateways — then works carefully through the two firewalls that behave differently, security groups and network ACLs, since confusing stateful and stateless evaluation is the most common source of a connectivity failure.From there it covers private connectivity with VPC endpoints, PrivateLink, peering, and Transit Gateway; hybrid links over Site-to-Site VPN and Direct Connect; Route 53 hosted zones and routing; content delivery with CloudFront and Global Accelerator; the protection stack of WAF, Shield, Network Firewall, and DNS Firewall; and finally a systematic troubleshooting method built on flow logs, load balancer logs, and Reachability Analyzer.

5.1 VPC fundamentals: CIDR, subnets, route tables, and gateways 6 min 🔒
5.2 Security groups and network ACLs 5 min 🔒
5.3 IP addressing, elastic network interfaces, and Elastic IPs 6 min 🔒
5.4 VPC endpoints, PrivateLink, peering, and Transit Gateway 6 min 🔒
5.5 Hybrid connectivity: Site-to-Site VPN and Direct Connect 5 min 🔒
5.6 Route 53 hosted zones, records, and DNS operations 5 min 🔒
5.7 CloudFront and Global Accelerator 6 min 🔒
5.8 Network protection: WAF, Shield, Network Firewall, and DNS Firewall 5 min 🔒
5.9 Network troubleshooting: flow logs, access logs, and Reachability Analyzer 6 min 🔒

Frequently asked questions about the SOA-C03 training course

Is the SOA-C03 training course free?

Yes. The course costs nothing to read and opens once you are signed in to a free Certifym account, no payment and no card.

How is the course structured?

One module per official SOA-C03 exam domain, in the order AWS lists them in the exam guide, with each module weighted to the domain’s published percentage. Within a module the material is broken into short lessons, followed by key terms and further reading.

Does this replace AWS’s official training?

No. AWS publishes the exam guide and free digital courses on AWS Skill Builder, and those are the authoritative sources. This course is an independent study companion written to be read quickly and paired with practice questions, not a substitute for the official exam guide.

Do I need AWS experience before starting?

Some. AWS describes the target candidate as having roughly one year of hands-on AWS operations experience plus at least one year in a related on-premises operations role. The course assumes you understand servers, networking, and monitoring in general terms; it does not assume you have already operated a multi-account AWS estate. If AWS itself is new to you, read the CLF-C02 cloud practitioner course first.

What should I do after finishing the course?

Rebuild the scenarios rather than reread the text. Stand up an Auto Scaling group behind a load balancer, break it, and diagnose it from CloudWatch and flow logs alone; run a restore from AWS Backup and time it against a stated RPO. Working the domains as exercises is what converts the reading into the judgment the scenario questions ask for.

Is the course current with the latest SOA-C03 exam guide?

The course is built against the SOA-C03 exam guide, the version that superseded SOA-C02 on September 30, 2025, including its expanded container services, AWS CDK, multi-account governance, and observability coverage. AWS can revise an exam guide at any time; download the current guide from aws.amazon.com before you schedule.

Trademark notice & independence. Certifym.net is operated by Certifym Exam Services, LLC and is not affiliated with, endorsed by, or sponsored by Amazon Web Services, Inc. AWS, Amazon Web Services, AWS Certified CloudOps Engineer – Associate, and SysOps Administrator – Associate are trademarks of Amazon.com, Inc. or its affiliates. Use of these marks is solely to identify the certification for which these study materials are intended. The SOA-C03 exam and its domain structure are the property of Amazon Web Services, Inc.; candidates should download the official, current exam guide directly from aws.amazon.com.

All course content, questions, answers, and explanations on Certifym are original content created for study purposes. They are not actual AWS training materials or examination questions and are not represented as such. Studying with these materials does not guarantee a passing result on any live certification exam. Exam requirements, format, domain weights, pricing, and recertification policies are set by Amazon Web Services and may change; always verify current details on aws.amazon.com before scheduling your exam.