SOA-C03 — AWS Certified CloudOps Engineer – Associate Exam Blueprint
Practical exam blueprint for the AWS Certified CloudOps Engineer – Associate (SOA-C03) exam.
How to Use This Exam Blueprint
Use this checklist as a readiness map for the AWS Certified CloudOps Engineer – Associate (SOA-C03) exam from AWS. It is designed to help you turn broad exam topics into concrete review tasks.
A strong SOA-C03 candidate can usually:
- Choose the right AWS operational service for a scenario.
- Interpret logs, metrics, alarms, events, and configuration history.
- Troubleshoot compute, storage, network, identity, and deployment problems.
- Apply least privilege, encryption, backup, patching, and governance controls.
- Compare operational tradeoffs: availability, automation, cost, security, and recovery.
This is not a list of exact exam weights or guaranteed question coverage. Treat it as a practical blueprint for what to be ready to do.
Topic-Area Readiness Table
| Readiness area | You should be able to | AWS services and artifacts to review | Ready when you can answer |
|---|---|---|---|
| Monitoring and observability | Detect, investigate, alert, and respond to operational issues | Amazon CloudWatch, CloudWatch Logs, CloudWatch Alarms, CloudWatch dashboards, CloudTrail, AWS Config, EventBridge, VPC Flow Logs, X-Ray basics | “What data source proves what happened, when, and by whom?” |
| Incident response and remediation | Identify root cause, restore service, and reduce repeat incidents | Systems Manager, Automation runbooks, Run Command, Session Manager, AWS Health, Personal Health Dashboard, EventBridge rules | “What is the safest operational action to restore service?” |
| Compute operations | Operate EC2, Auto Scaling, load balancing, containers, and serverless workloads | EC2, Auto Scaling groups, launch templates, ELB, Lambda, ECS/EKS awareness, AMIs, user data, instance profiles | “Is the problem capacity, health check, permissions, network, or application?” |
| Storage operations | Select, protect, recover, and troubleshoot AWS storage | S3, EBS, EFS, FSx awareness, snapshots, lifecycle rules, versioning, replication, encryption | “Which storage option matches durability, performance, access, and recovery needs?” |
| Database operations | Monitor, back up, restore, scale, and troubleshoot managed databases | RDS, Aurora awareness, DynamoDB, ElastiCache awareness, backups, snapshots, Multi-AZ, read replicas, Performance Insights | “Is the fix availability, scaling, backup, indexing, connection, or parameter related?” |
| Networking and connectivity | Diagnose reachability, routing, DNS, filtering, and hybrid access | VPC, subnets, route tables, security groups, NACLs, NAT gateways, internet gateways, VPC endpoints, Route 53, CloudFront, VPN, Direct Connect awareness | “Where is traffic blocked or misrouted?” |
| Security and identity operations | Implement access control, encryption, secrets, auditability, and secure administration | IAM users, groups, roles, policies, permission boundaries awareness, KMS, Secrets Manager, Parameter Store, CloudTrail, GuardDuty, Security Hub awareness | “What is the least-privilege, auditable way to allow this action?” |
| Deployment and automation | Provision, update, roll back, and standardize infrastructure | CloudFormation, StackSets awareness, Systems Manager, CodeDeploy awareness, Elastic Beanstalk awareness, AMIs, launch templates | “How do you deploy repeatably and recover safely?” |
| Resilience and continuity | Design and operate backups, failover, recovery, and high availability | AWS Backup, snapshots, RDS backups, S3 replication, Route 53 health checks, ELB, Auto Scaling, Multi-AZ patterns | “What failure mode is covered, and what is still a single point of failure?” |
| Cost, governance, and optimization | Identify waste, right-size resources, set guardrails, and improve efficiency | AWS Cost Explorer, AWS Budgets, Cost and Usage Reports awareness, Trusted Advisor, Compute Optimizer, AWS Organizations, tags | “How do you reduce cost without breaking availability, security, or recovery?” |
Monitoring, Logging, and Alerting Checklist
Core Monitoring Tasks
- Distinguish between metrics, logs, events, traces, and configuration history.
- Choose CloudWatch metrics for EC2, EBS, RDS, Lambda, ELB, Auto Scaling, and custom applications.
- Interpret common alarm states:
OK,ALARM, andINSUFFICIENT_DATA. - Decide when to use:
- CloudWatch Alarms for threshold-based alerting.
- EventBridge for event-driven routing.
- CloudWatch Logs metric filters for log-derived metrics.
- CloudTrail for API activity.
- AWS Config for resource configuration changes.
- VPC Flow Logs for network traffic visibility.
- Explain how CloudWatch dashboards help operations teams but do not replace alarms.
- Identify when missing metrics may require a CloudWatch agent or application instrumentation.
- Know what information is available from basic EC2 status checks:
- System status checks.
- Instance status checks.
- Attached EBS volume health indicators.
- Use log retention, subscription filters, and centralized logging concepts appropriately.
Can You Do This?
| Prompt | Ready answer should include |
|---|---|
| An EC2 instance is unreachable. What do you check first? | Instance state, system/instance status checks, security group, NACL, route table, public IP or private connectivity, OS firewall, application listener |
| A deployment caused increased 5xx errors behind an Application Load Balancer. What do you inspect? | ALB target health, CloudWatch metrics, application logs, deployment events, target group health checks, recent changes |
| An IAM user deleted a security group rule. Where do you prove it? | CloudTrail event history or logs, identity, source IP, API action, timestamp |
| A resource’s configuration changed and broke compliance. What helps track drift? | AWS Config configuration history, rules, remediation options |
| A workload needs near-real-time reaction to AWS service events. What service routes the event? | Amazon EventBridge |
Incident Response and Operational Remediation
SOA-C03 readiness requires more than recognizing services. You should be able to choose the safest operational response.
| Incident type | Evidence to gather | Likely remediation options | Avoid |
|---|---|---|---|
| EC2 instance unhealthy | Status checks, logs, recent changes, CPU/memory/disk metrics, system logs | Reboot, stop/start, replace via Auto Scaling, recover from AMI, use SSM if accessible | Manually fixing one instance when Auto Scaling replacement is better |
| Application errors | ALB metrics, target logs, application logs, deployment history | Roll back deployment, adjust health check, scale out, fix dependency | Scaling before confirming root cause |
| IAM access failure | Error message, CloudTrail, policy simulator concept, effective permissions | Add least-privilege permission, fix trust policy, attach correct role | Broad AdministratorAccess as a shortcut |
| Network outage | Route tables, SGs, NACLs, DNS, VPC Flow Logs, endpoint policies | Correct route, update rule, fix DNS, restore endpoint or NAT path | Changing multiple controls at once |
| Database performance issue | CPU, memory, connections, I/O, locks, slow queries, Performance Insights | Tune queries, scale, add read replica, adjust parameters, improve connection handling | Assuming storage size alone fixes query design |
| Failed automation | CloudFormation events, SSM command output, IAM role permissions, logs | Fix template/role/parameter, retry safely, roll back | Re-running destructive automation without reviewing failure state |
Remediation Decision Path
flowchart TD
A[Operational alarm or ticket] --> B{Is user impact active?}
B -- Yes --> C[Stabilize service first]
B -- No --> D[Gather evidence before changing]
C --> E{Is there a safe rollback or failover?}
E -- Yes --> F[Rollback, fail over, or replace unhealthy resource]
E -- No --> G[Apply minimal reversible fix]
D --> H[Review logs, metrics, events, config history]
F --> I[Confirm recovery with metrics and health checks]
G --> I
H --> J[Identify root cause and preventive control]
I --> J
J --> K[Document, automate, alert, or add guardrail]
Compute Operations Checklist
Amazon EC2
- Explain when to use EC2 instead of Lambda, containers, or managed services.
- Review EC2 lifecycle states and operational implications.
- Understand AMIs, launch templates, key pairs, security groups, instance profiles, and user data.
- Troubleshoot boot, reachability, and application startup issues.
- Distinguish between stopping, starting, rebooting, terminating, and replacing an instance.
- Know how EBS-backed instances differ operationally from instance store usage.
- Understand when to use Systems Manager Session Manager instead of direct SSH/RDP.
- Recognize how Auto Scaling replaces unhealthy instances.
Auto Scaling and Load Balancing
- Interpret scaling policies based on metrics, schedules, and target tracking concepts.
- Understand desired, minimum, and maximum capacity conceptually.
- Diagnose why Auto Scaling did or did not launch instances.
- Review lifecycle hooks and health check grace period concepts.
- Compare ELB types at a high level:
- Application Load Balancer for HTTP/HTTPS routing.
- Network Load Balancer for high-performance TCP/UDP-style workloads.
- Gateway Load Balancer for appliance-style traffic inspection.
- Troubleshoot failed health checks:
- Wrong path or port.
- Application not listening.
- Security group blocking traffic.
- NACL or route problem.
- Slow startup.
- TLS or host header mismatch.
Lambda and Event-Driven Operations
- Know when Lambda is appropriate for operational automation.
- Review Lambda triggers, permissions, environment variables, versions, and aliases.
- Understand how CloudWatch Logs support Lambda troubleshooting.
- Identify common Lambda failure causes:
- Missing IAM permission.
- Timeout.
- Memory pressure.
- Bad environment variable.
- VPC networking issue.
- Downstream service throttling.
Storage Operations Checklist
| Service | Operational topics to review | Scenario cue |
|---|---|---|
| Amazon S3 | Buckets, objects, versioning, lifecycle, replication, encryption, access policies, Block Public Access, storage classes | “Need durable object storage with policy-controlled access and lifecycle transitions.” |
| Amazon EBS | Volume types conceptually, snapshots, encryption, attachment, performance symptoms, resizing workflow awareness | “Need block storage attached to EC2.” |
| Amazon EFS | Shared file storage, mount targets, security groups, performance modes conceptually, access points awareness | “Multiple instances need shared POSIX-style file access.” |
| AWS Backup | Backup plans, vaults, retention, cross-account/cross-Region concepts | “Need centralized backup policy across supported services.” |
| Amazon FSx | Managed file system options awareness | “Need managed Windows or high-performance file system features.” |
Storage Readiness Prompts
- Can you choose between S3, EBS, and EFS based on access pattern?
- Can you explain why S3 versioning helps recover from accidental overwrite or delete?
- Can you identify when S3 lifecycle rules reduce storage cost?
- Can you troubleshoot S3 access denied errors using IAM policy, bucket policy, object ownership, encryption, and Block Public Access?
- Can you explain how EBS snapshots support backup and restore?
- Can you identify why an EFS mount may fail?
- Missing mount target.
- Security group issue.
- DNS issue.
- NFS client or mount option issue.
- Network path issue.
- Can you select encryption with AWS KMS where required?
Database Operations Checklist
Amazon RDS and Aurora Awareness
- Understand automated backups, manual snapshots, restore workflows, and retention concepts.
- Distinguish Multi-AZ availability from read replica scaling.
- Know common RDS monitoring metrics:
- CPU.
- Free storage.
- Database connections.
- Read/write latency.
- IOPS.
- Replica lag.
- Know when Performance Insights or database logs can help isolate query or wait-state issues.
- Review parameter groups, option groups, maintenance windows, and backup windows conceptually.
- Understand failover impact at a high level.
DynamoDB
- Understand table, item, partition key, sort key, global secondary index, and local secondary index concepts.
- Review capacity modes conceptually.
- Understand throttling symptoms and how to investigate them.
- Know when to use DynamoDB Streams for event-driven processing.
- Review point-in-time recovery and backup concepts.
- Recognize hot partition patterns at a high level.
Database Scenario Checks
| Scenario | Better operational thinking |
|---|---|
| “The application needs higher read throughput.” | Consider read replicas, caching, query tuning, or scaling depending on database type. |
| “The database must survive an Availability Zone failure.” | Consider Multi-AZ architecture rather than only snapshots. |
| “A user accidentally deleted data.” | Consider backups, snapshots, point-in-time recovery, versioned data patterns. |
| “Replica lag is increasing.” | Check write load, replica capacity, long-running queries, network/engine constraints. |
| “Connections are exhausted.” | Check application pooling, connection leaks, scaling, database limits conceptually, and metrics. |
Networking and Connectivity Checklist
VPC Fundamentals
- Explain how VPCs, subnets, route tables, internet gateways, NAT gateways, and endpoints work together.
- Distinguish public and private subnet design.
- Understand how security groups differ from network ACLs:
- Security groups are stateful.
- Network ACLs are stateless.
- Security groups attach to elastic network interfaces.
- Network ACLs apply at the subnet level.
- Know how route table association affects traffic flow.
- Recognize when a NAT gateway is needed for private subnet outbound internet access.
- Recognize when a VPC endpoint can avoid public internet paths for supported AWS services.
- Understand endpoint policies at a high level.
- Interpret VPC Flow Logs for allowed or rejected traffic.
DNS, Edge, and Hybrid Connectivity
- Review Route 53 hosted zones, records, routing policies conceptually, and health checks.
- Know when CloudFront is used for caching, edge delivery, TLS termination patterns, and origin protection concepts.
- Understand VPN and Direct Connect at an operational awareness level.
- Understand how Route 53 health checks and failover routing can support resilience patterns.
- Recognize common DNS troubleshooting issues:
- Wrong record value.
- Hosted zone mismatch.
- Resolver path problem.
- TTL/cache delay.
- Health check status.
- Split-horizon DNS confusion.
Network Troubleshooting Decision Table
| Symptom | Check first | Then check |
|---|---|---|
| Public EC2 instance cannot be reached | Instance state, public IP, security group inbound rule | Route to internet gateway, NACL, OS firewall, app listener |
| Private EC2 instance cannot reach internet | Route to NAT gateway, NAT subnet route to internet gateway | NACLs, security group egress, DNS, NAT health |
| Service in VPC cannot access S3 privately | VPC endpoint existence and route or DNS behavior | Endpoint policy, bucket policy, IAM permissions |
| Load balancer target is unhealthy | Health check path, port, protocol | Target security group, app status, logs, route/NACL |
| Intermittent connection failures | NACL ephemeral port rules, scaling events, DNS, target health | Flow Logs, application timeout settings |
| Name resolves but connection fails | Security group, NACL, route table | Listener, certificate, health check, endpoint policy |
Security, Identity, and Compliance Operations
IAM Readiness
- Understand users, groups, roles, policies, and trust policies.
- Explain why roles are preferred for AWS service access and temporary credentials.
- Interpret identity-based and resource-based policies at a practical level.
- Apply least privilege using actions, resources, and conditions.
- Recognize when permission boundaries, service control policies, or session policies may affect access.
- Troubleshoot access denied errors by checking:
- Identity policy.
- Resource policy.
- Trust policy.
- Explicit deny.
- AWS Organizations controls.
- KMS key policy.
- Session context.
- Region or resource mismatch.
Encryption and Secrets
- Choose when to use AWS KMS managed keys or customer managed keys conceptually.
- Understand envelope encryption at a high level.
- Know that KMS permissions and key policies can both affect access.
- Compare Secrets Manager and Systems Manager Parameter Store for operational secret/configuration use cases.
- Review secret rotation concepts.
- Recognize encryption controls for S3, EBS, RDS, CloudWatch Logs, and backups.
Audit and Detection
| Need | Likely service or control |
|---|---|
| Who made an API call? | AWS CloudTrail |
| Did a resource drift from desired configuration? | AWS Config |
| Is there suspicious account or workload activity? | GuardDuty awareness |
| Are security findings aggregated? | Security Hub awareness |
| Are public S3 buckets blocked? | S3 Block Public Access and policy review |
| Are administrative sessions auditable? | Systems Manager Session Manager with logging |
Deployment, Provisioning, and Automation Checklist
Infrastructure as Code
- Understand why CloudFormation supports repeatability and drift detection.
- Review stacks, templates, parameters, mappings, conditions, outputs, and change sets conceptually.
- Know how stack events help troubleshoot failed deployments.
- Understand rollback behavior at a high level.
- Recognize dependency ordering and resource replacement risks.
- Identify when to use nested stacks or StackSets conceptually.
Systems Manager Operations
- Know common Systems Manager capabilities:
- Session Manager.
- Run Command.
- Automation.
- Patch Manager.
- State Manager.
- Parameter Store.
- Inventory.
- Understand requirements at a high level:
- SSM Agent.
- Instance profile permissions.
- Network connectivity to Systems Manager endpoints.
- Correct target selection.
- Know when SSM is safer than opening inbound SSH or RDP.
Deployment Services and Patterns
- Understand blue/green and rolling deployment concepts.
- Know when CodeDeploy-style deployment health checks and rollback matter.
- Recognize deployment failure signals:
- Failed lifecycle hook.
- Health check failure.
- IAM role missing permission.
- Application start failure.
- Configuration mismatch.
- Understand immutable infrastructure concepts using AMIs, launch templates, and replacement instead of manual repair.
Resilience, Backup, and Disaster Recovery Readiness
| Requirement type | Review these options | Key distinction |
|---|---|---|
| Recover from accidental deletion | Backups, snapshots, S3 versioning, point-in-time recovery | Recovery from data loss is different from high availability |
| Survive instance failure | Auto Scaling, health checks, replacement, AMIs | Replace unhealthy compute instead of manually repairing when possible |
| Survive AZ failure | Multi-AZ design, load balancing, redundant subnets | Requires resources across Availability Zones |
| Reduce read pressure | Read replicas, caching, CloudFront, application changes | Read scaling is not the same as failover |
| Regional resilience | Replication, backups, Route 53 patterns, tested runbooks | More complex than Multi-AZ and requires operational planning |
| Centralize backup governance | AWS Backup plans and vaults | Policy-driven backup management |
Can You Explain the Difference?
- Snapshot vs backup policy.
- Backup vs replication.
- Multi-AZ vs read replica.
- Auto Scaling health replacement vs manual instance recovery.
- Route 53 failover vs load balancer target health.
- RTO concept vs RPO concept.
- High availability vs disaster recovery.
- Resilience by design vs recovery after failure.
Cost, Governance, and Optimization Checklist
Cost Awareness
- Use tags to support cost allocation and operational ownership.
- Know when AWS Budgets helps alert on spending or usage trends.
- Know when Cost Explorer helps analyze spend patterns.
- Recognize Trusted Advisor and Compute Optimizer at a high level.
- Identify common waste:
- Idle EC2 instances.
- Unattached EBS volumes.
- Old snapshots without retention policy.
- Overprovisioned databases.
- Unused load balancers.
- Excessive data transfer patterns.
- Inefficient storage classes.
- Understand tradeoffs among On-Demand, Reserved Instances, Savings Plans, and Spot concepts without relying on exact pricing.
Governance Readiness
- Understand how AWS Organizations can support multi-account governance.
- Recognize the purpose of service control policies at a high level.
- Know how AWS Config rules can detect noncompliant resources.
- Use CloudTrail and centralized logging concepts for auditability.
- Use tagging standards for ownership, environment, application, and cost center.
- Know how automation can enforce or remediate standards.
Command, Console, and Artifact Checks
You do not need to memorize every AWS CLI flag, but you should recognize which command, console page, or artifact would answer an operational question.
| Task | Artifact or command family to recognize |
|---|---|
| Check EC2 health | EC2 instance status checks, CloudWatch metrics, describe-instance-status |
| Review load balancer target health | Target group health page, ELB metrics, describe-target-health |
| Find who changed a resource | CloudTrail event history or CloudTrail logs |
| Review failed CloudFormation deployment | Stack events, change set, template, rollback state |
| Inspect SSM command result | Run Command output, SSM command invocation details |
| Check IAM role assumption | Trust policy, CloudTrail AssumeRole event, effective permissions |
| Investigate blocked network traffic | Security group, NACL, route table, VPC Flow Logs |
| Confirm S3 access controls | IAM policy, bucket policy, ACL legacy awareness, Block Public Access, KMS key policy |
| Validate backup coverage | AWS Backup plan, vault, recovery points, service-specific backup settings |
Example AWS CLI patterns to recognize:
aws ec2 describe-instance-status --instance-ids i-xxxxxxxxxxxxxxxxx
aws elbv2 describe-target-health --target-group-arn arn:aws:elasticloadbalancing:...
aws cloudformation describe-stack-events --stack-name my-stack
aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=DeleteSecurityGroup
aws ssm list-command-invocations --command-id command-id --details
High-Value Scenario Cues
“Users report the application is down.”
Check in this order:
- External symptom: DNS, CDN, load balancer, endpoint, status page.
- Load balancer metrics and target health.
- Auto Scaling events and instance health.
- Application logs and recent deployment events.
- Database and dependency metrics.
- Network controls if reachability changed.
- CloudTrail and Config for recent changes.
“A private instance cannot install updates.”
Likely causes:
- No NAT gateway or other approved egress path.
- Route table missing default route to NAT.
- Security group egress too restrictive.
- NACL blocks outbound or ephemeral return traffic.
- DNS resolution issue.
- VPC endpoint required but missing for AWS service access.
- Instance profile missing required permissions for managed operations.
“An S3 object access request returns AccessDenied.”
Check:
- IAM identity policy.
- Bucket policy.
- S3 Block Public Access setting.
- Object ownership or ACL legacy issue.
- KMS key policy and grants if object is KMS-encrypted.
- VPC endpoint policy if access uses an endpoint.
- Explicit deny from any applicable policy.
- Requested Region, bucket name, and object key.
“CloudFormation stack update failed.”
Check:
- Stack events for the first failing resource.
- IAM execution role permissions.
- Resource naming conflicts.
- Replacement behavior for stateful resources.
- Parameter values.
- Dependency ordering.
- Service quotas or unavailable capacity conceptually.
- Rollback status before retrying.
“Auto Scaling is not adding capacity.”
Check:
- Scaling policy configuration.
- Alarm state and metric data.
- Desired/minimum/maximum capacity relationship.
- Launch template or AMI validity.
- IAM service-linked role or instance profile.
- Subnet capacity or placement issue.
- Health check grace period.
- Suspended scaling processes awareness.
Common Weak Areas and Exam Traps
| Weak area | Why it causes missed questions | How to fix it |
|---|---|---|
| Confusing CloudTrail, CloudWatch, and AWS Config | They answer different operational questions | Practice mapping “who did it,” “what metric changed,” and “what configuration changed” |
| Treating security groups and NACLs the same | Stateful vs stateless behavior changes troubleshooting | Draw packet flow for inbound and return traffic |
| Assuming snapshots equal high availability | Snapshots help recovery, not automatic failover | Separate backup, HA, and DR scenarios |
| Choosing broad IAM permissions | Exam scenarios often prefer least privilege | Look for specific action, resource, role, and trust relationship |
| Ignoring KMS policy impact | Encrypted resources can fail even when IAM looks correct | Always check key policy and KMS permissions |
| Confusing Multi-AZ and read replicas | Availability and read scaling are different goals | Tie each feature to the requirement in the question |
| Skipping route table association | Correct route in the wrong table does not help | Confirm subnet association every time |
| Overlooking health check configuration | Healthy app can be marked unhealthy if path/port is wrong | Verify protocol, path, port, matcher, and security group |
| Manually repairing ephemeral compute | Cloud operations often favors replacement and automation | Think Auto Scaling, AMI, launch template, and runbook |
| Forgetting endpoint policies | VPC endpoints can add another authorization layer | Include endpoint policy in access-denied troubleshooting |
Final-Week Review Checklist
Three to Five Days Out
- Review each AWS service in this checklist at the “what problem does it solve?” level.
- Build a one-page comparison sheet for:
- CloudTrail vs CloudWatch vs AWS Config.
- Security groups vs NACLs.
- NAT gateway vs internet gateway vs VPC endpoint.
- Multi-AZ vs read replica vs backup.
- S3 vs EBS vs EFS.
- IAM role policy vs trust policy.
- Rework missed practice questions by identifying the decision clue, not just the correct answer.
- Practice reading scenario questions for constraints:
- Least operational overhead.
- Highest availability.
- Most secure.
- Fastest recovery.
- Lowest cost.
- Minimal change.
- Review common failure workflows: EC2 unreachable, target unhealthy, AccessDenied, failed deployment, database slow, private subnet no egress.
One to Two Days Out
- Stop deep-diving obscure service details unless they fix a known weakness.
- Revisit monitoring and troubleshooting artifacts:
- Metrics.
- Logs.
- Events.
- Config history.
- CloudTrail API activity.
- Health checks.
- Practice explaining service choices out loud in one sentence.
- Review IAM troubleshooting and KMS interactions.
- Review VPC traffic flow from source to destination.
- Sleep and keep review sessions short.
Exam-Day Readiness
- For each scenario, identify the primary requirement before reading answer choices.
- Eliminate answers that are insecure, manual, nonrepeatable, or do not address the failure mode.
- Watch for answers that solve a different problem than the question asks.
- Prefer AWS-managed, auditable, automated, and least-privilege options when the scenario supports them.
- If stuck, classify the question:
- Monitoring evidence.
- Network path.
- IAM/KMS access.
- Deployment failure.
- Backup/recovery.
- Scaling/performance.
- Cost/governance.
Practical Next Step
Use this Exam Blueprint to mark strong and weak areas, then practice mixed SOA-C03 scenarios that force you to choose between similar AWS services and operational responses. Focus especially on troubleshooting paths, IAM/KMS access decisions, VPC connectivity, monitoring evidence, and recovery tradeoffs.