AWS CloudOps Engineer (SOA-C03) study plan
AWS CloudOps Engineer (SOA-C03) · Give each week a clear focus.
8 weeks · About 7 hours per week
Monitoring, Logging, and Remediation
Map each CloudWatch metric type (standard vs. detailed) to the alarm evaluation behavior it drives
Configure a composite alarm and a metric-math alarm from scratch in a sandbox account
Trace how CloudWatch Logs subscription filters route to Lambda and Kinesis Firehose
Identify which CloudTrail event categories land in management vs. data events
Your checkpoint
A working sandbox stack (IaC or console) with three alarms (static threshold, metric math, composite) plus a log subscription filter, each verified by deliberately triggering it and capturing the alarm state transition history
Monitoring, Logging, and Remediation
Design a centralized logging architecture across accounts using cross-account log destinations
Differentiate CloudWatch Logs Insights query syntax from Athena-based log querying and pick appropriately
Configure AWS Config rules and conformance packs to detect drift on a target resource type
Build an EventBridge rule that triggers an automated remediation action via SSM Automation
Set up X-Ray tracing on a sample application and interpret the service map
Your checkpoint
An automated remediation runbook: an EventBridge rule detects a misconfiguration, invokes SSM Automation, and the before/after state is documented with the log evidence trail
Reliability and Business Continuity
Compare RTO/RPO implications of backup-and-restore, pilot light, warm standby, and multi-site active-active
Configure AWS Backup with cross-region and cross-account copy plus a vault lock policy
Design a Multi-AZ vs. Multi-Region failover strategy for a relational and a NoSQL workload
Implement health checks and Route 53 failover routing to test a controlled failover
Define an Elasticity strategy that survives an AZ impairment
Your checkpoint
A written disaster recovery runbook for one workload specifying RTO/RPO targets, the strategy chosen, and a table mapping each step to the AWS service and API call that executes it
Reliability and Business Continuity
Execute and time an actual failover drill for the workload from week 3 and record the measured RTO
Tune Auto Scaling policies (target tracking vs. step vs. scheduled) and validate scaling under synthetic load
Configure S3 durability and resilience features (versioning, replication, Object Lock) and verify behavior
Evaluate service quotas that constrain recovery and request an increase where needed
Your checkpoint
A drill report with the measured RTO/RPO versus target, the scaling behavior observed under load, and a prioritized list of gaps with the fix for each
Deployment, Provisioning, and Automation
Author a CloudFormation template and a CDK or SAM equivalent for the same stack and compare drift/change-set behavior
Configure a CodePipeline with build, test, and deploy stages including a manual approval gate
Implement blue/green or canary deployment with CodeDeploy and define automatic rollback triggers
Parameterize and layer configurations using Systems Manager Parameter Store and AppConfig
Automate patching with SSM Patch Manager and a maintenance window
Your checkpoint
A CI/CD pipeline that deploys the sample stack through at least two environments, demonstrates an automatic rollback on a failed health check, and stores all config in Parameter Store
Deployment, Provisioning, and Automation & Cost and Performance Optimization
Codify infrastructure with reusable modules and validate them with cfn-lint or equivalent
Right-size compute by analyzing CloudWatch metrics and Compute Optimizer recommendations
Select and configure the correct storage class and lifecycle policy for a given access pattern
Apply Savings Plans or Reserved Instance purchase analysis to a sample workload's usage
Choose between Spot, On-Demand, and Graviton-based instances for a stated workload profile
Your checkpoint
A cost and performance optimization memo for the sample workload quantifying projected monthly savings and performance impact, backed by the metrics and recommendations you pulled
Security and Compliance
Enforce least-privilege IAM by scoping a policy with IAM Access Analyzer findings and validating with the policy simulator
Design a KMS key policy and rotation strategy for data at rest across two services
Configure Guardrails with SCPs and permission boundaries and test that they deny the intended actions
Enable and interpret Security Hub findings and Amazon GuardDuty detections
Harden secrets management by migrating credentials into Secrets Manager with rotation
Your checkpoint
A security baseline document plus deployed SCPs, permission boundaries, and a KMS key policy, each proven with a test that shows the allowed action succeeding and the denied action failing
Networking and Content Delivery & Monitoring, Logging, and Remediation & Reliability and Business Continuity
Design a VPC with public/private subnets, NAT, and VPC endpoints and justify each endpoint choice
Configure security groups and NACLs to demonstrate stateful vs. stateless filtering differences
Set up CloudFront with an origin access control and a cache behavior tuned to a content type
Diagnose a simulated connectivity failure using Reachability Analyzer and VPC Flow Logs
Run a full timed practice exam and review every missed question by domain
Your checkpoint
A troubleshooting write-up of the simulated connectivity failure with the root cause identified from Reachability Analyzer and Flow Logs, plus a scored practice exam with a per-domain gap list and a final review schedule
Milestones
Week 2: Can explain, without notes, the difference between CloudWatch, CloudTrail, Config, and X-Ray and which one answers a given operational question; automated remediation demo runs end to end
Week 4: Measured failover RTO is documented and within 2x of the stated target, and you can defend the DR strategy choice against two alternatives
Week 6: Pipeline deploys and rolls back unattended; optimization memo shows a quantified savings estimate with the metrics that support it
Week 8: Practice exam score is at or above 80% overall with no single domain below 70%; every missed question has a written root-cause note