AWS SysOps Administrator study plan
AWS SysOps Administrator · Give each week a clear focus.
8 weeks · About 8 hours per week
Monitoring, Logging, and Remediation
Diagram the CloudWatch metric/alarm/dashboard object model from memory, including namespace, dimension, period, and evaluation-period behavior
Configure a custom metric with the CloudWatch agent on an EC2 instance and build an alarm that triggers an SNS notification
Write three Logs Insights queries that parse, filter, and aggregate a sample application log group
Explain the difference between CloudWatch Logs, CloudTrail, and VPC Flow Logs by listing which question each one answers
Your checkpoint
A one-page CloudWatch decision matrix plus saved screenshots of a working custom-metric alarm and three Logs Insights query results
Monitoring, Logging, and Remediation & Deployment, Provisioning, and Automation
Build an EventBridge rule that matches a state-change event and targets an SSM Automation runbook for remediation
Compare SNS, SQS, and EventBridge as alarm and event targets and justify the choice for three given scenarios
Create a CloudFormation template that provisions an alarm, a topic, and a subscription in one stack and verify drift detection
Trace how an Auto Scaling lifecycle hook plus a Lambda function can perform instance-level remediation
Your checkpoint
A deployed CloudFormation stack that auto-remediates a stopped-instance event, with the stack template and an event log proving the runbook fired
Deployment, Provisioning, and Automation
Compare blue/green, canary, rolling, and in-place deployment strategies and state when each is the correct answer
Configure a CodeDeploy application with an EC2 deployment group and a rolling-with-additional-batch configuration
Use Elastic Beanstalk deployment policies and saved configurations to roll back a failed release
Write SSM documents and Parameter Store entries to patch and configure a fleet without SSH access
Your checkpoint
A runbook document showing a successful CodeDeploy deployment, an intentional rollback, and a Parameter Store-backed configuration change
Networking and Content Delivery
Design a VPC from scratch on paper: CIDR planning, public/private subnets across three AZs, route tables, IGW, and NAT gateways
Distinguish security groups from network ACLs and predict the outcome of five layered-rule scenarios
Select between VPC peering, transit gateway, and PrivateLink for three given connectivity requirements
Configure Route 53 record types, routing policies, and health checks and explain how each affects failover
Your checkpoint
A working two-tier VPC (built manually or via template) plus a written justification memo for every routing and endpoint decision
Networking and Content Delivery & Reliability and Business Continuity
Compare Site-to-Site VPN, Direct Connect, and Direct Connect Gateway for latency, cost, and redundancy tradeoffs
Configure CloudFront with an origin access control and a cache behavior that overrides TTLs for dynamic content
Map four DR strategies (backup and restore, pilot light, warm standby, multi-site) to specific RTO/RCO targets and cost profiles
Verify that RDS automated backups, snapshots, and cross-Region read replicas behave as expected in a restore test
Your checkpoint
A DR strategy table with RTO/RPO estimates plus a completed restore test from an RDS snapshot into a new instance
Reliability and Business Continuity & Security and Compliance
Implement a Route 53 failover pair backed by health checks and prove failover with a simulated regional outage
Design an IAM permission boundary plus role-chaining model and explain when each control applies
Differentiate KMS key policies, grants, and IAM policies and describe the envelope encryption flow for S3
Enable CloudTrail organization trails, AWS Config rules, and GuardDuty findings and route them into a single investigation workflow
Configure S3 Block Public Access, bucket policies, and Object Lock for a compliance-driven bucket
Your checkpoint
A security control checklist mapping each of the six controls (CloudTrail, Config, GuardDuty, IAM boundary, KMS, S3 protection) to the resource you enabled it on and the evidence it produces
Security and Compliance & Cost and Performance Optimization
Write AWS Config rules and a conformance pack that detect three noncompliant resource states
Attribute monthly spend by service and tag using Cost Explorer and configure a budget with an alert threshold
Compare Savings Plans, Reserved Instances, and Spot for three given workload profiles
Tune an Auto Scaling group with target-tracking and step-scaling policies and select the correct EBS volume type for four IOPS/latency profiles
Use Compute Optimizer or Trusted Advisor output to justify one rightsizing recommendation
Your checkpoint
A cost-optimization report covering current spend, a budget alert, and two rightsizing recommendations with projected savings
Monitoring, Logging, and Remediation & Reliability and Business Continuity & Deployment, Provisioning, and Automation & Security and Compliance & Networking and Content Delivery & Cost and Performance Optimization
Take two full-length timed practice exams and log every missed question by domain and by root cause
Re-study the two weakest domains using targeted labs rather than rereading notes
Rehearse scenario triage: for each missed item, identify the key discriminator word in the prompt
Confirm exam logistics, review the domain weighting, and build a one-page recall sheet
Your checkpoint
Two completed practice exam score reports with an error log and a documented score improvement between attempt one and attempt two
Milestones
Week 2: Score at least 80% on a 30-question timed set drawn only from domains 1 and 3
Week 4: Score at least 75% on a 30-question timed set drawn only from domain 5, and explain every wrong answer aloud without notes
Week 5: Demonstrate a live RDS restore plus a Route 53 failover in the console within 45 minutes total
Week 6: Score at least 80% on a 40-question timed set drawn from domains 2 and 4
Week 7: Produce a cost report showing at least two quantified optimization opportunities
Week 8: Reach 85% or higher on the second full-length practice exam, with no single domain below 70%