AWS CloudOps Engineer SOA-C03: Complete Study Guide 2026

The AWS Certified CloudOps Engineer – Associate (SOA-C03) replaced the AWS Certified SysOps Administrator – Associate (SOA-C02) in late 2025, bringing containers, multi-account architectures, and deeper infrastructure-as-code coverage into scope. If you are studying with SOA-C02 materials, you are preparing for an exam that no longer exists. This guide breaks down every domain, the key content changes, a proven eight-week study plan, and the hands-on labs you must complete before sitting the exam.

What Changed: SysOps to CloudOps

AWS announced the certification rename on July 15, 2025, and registration for the new exam opened on September 9, 2025. The final day to take the old SOA-C02 was September 29, 2025, meaning only SOA-C03 is available now. The name change from “SysOps Administrator” to “CloudOps Engineer” reflects an industry-wide shift in terminology — the role is no longer just server administration, but end-to-end cloud operations including automation, observability, and containerized workloads (AWS Training and Certification Blog).

The rebrand is not cosmetic. AWS worked with subject matter experts to add three major content areas that the previous exam never tested. Containers — Amazon ECS, EKS, and ECR — are now in scope. Multi-account and multi-Region architectures carry more weight, reflecting how production AWS environments actually operate in 2026. Automation and infrastructure as code got deeper coverage, with CloudFormation, the AWS CDK, AWS Systems Manager, and third-party tools like Terraform all appearing in the exam guide (official SOA-C03 Exam Guide).

Critically, no task statements were removed between exam versions. AWS only added and reorganized content. If you previously studied for SOA-C02, your foundation is valid — but you have gaps to fill, and those gaps are exactly where candidates lose points.

SOA-C03 Exam Structure and Format

The SOA-C03 exam costs $150 USD and is delivered through Pearson VUE, either at a testing center or online with a proctor. You get 130 minutes to complete 65 questions: 50 scored and 15 unscored. The unscored questions are not identified and are used by AWS to evaluate future exam content, so treat every question as if it counts (AWS Certification page).

Question types include multiple choice (one correct answer from four options) and multiple response (two or more correct answers from five or more options). The exam uses a compensatory scoring model — you do not need to pass each domain individually, only the exam as a whole. Your raw score is scaled to a range of 100–1,000, and the minimum passing score is 720. Unanswered questions count as incorrect, so you should never leave a question blank.

The languages offered are English, Japanese, Korean, and Simplified Chinese. If English is not your first language, you can request a 30-minute time accommodation through the Pearson VUE scheduling portal — but you must request it before booking, not on exam day. The certification is valid for three years from the date you pass.

Domain Breakdown and Weightings

The exam is organized into five content domains, each with specific task statements and skills. Understanding the weightings tells you where to invest your study hours. Three domains each carry 22 percent of the scored content, making them your priority focus areas (SOA-C03 Exam Guide).

Domain	Topic	Weight
1	Monitoring, Logging, Analysis, Remediation, and Performance Optimization	22%
2	Reliability and Business Continuity	22%
3	Deployment, Provisioning, and Automation	22%
4	Security and Compliance	16%
5	Networking and Content Delivery	18%

Domain 1 tests your ability to configure CloudWatch metrics, alarms, and dashboards, including composite alarms and cross-account observability. You need to know how to configure the CloudWatch agent on EC2 instances and ECS or EKS clusters, and how to route notifications through Amazon SNS and EventBridge. Domain 2 covers auto scaling, high availability, backup and restore strategies, and disaster recovery — including RTO and RPO calculations. Domain 3 is where infrastructure as code lives: CloudFormation, the CDK, StackSets, EC2 Image Builder, Systems Manager automation, and event-driven patterns using Lambda and S3 Event Notifications.

Domain 4 focuses on IAM, encryption (KMS, ACM), Security Hub, GuardDuty, AWS Config, and Inspector — plus multi-account security strategies. Domain 5 covers VPC design, Route 53 routing policies, CloudFront, transit gateways, VPC flow logs, and network troubleshooting. Every domain expects hands-on familiarity, not just theoretical knowledge.

The Container Question: What’s New

The single biggest content addition in SOA-C03 is containers. Amazon ECS, EKS, and ECR now appear across multiple domains, and this is where candidates using SOA-C02 study materials get caught. The official exam guide explicitly lists the CloudWatch agent configuration for ECS clusters and EKS clusters as a scored skill under Domain 1. Container logs appear in the networking troubleshooting domain (Skill 5.3.2 references “container logs” alongside VPC flow logs and CloudFront logs).

In Domain 3, Skill 3.1.1 covers creating and managing container images — including Amazon EC2 Image Builder for AMIs and container image pipelines. You need to understand how to build, push, and manage images in ECR, how to deploy containerized workloads on ECS (both EC2 and Fargate launch types), and the basics of EKS cluster operations. The target candidate description now explicitly requires “containerization and orchestration basics” and “understanding of continuous integration and continuous delivery (CI/CD) and Git” as recommended general IT knowledge.

If you have never run a container on AWS, allocate at least two full study sessions to hands-on ECS and EKS labs. Deploy a simple web application on ECS with Fargate, configure a load balancer in front of it, set up CloudWatch monitoring for the cluster, and practice scaling policies. That single exercise touches four exam domains simultaneously.

Your Eight-Week Study Plan

Assuming you have one year of hands-on AWS experience (the recommended prerequisite), an eight-week focused study plan is realistic. If you are transitioning from on-premises infrastructure with minimal cloud exposure, extend this to twelve weeks and start with the AWS Cloud Practitioner fundamentals before tackling VPC and IAM labs.

Weeks 1–2: Monitoring and Logging (Domain 1). Deploy an EC2 instance and configure the CloudWatch agent to collect custom metrics and logs. Create metric filters, alarm thresholds, and composite alarms that trigger SNS notifications. Build a cross-account CloudWatch dashboard. Practice interpreting CloudTrail logs and identifying API call patterns. Spend time with Amazon Managed Service for Prometheus if your organization uses containerized workloads.

Weeks 3–4: Reliability and Automation (Domains 2–3). Build an auto scaling group behind an Application Load Balancer with target tracking policies. Implement a multi-AZ RDS database with automated backups and a read replica. Practice point-in-time recovery and snapshot restores. Then shift to infrastructure as code: write CloudFormation templates, deploy StackSets across multiple accounts, and use Systems Manager Run Command and Automation documents to manage instances at scale. Build an event-driven automation where an S3 upload triggers a Lambda function.

Weeks 5–6: Containers, Security, and Networking (Domains 3–5). Deploy a containerized application on ECS Fargate. Configure ECR image scanning. Then move to security: implement IAM permission boundaries, set up Security Hub with automated remediation via AWS Config rules, and practice KMS key policies for encryption at rest. For networking, build a multi-tier VPC with public and private subnets, configure a NAT gateway, set up Route 53 routing policies (weighted, latency-based, failover), and deploy a CloudFront distribution with caching behavior tuned for your content type.

Weeks 7–8: Practice Exams and Weak-Spot Review. Take the official AWS Certification Practice Question Set and the full practice exam available on AWS Skill Builder. Review every incorrect answer against the exam guide task statements. Rebuild the scenarios you struggled with in the console. The day before the exam, review your notes — do not try to learn new material (AWS Exam Prep Plan).

Hands-On Labs You Must Complete

AWS exams in 2026 have shifted toward applied reasoning rather than pure knowledge recall. Candidates who memorize service limits and feature lists without practical experience consistently underperform. The AWS Certification page recommends a four-step prep plan that includes hands-on practice through AWS Builder Labs, AWS Cloud Quest, and AWS SimuLearn (AWS Certification).

These six lab exercises cover the highest-weighted exam objectives and build the muscle memory you need for scenario-based questions:

CloudWatch cross-account observability: Set up a monitoring account, share CloudWatch data from two source accounts, and create a unified dashboard with cross-account alarms.
Multi-AZ disaster recovery: Deploy an RDS Multi-AZ database, trigger a failover, measure the RTO, and configure an automated snapshot copy to a different Region.
CloudFormation StackSets: Deploy an IAM role across five accounts using AWS Organizations and StackSets, then troubleshoot a permission drift detected by AWS Config.
ECS Fargate deployment: Build a container image, push it to ECR with image scanning enabled, deploy it on ECS Fargate behind an ALB, and configure auto scaling based on CPU utilization.
Systems Manager automation: Create a Systems Manager Automation document that patches a fleet of EC2 instances across multiple Regions and sends a completion notification to an SNS topic.
VPC troubleshooting: Deliberately misconfigure a route table and a security group, then use VPC Flow Logs and the Reachability Analyzer to diagnose and fix the connectivity failure.

Each lab takes 45–90 minutes. The AWS Free Tier covers most of the services involved, but watch your EC2 and NAT gateway costs — tear down resources after each session. The Exam Prep Plan for SOA-C03 on AWS Skill Builder includes guided SimuLearn scenarios that mirror these exercises at no additional cost if you have a Skill Builder subscription.

Common Mistakes That Cost Retakes

Multiple industry analyses of 2026 AWS exam trends highlight a persistent pattern: candidates fail not because they lack knowledge, but because they studied the wrong material or the wrong way (Planetcert AWS Certification Changes 2026). The SOA-C03 has specific traps that catch candidates off guard.

Studying with SOA-C02 materials. This is the most common and most costly mistake. Third-party study guides, practice exams, and video courses created before September 2025 do not cover containers, the updated multi-account content, or the reorganized domain structure. Before purchasing any study resource, verify it explicitly references SOA-C03. If the exam code says SOA-C02, skip it entirely.

Ignoring AI and ML operational considerations. Even though the AI Practitioner certification (AIF-C02) is the dedicated AI credential, SOA-C03 now touches operational considerations for ML workloads on managed services. Candidates who skip this content entirely are leaving points on the table. Search the exam guide for “machine learning” and “managed services” to identify the specific task statements.

Over-relying on practice exams. Practice questions are a diagnostic tool, not a study method. If you score 80 percent on practice exams but cannot configure a CloudFormation StackSet in the console, you will struggle with the scenario-driven questions on the real exam. Use practice exams to identify weak spots, then build hands-on labs to close those gaps.

Neglecting the networking domain. At 18 percent, Domain 5 is not the largest, but networking questions tend to be multi-step and scenario-heavy. Candidates who are strong in monitoring and automation but weak in VPC troubleshooting often fail by a narrow margin. Spend dedicated time on Route 53 routing policies, transit gateways, and VPC flow log interpretation.

What Comes After Certification

The AWS Certified CloudOps Engineer – Associate is valid for three years. You can recertify by passing the latest version of the exam or by earning the AWS Certified DevOps Engineer – Professional, which automatically recertifies this associate-level credential. If you hold both certifications, passing the DevOps Professional exam recertifies both (AWS Training and Certification Blog).

Existing SOA-C02 holders should note an important detail: the name change is not retroactive. Your badge will continue to display “AWS Certified SysOps Administrator – Associate” until it expires. You only earn the “CloudOps Engineer” title by passing SOA-C03. However, your existing certification remains fully valid and recognized until its expiration date — there is no requirement to retake the exam early.

The most common next step is the AWS Certified DevOps Engineer – Professional, which builds directly on the operational skills validated by SOA-C03. Candidates aiming at the developer track may also consider the AWS Developer Associate, which shares significant overlap with automation and CI/CD content. Other professionals pursue the AWS Certified Security – Specialty to deepen their compliance and threat-protection expertise. AWS also offers a 50 percent discount voucher on your next exam after you earn any certification, making sequential certification paths more affordable. Plan your next credential before you finish this one — the momentum from focused study is your most valuable asset. For a cost-efficient approach to maintaining multiple credentials, review a structured certification renewal strategy that minimizes exam fees.