AWS Certified CloudOps Engineer – Associate Cheat Sheet (SOA-C03)
Every CloudWatch alarm pattern, Systems Manager tool, DR strategy, and VPC diagnostic the SOA-C03 exam actually tests — organised the way operators work, not the way services are catalogued
About This Cheat Sheet
A 13-page reference covering every in-scope service from the official SOA-C03 exam guide (the renamed CloudOps Engineer Associate, formerly SysOps Administrator) — 19 sections organised around the five exam domains: Monitoring & Remediation (22%), Reliability & Business Continuity (22%), Deployment & Automation (22%), Security & Compliance (16%), Networking & Content Delivery (18%). Covers EC2 with Auto Scaling, Containers (ECR/ECS/EKS with Fargate), AWS Lambda for operators, CloudWatch (metrics/alarms/logs/agent/Synthetics/ServiceLens), the observability stack (Managed Grafana, Managed Service for Prometheus, X-Ray), the full Systems Manager suite, Audit (CloudTrail/Config with auto-remediation), Reliability & Backup with ARC readiness checks and zonal shift, Storage, Database, Application Integration (SQS/SNS/EventBridge/Step Functions), Analytics (Athena/Data Firehose/SES), Deployment (CloudFormation helper scripts, CDK, Organizations, Control Tower, Service Catalog, RAM, IAM Identity Center), Identity/KMS/ACM/Secrets Manager, Threat Detection, Networking with diagnostics (Reachability Analyzer, IPAM, DNS Firewall, Network Firewall), and Edge/DNS/LB. Every service on the official in-scope list is present — audited against the exam guide.
What's Inside
CloudOps Fundamentals & EC2
AWS Console, CLI v2, CloudShell, Amazon Q Developer. EC2 User Data, IMDSv2, instance profiles, AMIs with EC2 Image Builder, placement groups, Auto Scaling with launch templates, lifecycle hooks, warm pools, instance refresh, termination policies.
Amazon CloudWatch (deep)
Built-in vs. CloudWatch agent metrics (memory/disk need the agent), standard vs. high-resolution, metric math, metric alarms vs. composite alarms, EC2 recovery action, anomaly detection bands. Logs with retention, subscription filters, metric filters, Logs Insights, Contributor Insights. Synthetics Canaries, ServiceLens. EventBridge rules and EventBridge Scheduler.
Observability Stack
Amazon Managed Grafana, Amazon Managed Service for Prometheus, AWS X-Ray (segments/subsegments/annotations/metadata/sampling), VPC Flow Logs, CloudTrail Insights.
AWS Systems Manager (the full suite)
Session Manager (no SSH, port forwarding), Run Command, State Manager Associations, Patch Manager with baselines and patch groups, Maintenance Windows, Automation runbooks, Parameter Store, Inventory, OpsCenter, Change Manager, Distributor, Fleet Manager, Hybrid Activations.
Audit, Logging & Compliance
CloudTrail management vs. data events, CloudTrail Lake, AWS Config with rules and SSM Automation auto-remediation, conformance packs, Trusted Advisor (especially service-quota checks), Audit Manager, AWS Health Dashboard. The CloudTrail / CloudWatch / Config three-way pattern.
Reliability, Backup & DR
AWS Backup with Backup Vault Lock and cross-Region/cross-account copy, RDS Multi-AZ vs. Multi-AZ Cluster vs. Read Replicas, Aurora HA, Route 53 failover routing. Application Recovery Controller (readiness checks, routing controls, safety rules, zonal shift). The four DR strategies with RPO/RTO tradeoffs.
Storage & Database Operations
S3 lifecycle rules, Replication (including RTC 15-min SLA), Object Lock, Storage Lens, Access Points, Block Public Access. EBS types with IOPS/throughput tradeoffs, Data Lifecycle Manager, Fast Snapshot Restore. EFS, FSx variants, Storage Gateway, DataSync. RDS parameter/option groups, RDS Events, Performance Insights, RDS Proxy, Aurora operational features.
Deployment & Multi-Account Governance
CloudFormation with change sets, drift detection, stack sets, helper scripts (cfn-init/signal/hup), CreationPolicy/UpdatePolicy/DeletionPolicy. AWS CDK workflow. Organizations with SCPs and tag policies, Control Tower landing zone and Account Factory, Service Catalog, Resource Access Manager, IAM Identity Center.
Identity, Encryption & Threat Detection
IAM policy evaluation order, IAM Access Analyzer. KMS key types, envelope encryption, multi-Region keys. Secrets Manager vs. Parameter Store. GuardDuty, Inspector, Macie, Security Hub, WAF, Shield Standard vs. Advanced, AWS Network Firewall for deep-packet inspection in a central inspection VPC, Firewall Manager for org-wide policy.
Networking & Edge
VPC components (subnets, IGW, Egress-only IGW, NAT, SG, NACL, route tables), Transit Gateway, PrivateLink, VPC Endpoints (Gateway vs. Interface). Network diagnostics: Flow Logs, Reachability Analyzer, Network Access Analyzer, IPAM, Route 53 Resolver DNS Firewall. Route 53 routing policies, ELB types with sticky sessions and cross-zone tradeoffs, CloudFront with OAC.
Cost Management
Cost Explorer, AWS Budgets with actions, Cost and Usage Report with Athena/QuickSight, Savings Plans (especially Compute), Reserved Instances, Compute Optimizer, Trusted Advisor cost checks.
Why This Cheat Sheet Helps
SOA-C03 is the only AWS associate exam whose whole shape is operational rather than architectural or developer-focused. Questions test the muscle memory of an operator in a running account — which alarm action to wire up, which SSM tool to reach for, how to patch a fleet on a schedule, how to detect DR drift before it bites you. This cheat sheet puts those decisions side by side with the specific language examiners use.
It assumes you have about a year of hands-on AWS operations experience. Use it as a final-week review to reinforce patterns you already recognise, fill gaps surfaced by practice exams, and prime yourself for the phrasings the exam uses.
How to Use It
Skim the whole sheet end to end to see the shape of the exam. Then use CloudNinja's free SOA-C03 practice exam to find your gaps. When you miss a question, jump to the relevant section — most likely CloudWatch (3), Systems Manager (5), Reliability & Backup (7), or Networking (13), since those carry the most exam weight.
On exam day minus three, go through every Exam Tip call-out. Those are the decision rules distilled — they're the pattern-match you need on test day.
Frequently Asked Questions
Is this AWS CloudOps Engineer cheat sheet free?
Yes, completely free with no signup required. Download the PDF directly from CloudNinja and use it as a study reference for the SOA-C03 exam.
Why is the exam called CloudOps Engineer instead of SysOps Administrator?
AWS rebranded the SysOps Administrator Associate exam to CloudOps Engineer Associate to better reflect the modern role — operations work is now about automation, observability, and reliability rather than traditional systems administration. The exam code (SOA-C03) and most of the content are continuous with the previous version; the name change reflects how the job has evolved.
How much AWS experience do I need before SOA-C03?
AWS recommends around one year of hands-on operations experience — deploying, managing, monitoring, and troubleshooting workloads on AWS. If you have less than that, consider starting with the Cloud Practitioner (CLF-C02). If you already hold the Solutions Architect Associate, most of the architectural concepts will transfer; the differences are the depth on CloudWatch, Systems Manager, and operational governance.
Is this cheat sheet updated for the renamed CloudOps Engineer exam?
Yes, it is built directly from the current SOA-C03 exam guide (sysops-administrator-associate-03) and uses the new CloudOps Engineer name while acknowledging the SysOps Administrator heritage. It covers the in-scope services AWS added to the renamed exam (Managed Grafana, Managed Prometheus, Application Recovery Controller, IPAM, Network Firewall) alongside everything carried over from SysOps.
Keep Studying
Recommended courses
Affiliate links — if you enrol through them, CloudNinja may earn a commission at no extra cost to you.