SOA-C03 Cheatsheet - CloudOps Signals, Runbooks, Reliability, Security & Networking

Keep this page open while drilling. SOA-C03 rewards structured operations thinking: signal -> diagnosis -> low-risk remediation -> verification.

---

Quick facts (SOA-C03)

Fast strategy

• Start from the constraint in the last sentence (availability, compliance, latency, cost, operational effort).
• Prefer the smallest safe operational change that addresses root cause.
• For noisy incidents, choose approaches that improve signal quality first (better alarms, filtering, dashboards).
• For repeated incidents, prefer automation (EventBridge + Lambda/SSM runbooks).

Final 20-minute recall (exam day)

Cue -> best answer (pattern map)

Must-memorize SOA defaults

Last-minute traps

• Acting on one symptom metric without correlation to logs/traces/deploy timeline.
• Running high-risk remediation before confirming blast radius.
• Treating backups as compliant without restore testing.
• Alerting on every metric spike instead of SLO-aligned sustained conditions.

---

1) CloudOps incident loop

    flowchart LR
	  A[Detect signal] --> B[Triage severity]
	  B --> C[Identify probable root cause]
	  C --> D[Apply low-risk remediation]
	  D --> E[Validate recovery]
	  E --> F[Document + automate prevention]

Use this loop in scenario questions. Wrong answers often skip validation or choose high-blast-radius changes.

---

2) Monitoring and logging defaults (Domain 1)

Choose the right telemetry

Alarm design defaults

• Use alarm thresholds tied to SLO/error budgets where possible.
• Use composite alarms to reduce alert noise.
• Route alerts to SNS or EventBridge for automation paths.
• Include runbook links in alarm descriptions for faster response.

Common D1 pitfalls

• Alarm on raw spikes without sustained evaluation windows.
• No distinction between symptom metrics and cause metrics.
• Missing CloudWatch agent config on EC2/ECS/EKS.
• Automation triggers without guardrails/permissions checks.

---

3) Reliability and business continuity (Domain 2)

HA and scaling picks

Backup/restore language you must apply correctly

• RPO: acceptable data loss window.
• RTO: acceptable restoration time.

If question emphasizes strict RPO/RTO, prioritize restore method and backup frequency that explicitly satisfy those targets.

Reliability anti-patterns

• Single-AZ for critical stateful production workloads.
• Backups with no restore test evidence.
• Scaling policies with no cooldown/health alignment.

---

4) Deployment, provisioning, and automation (Domain 3)

Core service map

CloudFormation troubleshooting checklist

1. Validate IAM permissions for stack actions.
2. Check resource dependency/order failures.
3. Confirm subnet CIDR sizing and limits.
4. Review event log for first failing resource (not only terminal error).

Automation rule of thumb

Automate repetitive, deterministic operations first: patching, restart/remediation runbooks, compliance drift checks, and standard incident responses.

---

5) Security and compliance operations (Domain 4)

High-yield controls

Common exam patterns

• Access denied: check identity policy, resource policy, and KMS key policy.
• Compliance drift: Config rule failure -> remediation workflow.
• Multi-account controls: Organizations/SCP boundaries and delegated operations.

---

6) Networking and content delivery troubleshooting (Domain 5)

VPC troubleshooting order

1. Route tables
2. Security groups (stateful)
3. NACLs (stateless)
4. Gateway/path (IGW, NAT, TGW, endpoints)
5. DNS resolution (Route 53 / Resolver)

Network/data path service picks

Frequent D5 anti-patterns

• Allowing SG but blocking ephemeral return traffic via NACL.
• Assuming NAT provides inbound access.
• CloudFront cache issue treated as origin outage.

---

7) Troubleshooting playbooks you can reuse

5xx spike behind load balancer

• Check target health first.
• Correlate LB access logs + target logs + alarm timeline.
• Validate autoscaling events and recent config/deploy changes.

Alarm noise flood

• Replace independent symptom alarms with composite alarm logic.
• Tune thresholds/evaluation periods from observed baseline.
• Route only actionable alerts to incident channels.

Intermittent connectivity failure

• Validate route and SG path both directions.
• Inspect NACL rules for stateless return traffic blocks.
• Use Reachability Analyzer and VPC Flow Logs for confirmation.

---

8) Cost-aware operations quick wins

• Delete idle unattached EBS volumes and stale snapshots with retention policy.
• Use lifecycle policies for S3/EFS where access patterns allow.
• Reduce NAT egress by using VPC endpoints where applicable.
• Right-size compute using utilization and recommendation signals.

---

Next steps

• Follow the Syllabus task-by-task.
• Drill weak tasks in Practice .
• Use the Study Plan if you want a timeline.