SOA-C03 — AWS Certified CloudOps Engineer – Associate Study Plan
Practical 7-day, 14-day, 30-day, and 60/90-day study plans for the AWS Certified CloudOps Engineer – Associate (SOA-C03) exam.
Who this study plan is for
This study plan is for candidates preparing for the AWS Certified CloudOps Engineer – Associate (SOA-C03) exam from AWS. It is designed for people who need a practical schedule for turning available study time into exam-ready practice.
The SOA-C03 exam rewards operational judgment: monitoring, alerting, troubleshooting, automation, deployments, security controls, networking, reliability, and cost-aware operations. Your study time should therefore combine:
- Objective-based reading and review
- Hands-on AWS console and AWS CLI familiarity
- Scenario-based practice questions
- Timed mock exams
- Careful missed-question review
If you have limited time, prioritize diagnostic practice, weak-area repair, and timed decision-making over trying to reread everything.
Which plan should you use?
| Time before exam | Best plan | Use this if | Main goal |
|---|---|---|---|
| 7 days | Final review sprint | You already studied or have AWS operations experience | Stabilize weak areas and sharpen timing |
| 14 days | Focused plan | You know AWS basics but need structured SOA-C03 review | Cover high-value CloudOps topics quickly |
| 30 days | Balanced plan | You can study most days and want full coverage | Build knowledge, practice, and exam rhythm |
| 60/90 days | Full preparation path | You are newer to AWS operations or have inconsistent study time | Learn, practice hands-on, then test readiness |
Recommended weekly study time
| Plan | Minimum useful time | Better target | Notes |
|---|---|---|---|
| 7-day plan | 10-12 hours total | 15-20 hours total | Do not start large new topics late unless they are major gaps |
| 14-day plan | 18-24 hours total | 28-35 hours total | One diagnostic, one full mock, and daily weak-area repair |
| 30-day plan | 30-40 hours total | 50-70 hours total | Best balance for most working professionals |
| 60/90-day plan | 45-70 hours total | 80-120 hours total | Add hands-on labs and deeper troubleshooting review |
Build your SOA-C03 study map first
Before choosing a schedule, organize your review around the skills the exam is likely to test in operational scenarios.
| Study area | What to practice | Examples of decisions to be ready for |
|---|---|---|
| Monitoring, logging, and observability | CloudWatch metrics, alarms, dashboards, logs, events, traces, operational baselines | Which signal identifies the issue? Which alarm or log source should be used? |
| Incident response and troubleshooting | EC2, Auto Scaling, load balancers, networking, storage, permissions, failed deployments | What is the fastest safe recovery action? What should be checked first? |
| Deployment, provisioning, and automation | CloudFormation, Systems Manager, automation runbooks, patching, AMIs, launch templates | Which automation approach reduces manual work and drift? |
| Security and compliance operations | IAM, least privilege, encryption, logging, resource access, secrets, audit trails | Which control enforces access while preserving operations? |
| Networking and connectivity | VPC, subnets, route tables, security groups, NACLs, NAT, endpoints, DNS, load balancing | Is the issue routing, name resolution, firewalling, or service configuration? |
| Reliability and business continuity | Backups, snapshots, multi-AZ design, scaling, recovery procedures, health checks | How do you improve availability or recover safely? |
| Cost, governance, and optimization | Tagging, budgets, usage visibility, rightsizing signals, lifecycle policies | Which action controls cost without breaking operations? |
Start with a diagnostic
Do this before any plan longer than 7 days. If you have only 7 days, do a shortened diagnostic on Day 1.
| Step | Time | Action | Output |
|---|---|---|---|
| 1 | 45-90 min | Take a mixed SOA-C03 practice set without notes | Baseline score and weak areas |
| 2 | 30-45 min | Review every missed and guessed question | Missed-question log |
| 3 | 20 min | Group misses by topic | Top 3 priorities |
| 4 | 15 min | Choose your plan and calendar blocks | Realistic daily schedule |
Do not use the diagnostic as a confidence test. Use it as a sorting tool.
Daily practice rhythm
Use this rhythm on most study days. Adjust the duration, but keep the sequence.
| Block | 45-minute day | 90-minute day | 2-3 hour day |
|---|---|---|---|
| Warm-up recall | 5 min | 10 min | 10 min |
| Focused concept review | 15 min | 25 min | 35-45 min |
| Scenario practice | 15 min | 30 min | 45-60 min |
| Missed-question review | 10 min | 20 min | 30 min |
| Hands-on or diagram review | Optional | 5 min | 30-45 min |
| Summary notes | Optional | 5 min | 10 min |
What to do during each block
| Block | Practical action |
|---|---|
| Warm-up recall | Write down key differences from memory: security group vs NACL, CloudWatch alarm vs EventBridge rule, NAT gateway vs VPC endpoint, AMI vs launch template. |
| Concept review | Review one narrow topic. Avoid passive rereading across many services. |
| Scenario practice | Answer questions in timed mode when possible. Force yourself to choose the AWS-native operational response. |
| Missed-question review | Explain why the correct answer is better and why the distractors are wrong. |
| Hands-on or diagram review | Sketch an architecture, trace a request path, or verify where logs, metrics, permissions, and routes are configured. |
| Summary notes | Write 3-5 bullets you want to remember tomorrow. |
7-day final review sprint
Use this plan if your exam is in one week. The goal is not to learn every AWS service from scratch. The goal is to remove avoidable mistakes, improve scenario recognition, and finish with stable timing.
7-day schedule
| Day | Main focus | Study actions | Practice target |
|---|---|---|---|
| 1 | Diagnostic and triage | Take a mixed timed practice set. Review all missed and guessed questions. Build a top-10 weak-area list. | 40-65 questions or one partial mock |
| 2 | Monitoring and incident response | Review CloudWatch, logs, alarms, EventBridge, health checks, Systems Manager, operational runbooks. | 30-50 targeted questions |
| 3 | Networking and access troubleshooting | Review VPC routing, security groups, NACLs, NAT, VPC endpoints, DNS, load balancers, IAM permission symptoms. | 30-50 targeted questions |
| 4 | Deployment and automation | Review CloudFormation, launch templates, Auto Scaling, patching, AMIs, Systems Manager automation, rollback patterns. | 30-50 targeted questions |
| 5 | Security, compliance, and reliability | Review IAM, encryption, audit logging, backups, snapshots, multi-AZ operations, recovery choices. | 30-50 targeted questions |
| 6 | Full timed mock | Take one full-length timed mock. Review deeply. Do not rush review. | One full timed mock |
| 7 | Light final review | Revisit missed-question log, service-selection notes, and diagrams. Stop heavy new material. | 15-25 light questions only |
7-day rules
- Stop adding major new material after Day 5.
- Use Day 6 to test timing, not to chase a perfect score.
- On Day 7, focus on mistakes you have already made.
- Do not take multiple full mocks the day before the exam if review quality will drop.
- Sleep and pacing matter more than one more rushed question set.
14-day focused plan
Use this if you have two weeks and need a concentrated schedule. This plan assumes you can study 1-2 hours on weekdays and more on one or both weekends.
Days 1-7: coverage and weak-area repair
| Day | Focus | Actions |
|---|---|---|
| 1 | Diagnostic | Mixed timed set, missed-question log, rank weak areas. |
| 2 | Observability | CloudWatch metrics, alarms, logs, dashboards, EventBridge, operational signals. |
| 3 | Compute operations | EC2 lifecycle, Auto Scaling, launch templates, AMIs, Systems Manager, patching. |
| 4 | Networking | VPC routing, subnets, security groups, NACLs, NAT, endpoints, DNS, load balancing. |
| 5 | Storage and backup operations | EBS, EFS, S3 operational features, snapshots, lifecycle, recovery choices. |
| 6 | Security operations | IAM, least privilege, encryption, logging, secrets, audit readiness. |
| 7 | Timed mixed set | Take a larger mixed practice set. Review misses by topic and reason. |
Days 8-14: exam rhythm and final readiness
| Day | Focus | Actions |
|---|---|---|
| 8 | Deployment and automation | CloudFormation, Systems Manager, operational automation, rollback and drift concepts. |
| 9 | Reliability and scaling | Health checks, Auto Scaling behavior, load balancer troubleshooting, recovery planning. |
| 10 | Cost and governance | Tagging, budgets, cost visibility, rightsizing signals, lifecycle policies, governance controls. |
| 11 | Weak-area sprint 1 | Rework your two weakest topics with targeted questions and notes. |
| 12 | Full timed mock | Take one full mock under exam-like timing. Review every miss and guess. |
| 13 | Weak-area sprint 2 | Repair issues found on the mock. Create a final service-selection sheet. |
| 14 | Light review | Review notes, diagrams, and missed-question log. Stop heavy new content. |
14-day priority order
If time runs short, prioritize in this order:
- Monitoring, logging, and alarm interpretation
- Networking and access troubleshooting
- IAM and security operations
- Compute, Auto Scaling, and Systems Manager
- Deployment and rollback scenarios
- Backup, recovery, and reliability
- Cost and governance
30-day balanced plan
Use this if you want full coverage without cramming. The structure is:
- Week 1: baseline and core operations
- Week 2: networking, security, and troubleshooting
- Week 3: automation, reliability, and cost
- Week 4: timed mocks and weak-area closure
Week 1: baseline, monitoring, and compute operations
| Day | Focus | Actions |
|---|---|---|
| 1 | Diagnostic | Mixed practice set, missed-question log, study calendar. |
| 2 | CloudWatch fundamentals | Metrics, alarms, logs, dashboards, namespaces, operational baselines. |
| 3 | Event-driven operations | EventBridge concepts, notifications, automated operational responses. |
| 4 | EC2 operations | Instance states, AMIs, EBS attachment concepts, status checks, troubleshooting flow. |
| 5 | Auto Scaling and load balancing | Scaling policies, health checks, target groups, failed instance replacement. |
| 6 | Systems Manager | Session access, Run Command, Patch Manager, Automation, inventory concepts. |
| 7 | Weekly review | 60-90 minute mixed set; update weak-area list. |
Week 2: networking and security operations
| Day | Focus | Actions |
|---|---|---|
| 8 | VPC routing | Route tables, internet access, private subnet patterns, NAT, endpoints. |
| 9 | Network filtering | Security groups, NACLs, connection symptoms, least-open access. |
| 10 | DNS and load balancing | Route 53 concepts, load balancer health, target registration, routing symptoms. |
| 11 | IAM operations | Users, roles, policies, permission boundaries conceptually, access troubleshooting. |
| 12 | Encryption and secrets | KMS concepts, encryption at rest/in transit, secrets handling, access patterns. |
| 13 | Logging and audit | CloudTrail, AWS Config concepts, log retention, investigation trails. |
| 14 | Weekly timed set | Timed mixed set focused on networking and security. Review deeply. |
Week 3: deployment, reliability, backup, and cost
| Day | Focus | Actions |
|---|---|---|
| 15 | CloudFormation operations | Stack lifecycle, updates, rollback concepts, drift awareness. |
| 16 | Deployment troubleshooting | Failed updates, configuration drift, launch template issues, safe rollback. |
| 17 | Backup and recovery | Snapshots, backups, restore choices, multi-AZ recovery thinking. |
| 18 | Storage operations | S3 operational controls, EBS/EFS use cases, lifecycle and access symptoms. |
| 19 | Reliability operations | Health checks, scaling, fault isolation, recovery actions. |
| 20 | Cost and governance | Tagging, budgets, usage visibility, lifecycle rules, rightsizing signals. |
| 21 | Full mixed review | Larger timed set; update final weak-area list. |
Week 4: mocks, weak areas, and final review
| Day | Focus | Actions |
|---|---|---|
| 22 | Mock 1 | Full timed mock. Record timing problems and weak topics. |
| 23 | Mock 1 review | Review every missed and guessed question. Write corrections. |
| 24 | Weak-area sprint | Target the lowest two domains from Mock 1. |
| 25 | Hands-on/diagram repair | Rebuild request paths, IAM access paths, alarm flows, and recovery flows. |
| 26 | Mock 2 or large timed set | Take another full mock if you have stamina; otherwise use a large timed set. |
| 27 | Mock 2 review | Compare mistakes to Mock 1. Focus on repeated errors. |
| 28 | Final service selection | Create one-page notes: when to use each service or feature. |
| 29 | Light mixed practice | Short timed set, no heavy new topics. |
| 30 | Final review | Review missed-question log and rest. |
60/90-day full preparation path
Use this path if you are newer to AWS operations, returning after a break, or studying around a demanding work schedule.
Phase structure
| Phase | 60-day version | 90-day version | Goal |
|---|---|---|---|
| Foundation | Days 1-10 | Days 1-18 | Understand core AWS operational building blocks |
| Domain coverage | Days 11-35 | Days 19-55 | Work through all SOA-C03 topic areas |
| Hands-on consolidation | Days 36-45 | Days 56-70 | Practice operational workflows and troubleshooting |
| Timed exam practice | Days 46-55 | Days 71-82 | Build speed and scenario recognition |
| Final review | Days 56-60 | Days 83-90 | Close weak areas and protect exam readiness |
Phase 1: foundation
| Topic | What to learn | Practice action |
|---|---|---|
| AWS account and region basics | Regions, Availability Zones, resource scope | Identify whether a service or setting is regional, zonal, or global. |
| IAM basics | Principals, policies, roles, temporary credentials | Trace why an action is allowed or denied. |
| VPC basics | Subnets, routes, security groups, NACLs | Draw traffic flow from a private instance to an AWS service. |
| Compute basics | EC2, Auto Scaling, load balancing | Explain what happens when an instance fails a health check. |
| Monitoring basics | Metrics, logs, alarms, events | Choose the best signal for a failure scenario. |
Phase 2: domain coverage rotation
Repeat this weekly pattern until all major topic areas have been covered.
| Day type | Focus | Actions |
|---|---|---|
| Day A | Concept review | Study one topic area from the exam guide. Make concise notes. |
| Day B | Hands-on or diagram | Use the console, AWS CLI, or architecture diagrams to reinforce the topic. |
| Day C | Targeted questions | Complete 25-40 questions on that topic. |
| Day D | Missed-question repair | Re-study only the concepts you missed. |
| Day E | Mixed questions | Complete a timed mixed set. |
| Weekend block | Integration | Combine topics: IAM plus networking, monitoring plus Auto Scaling, deployment plus rollback. |
Phase 3: hands-on consolidation
Focus on operational workflows, not building large projects.
| Workflow | What to practice |
|---|---|
| Alarm-to-action flow | Metric or log signal, alarm condition, notification or automated response, verification. |
| Failed instance recovery | Status checks, Auto Scaling replacement, AMI or launch template review, log collection. |
| Private subnet access | Route table, NAT or endpoint path, security group, NACL, DNS, IAM permissions. |
| Patch or command execution | Systems Manager prerequisites, instance targeting, command result review, failure causes. |
| Stack update failure | CloudFormation event review, rollback behavior, dependencies, drift awareness. |
| Access denied investigation | Identity policy, resource policy where applicable, role assumption, encryption key access. |
| Cost anomaly review | Usage signal, tags, budgets, lifecycle rules, rightsizing indicators. |
Phase 4: timed exam practice
| Week | Timed work | Review work |
|---|---|---|
| First timed week | One full mock or two large timed sets | Identify timing issues, repeated weak areas, and careless errors. |
| Second timed week | One full mock under stricter exam-like conditions | Review every miss and guess; rebuild weak notes. |
| Final timed check | Shorter mixed timed set | Confirm stability without exhausting yourself. |
Phase 5: final review
Use the final 5-7 days from the 7-day sprint. Do not keep expanding the study scope at the end.
Hands-on review checklist for SOA-C03
You do not need to memorize every console screen. You should be able to reason through where to look, what to check, and what action is safest.
| Area | Hands-on or diagram task |
|---|---|
| CloudWatch metrics and alarms | Identify which metric would detect a failure and what alarm action should happen. |
| CloudWatch Logs | Find the relevant log group, search for error patterns, and connect logs to the resource. |
| EventBridge | Explain how an operational event can trigger notification or automation. |
| Systems Manager | Know what must be in place for managed instances and remote commands. |
| EC2 and Auto Scaling | Trace instance launch, health checks, replacement, and scaling behavior. |
| Load balancers | Diagnose unhealthy targets, listener issues, target group health, and security group paths. |
| VPC networking | Draw subnet, route table, NAT, endpoint, security group, and NACL paths. |
| IAM | Trace identity, role, policy, and resource access. |
| CloudFormation | Review stack events, update behavior, rollback concepts, and drift. |
| Backup and recovery | Choose snapshot, backup, restore, or multi-AZ recovery actions. |
| Cost controls | Use tags, budgets, lifecycle policies, and usage reports conceptually. |
Useful practice prompts
Use these prompts to force scenario thinking:
- “A private EC2 instance cannot reach an AWS service. What are the possible network paths?”
- “An Auto Scaling group is replacing instances repeatedly. What health checks and launch settings should be reviewed?”
- “A user receives access denied when reading encrypted data. Which permissions might be missing?”
- “A deployment failed after a stack update. Where do you check first, and what rollback options exist?”
- “An alarm did not fire during an incident. Was the metric, threshold, period, evaluation logic, or notification path wrong?”
- “Costs increased unexpectedly. Which visibility and governance tools help narrow the cause?”
Lightweight command and query familiarity
SOA-C03 is not a scripting exam, but CloudOps candidates should be comfortable recognizing operational commands, logs, and query patterns.
AWS CLI review examples
aws cloudwatch describe-alarms
aws logs describe-log-groups
aws ec2 describe-instances
aws autoscaling describe-auto-scaling-groups
aws elbv2 describe-target-health --target-group-arn <target-group-arn>
aws cloudformation describe-stack-events --stack-name <stack-name>
Practice identifying what each command helps investigate. Do not memorize long command syntax at the expense of understanding the operational workflow.
CloudWatch Logs Insights pattern
fields @timestamp, @message
| filter @message like /ERROR|Exception|Timeout/
| sort @timestamp desc
| limit 20
Know when log analysis is more useful than metric review, and when a metric alarm is more useful than manually searching logs.
Missed-question review method
A missed-question log is more valuable than a larger question count. Track both wrong answers and guessed correct answers.
| Field | What to write |
|---|---|
| Date | When you answered it |
| Topic | Monitoring, IAM, VPC, Auto Scaling, CloudFormation, cost, etc. |
| Question type | Service selection, troubleshooting, security, deployment, reliability, cost |
| Why you missed it | Knowledge gap, keyword missed, confused services, rushed, changed answer, weak elimination |
| Correct rule | One sentence that would help you answer next time |
| Retest date | When you will try similar questions again |
Classify the mistake
| Mistake type | Repair action |
|---|---|
| Did not know the service feature | Review the service concept and do 10-15 targeted questions. |
| Confused two services | Make a comparison table with when to use each one. |
| Missed a keyword | Underline constraints: least operational effort, fastest recovery, most secure, cost-effective, highly available. |
| Chose a technically possible but poor answer | Ask which option is most AWS-native, operationally safe, and aligned with the scenario. |
| Ran out of time | Practice smaller timed sets and set a per-question decision limit. |
| Repeated the same error | Move that topic into the next day’s first study block. |
The three-pass review
- Immediate review: Read the explanation and identify the rule you missed.
- Next-day review: Re-answer similar questions without looking at notes.
- Final-week review: Revisit only repeated misses and high-risk topics.
How to use timed mock exams
Timed mocks are for readiness and pacing. They are not the main way to learn new material.
| Stage | Mock use | What to measure |
|---|---|---|
| Beginning | Diagnostic set, not necessarily full length | Weak topics and baseline timing |
| Middle | Large timed sets by topic or mixed domain | Scenario recognition and stamina |
| Final 2 weeks | Full timed mock | Timing, endurance, repeated weak areas |
| Final 48 hours | Avoid heavy mocks unless you are calm and reviewing well | Confidence and light recall only |
After every full mock
Do this before taking another one:
- Review every missed question.
- Review every question you guessed correctly.
- Identify the top 3 repeated topics.
- Identify whether misses came from knowledge, speed, or wording.
- Write 10-20 final correction notes.
- Schedule one targeted repair block before the next mock.
Taking three mocks without reviewing them carefully is usually less effective than taking one mock and repairing it well.
Service-selection review table
Many SOA-C03 questions test whether you can choose the most appropriate operational tool.
| Need | Common AWS area to consider | Study note |
|---|---|---|
| Monitor resource metrics | Amazon CloudWatch | Know metric, alarm, dashboard, and notification flow. |
| Search application or system logs | CloudWatch Logs | Know log groups, log streams, retention concepts, and query use. |
| React to operational events | Amazon EventBridge | Know event pattern and target conceptually. |
| Run commands on managed instances | AWS Systems Manager | Know prerequisites and common failure causes. |
| Automate operational tasks | Systems Manager Automation | Know when runbooks reduce manual actions. |
| Track API activity | AWS CloudTrail | Know investigation and audit use cases. |
| Evaluate configuration state | AWS Config | Know configuration history and rule concepts. |
| Deploy infrastructure as code | AWS CloudFormation | Know stack events, updates, rollback, and drift concepts. |
| Manage scaling | Amazon EC2 Auto Scaling | Know health checks, desired capacity conceptually, and replacement behavior. |
| Distribute traffic | Elastic Load Balancing | Know listeners, target groups, health, and security paths. |
| Control identity permissions | AWS Identity and Access Management | Know roles, policies, and access troubleshooting. |
| Protect data keys and encryption | AWS Key Management Service | Know key access and encryption dependency patterns. |
| Improve private access to AWS services | VPC endpoints | Know when endpoints avoid public internet paths. |
| Control cost visibility | AWS Budgets and cost tools | Know alerting, tagging, and usage review concepts. |
Troubleshooting review flow
Use this order when answering operational troubleshooting questions.
| Step | Ask | Examples |
|---|---|---|
| 1 | What changed? | Deployment, policy, route, scaling setting, certificate, image, patch. |
| 2 | What is the symptom? | Timeout, access denied, unhealthy target, failed health check, high latency, missing logs. |
| 3 | Where is the boundary? | Client, DNS, network, load balancer, instance, application, IAM, encryption, storage. |
| 4 | What evidence exists? | Metrics, logs, events, stack events, CloudTrail, health checks. |
| 5 | What is the safest fix? | Roll back, replace, scale, restore, adjust policy, correct route, automate repair. |
| 6 | How is recurrence prevented? | Alarm, runbook, automation, least privilege, backup, validation, governance. |
Final-week rules
Use these rules regardless of whether you followed the 7-day, 14-day, 30-day, or 60/90-day plan.
| Time remaining | What to do | What to avoid |
|---|---|---|
| 7 days | Take or review a timed mock, rank weak areas | Starting broad new courses |
| 5 days | Repair top weak areas with targeted practice | Reading passively for hours |
| 3 days | Review service-selection notes and repeated misses | Chasing obscure details |
| 2 days | Light timed set, diagrams, missed-question log | Full-day cramming |
| 1 day | Rest, logistics, light recall | Heavy mock exams and new topics |
| Exam day | Pace carefully, read constraints, eliminate distractors | Second-guessing every answer |
When to stop adding new material
Stop adding major new material when either condition is true:
- You are within 48 hours of the exam.
- New topics are reducing your confidence and preventing review of known weak areas.
At that point, focus on:
- Repeated missed-question patterns
- Common troubleshooting flows
- IAM, networking, monitoring, and deployment decision points
- Timing and careful reading
Exam-readiness checks
You are not looking for perfection. You are looking for stable, explainable performance.
| Readiness check | You are ready when |
|---|---|
| Timed practice | You can complete timed sets without rushing the final questions. |
| Missed-question review | You can explain why your wrong answers were wrong. |
| Service selection | You can choose between similar AWS operational services based on the scenario. |
| Troubleshooting | You can follow evidence from symptom to likely cause. |
| Security operations | You can reason through IAM, encryption, logging, and least privilege. |
| Networking | You can trace traffic through routes, security groups, NACLs, NAT, endpoints, DNS, and load balancers. |
| Deployment | You understand stack events, rollback concepts, drift, automation, and safe recovery. |
| Monitoring | You can connect metrics, logs, alarms, events, and notifications to operational outcomes. |
Red flags before scheduling
Consider delaying or increasing study time if:
- You cannot explain most missed answers after reading the explanation.
- You repeatedly confuse IAM, networking, and encryption failure symptoms.
- You have not done any timed mixed practice.
- You depend on memorized phrases instead of scenario reasoning.
- Your practice performance changes dramatically from one set to the next.
Practical next step
Choose the plan that matches your exam date, take a diagnostic practice set, and build your missed-question log today. Then use targeted SOA-C03 practice to repair weak areas before adding more study material.