AWS Certified CloudOps Engineer - Associate

SOA reads at the operations level, not the architecture level. Expect questions like 'you receive a 5xx alarm on this ELB - which combination of CloudWatch metrics and VPC Flow Log fields confirms the root cause' rather than 'design a multi-Region failover topology'. The right answer almost always names specific AWS services or features by name; vague best-practice answers are usually distractors.

Multiple-response (multi-select) questions are part of the format - five options, pick the two or three correct. Each scored multi-response counts as a single scored opportunity, but they eat more time per question than multiple-choice. Read the stem, then read every option twice; there is no partial credit (you need every correct option and zero incorrect ones).

CloudWatch agent vs CloudWatch service is the most-tested observability gap. Agents collect host metrics (memory, disk_used_percent, custom log files) that AWS does not publish natively; the service collects only what is exposed via the AWS API. Memorise that you need CloudWatchAgentServerPolicy on the role, the unified config file goes into SSM Parameter Store, and the same agent now collects metrics from ECS task definitions and EKS Container Insights.

Auto Scaling questions cluster around three patterns. (1) Choose the right scaling type: target tracking for 'maintain average', step for 'respond to thresholds', scheduled for 'predictable load'. (2) Lifecycle hooks pause launch/terminate so you can install software or drain connections - default timeout 1 hour, max 48. (3) Instance refresh replaces instances after a launch-template change with min healthy percentage; warm pools eliminate cold start by pre-warming stopped instances.

CloudFormation troubleshooting is heavily tested. Memorise UPDATE_ROLLBACK_FAILED + ContinueUpdateRollback (skip the resources that cannot roll back, then fix them out-of-band). Know that change sets preview risk before applying. Drift detection finds resources someone modified in the console; StackSets target multiple accounts/Regions via Organizations integration or self-managed permissions. cfn-init reads metadata, cfn-signal reports back to creation/update policies, cfn-hup watches for metadata changes on a running instance.

Multi-AZ vs read replica is a near-guaranteed RDS question. Multi-AZ = synchronous standby in another AZ, automatic DNS failover (same endpoint), same instance class, no read scaling. Read replica = asynchronous, separate endpoint, can be promoted manually, can scale reads or live in another Region. Multi-AZ + read replica is a valid combo when you need both HA and read scaling. Aurora collapses this with one writer + multiple readers under a single endpoint.

NACL vs Security Group is the networking pop-quiz. NACLs = stateless, evaluated in rule-number order, allow + deny rules, attached to subnet, you must add an explicit return rule. SGs = stateful, all rules evaluated together, allow-only, attached to ENI, return traffic is automatic. If a packet reaches the instance but the response never gets back, suspect a missing NACL return rule or an ephemeral-port-range mismatch (1024-65535).

Route 53 routing policies map cleanly to scenarios. Failover = active-passive HA with health-check evaluation. Latency = lowest RTT to a target. Weighted = blue/green or A/B traffic split with integer weights. Geolocation = route by user country/continent for compliance or locale. Multivalue = up to eight randomized health-checked answers (poor-man's load balancing). Geoproximity (with optional bias) needs Traffic Flow.

SOA-C03 dropped the three hands-on exam labs that SOA-C02 used - the full 130 minutes is now multiple-choice / multiple-response only. The breadth of services you must know widened in exchange: containers (ECS, EKS, ECR) are now explicitly in scope (CloudWatch Container Insights, ECS service auto scaling, EKS managed node groups + Fargate, ECR lifecycle policies), and the old 'Cost & Performance Optimization' domain folded into Domain 1.

Time budget: 65 questions in 130 minutes is exactly 2 minutes each. Multi-response and scenario stems with embedded YAML/JSON eat 3-4 minutes; pure 'which service does X' questions take 30 seconds. Sweep in two passes - bank the easy service-knowledge questions, flag long scenarios for a second pass. The 15 unscored questions are randomly mixed in and you cannot identify them, so answer every question.