SOA-C03 Cheat Sheet: CloudOps Engineer Associate Quick Reference

SOA-C03 is the renamed SysOps Administrator exam — it tests operating AWS in production: metrics, alarms, remediation, backup/restore, and safe deployments. This sheet compresses the highest-frequency operational facts.

CloudWatch essentials

• Default EC2 metrics: CPU, network, disk I/O, status checks — every 5 min (1 min with detailed monitoring)
• Memory and disk usage need the CloudWatch agent (or Systems Manager + unified agent config)
• Alarms states: OK / ALARM / INSUFFICIENT_DATA; actions: SNS, Auto Scaling, EC2 recover/reboot
• Logs Insights queries log groups; Contributor Insights finds top talkers
• EventBridge matches events/schedules → targets (SNS, Lambda, SSM Automation)

Remediation patterns

• Config rule + EventBridge + SSM Automation = detect → auto-remediate (e.g., public S3 bucket → make private)
• CloudWatch alarm → SSM runbook for instance remediation
• SSM Session Manager = shell access without SSH keys, bastion, or port 22
• Patch Manager = patch baselines + maintenance windows + compliance reporting

Backup & reliability

• AWS Backup: central policies for EBS/RDS/DynamoDB/EFS/S3, cross-account + cross-region copies, Vault Lock (WORM)
• DR options cheapest→strongest: Backup & Restore → Pilot Light → Warm Standby → Multi-site Active-Active
• RPO = data loss tolerance; RTO = downtime tolerance — always check which the question optimizes
• ELB health checks vs ASG: use ELB health check type so failed instances get replaced

Deployment & provisioning

• CloudFormation: change sets preview changes; drift detection finds out-of-band changes; StackSets deploy across accounts/regions
• SSM documents/Automation: runbooks for ops tasks; State Manager = desired-state enforcement
• OpsWorks/Puppet/Chef are legacy — favor Systems Manager answers
• Elastic Beanstalk deployment options: all-at-once, rolling, rolling+additional batch, immutable, blue/green

Security & compliance

• CloudTrail = API audit (management + data events); enable org trail for all accounts
• Config = resource configuration history + compliance rules
• GuardDuty = threat detection; Security Hub = findings aggregator; Inspector = vulnerability scanning
• SSM Parameter Store vs Secrets Manager: free vs rotation + cross-service integration

Networking & content delivery

• ALB = Layer 7 host/path routing; NLB = Layer 4, static IP, ultra-low latency
• CloudFront = CDN caching at edge; signed URLs/cookies for private content; OAI/OAC for S3 origin access
• Route 53 routing: simple, weighted, latency, failover, geolocation, geoproximity, multivalue
• NAT gateway per AZ for private-subnet outbound internet