Play free

AWS · Certification path · SOA-C03

SOA-C03: CloudOps Engineer - Associate

32 stages in study order, about 14.5 hours to complete, drawn from Networking, Security, Core architecture and Operations and delivery. Each stage names the section of the SOA-C03 exam guide it practises.

Open the path in the game The exam guide

The path, in study order

32 stages5 free without buying

  1. 1Measure ItFreeOperations and delivery · Ops World 1 · Skill 1.1.1, Skill 1.1.2, Skill 1.3.1
  2. 2Alarm ActionsOperations and delivery · Ops World 1 · Skill 1.1.3, Skill 1.1.5, Skill 1.2.1
  3. 3Keep the LogsOperations and delivery · Ops World 1 · Skill 1.1.1
  4. 4Trace the RequestOperations and delivery · Ops World 1 · Skill 1.1.1
  5. 5One PaneOperations and delivery · Ops World 1 · Skill 1.1.4
  6. 6Watch DeskOperations and delivery · Ops World 1 · Skill 1.1.2, Skill 1.1.3, Skill 5.3.5
  7. 7Volumes That FitFreeCore architecture · Architecture World 1 · Skill 1.3.2
  8. 8Back It UpCore architecture · Architecture World 1 · Skill 2.3.1, Skill 2.3.2
  9. 9Storage DeskCore architecture · Architecture World 1 · Skill 1.3.2, Skill 1.3.3, Skill 1.3.4
  10. 10Survive the ZoneCore architecture · Architecture World 2 · Skill 2.2.2, Skill 1.3.5
  11. 11Database DeskCore architecture · Architecture World 2 · Skill 1.3.5, Skill 2.1.3
  12. 12Balance the LoadCore architecture · Architecture World 3 · Skill 2.2.1
  13. 13Scale on a SignalCore architecture · Architecture World 3 · Skill 2.1.1, Skill 1.1.3
  14. 14Lose a ZoneCore architecture · Architecture World 3 · Skill 2.2.1, Skill 2.2.2
  15. 15Fleet DeskCore architecture · Architecture World 3 · Skill 2.1.1, Skill 2.2.1
  16. 16Open for BusinessFreeNetworking · World 1 · Skill 5.1.1, Skill 5.3.1
  17. 17Private but ConnectedFreeNetworking · World 1 · Skill 5.1.1, Skill 5.3.1, Skill 5.1.4
  18. 18Shortcut to S3Networking · World 1 · Skill 5.1.2, Skill 5.1.4
  19. 19Across the FenceNetworking · World 2 · Skill 5.1.2
  20. 20Tunnel VisionNetworking · World 2 · Skill 5.3.4
  21. 21Name GameNetworking · World 3 · Skill 5.2.1
  22. 22Two RegionsNetworking · World 3 · Skill 5.2.2, Skill 2.3.4
  23. 23Global EdgeNetworking · World 4 · Skill 5.2.3
  24. 24Deny WinsFreeSecurity · Security World 1 · Skill 4.1.1
  25. 25Who Are YouSecurity · Security World 1 · Skill 4.1.1
  26. 26Fence the OrgSecurity · Security World 2 · Skill 4.1.3, Skill 4.1.5
  27. 27Prove ItSecurity · Security World 2 · Skill 4.1.5, Skill 4.2.5
  28. 28At Rest EverywhereSecurity · Security World 3 · Skill 4.2.2
  29. 29Front DoorSecurity · Security World 4 · Skill 5.1.3
  30. 30Hardened HostsSecurity · Security World 4 · Skill 4.2.5
  31. 31Threshold AlarmSecurity · Security World 5 · Skill 1.1.3
  32. 32Missing LogsSecurity · Security World 5 · Skill 1.1.1, Skill 1.1.2, Skill 5.3.2

Articles on SOA-C03

One topic each, from the documentation, ending at a stage you can play

SOA-C03 · Core architecture

gp3, io2, st1 or sc1: choosing an EBS volume by the numbers

gp3 includes 3,000 IOPS at any size, io2 is the sub-millisecond volume, st1 sells throughput by the TiB, and the instance sets the last ceiling.

Ends at Volumes That FitFree5 min read · video coming

SOA-C03 · Operations and delivery

Why CloudWatch shows no memory for your EC2 instance

EC2 publishes CPU, network, disk operations and status checks. Memory and disk space live inside the guest, where the CloudWatch agent reads them.

Ends at Measure ItFree5 min read · video coming

SAA-C03 · Networking

How a private subnet reaches the internet: the NAT gateway, hop by hop

A NAT gateway lets private instances start connections out while nothing on the internet starts one in. Follow every hop, and see the address the far end sees.

Ends at Private but Connected Free at release6 min read · video coming

SCS-C03 · Security

How AWS decides a request: why an explicit deny always wins

Every request starts denied. An Allow lets it through, and one Deny in any policy ends it. The order AWS reads policies in, and how to find the Deny.

Ends at Deny WinsFree5 min read · video coming

SAA-C03 · Networking

Security group or network ACL: which one dropped the packet?

Security groups are stateful and only allow. Network ACLs are stateless, numbered and can deny. Follow one HTTPS request to see which layer drops what.

Ends at Guard Rails Paid5 min read · video coming

SAP-C02 · Networking

Transit gateway route tables: association and propagation, with one packet

Association picks the table a packet is looked up in. Propagation picks which tables know a VPC. Follow one packet to see how a transit gateway segments.

Ends at Routing Domains Paid5 min read · video coming

SAA-C03 · Networking

What actually makes a subnet public

Not its name, not a public IP, not the gateway alone. The subnet's route table decides, and the main route table decides for every subnet you forgot.

Ends at Open for BusinessFree5 min read · video coming

SAA-C03 · Networking

Why can't my private subnet reach S3? Gateway and interface endpoints

With no internet gateway or NAT, a private subnet can still reach AWS services. A gateway endpoint adds a route; an interface endpoint adds an address.

Ends at Shortcut to S3 Paid5 min read · video coming

Every article on SOA-C03

Guide sections the path practises

SectionAs the guide words itStages
Skill 1.1.4Create, implement, and manage customizable and shareable CloudWatch dashboards that display metrics and alarms for AWS resources across multiple accounts and AWS Regions1
Skill 1.1.5Configure AWS services to send notifications to Amazon SNS and to invoke alarms that send notifications to Amazon SNS1
Skill 1.2.1Analyze performance metrics and automate remediation strategies by using AWS services and functionality (for example, CloudWatch, Lambda, AWS Systems Manager, CloudTrail, Kiro, AWS DevOps Agent)1
Skill 1.3.1Optimize compute resources and remediate performance problems by using performance metrics, resource tags, and AWS tools1
Skill 5.3.5Configure and analyze CloudWatch network monitoring services1
Skill 4.1.3Implement multi-account strategies securely (for example, AWS Organizations, service control policies, IAM Identity Center)1
Skill 4.1.1Implement IAM features (for example, password policies, multi-factor authentication [MFA], roles, federated identity, resource policies, policy conditions)2
Skill 1.1.1Use AWS services (for example, Amazon CloudWatch, AWS CloudTrail, Amazon Managed Service for Prometheus) to configure monitoring and logging for workloads (for example, serverless, compute, AI)4
Skill 1.1.2Configure and manage the CloudWatch agent to collect metrics and logs from EC2 instances, Amazon ECS clusters, or Amazon EKS clusters3
Skill 1.1.3Configure, identify, and troubleshoot CloudWatch alarms that can invoke AWS services directly or through Amazon EventBridge (for example, by creating composite alarms and identifying their invokable actions)4
Skill 4.1.5Enforce compliance requirements and continuous monitoring2
Skill 4.2.2Implement, configure, and troubleshoot encryption at rest (for example, AWS KMS)1
Skill 2.1.1Configure and manage scaling mechanisms in compute environments2
Skill 2.3.1Automate snapshots and backups for AWS resources (for example, EC2 instances, RDS DB instances, EBS volumes, S3 buckets, DynamoDB tables) by using AWS services (for example, AWS Backup)1
Skill 4.2.5Configure reports and remediate findings from AWS services (for example, AWS Security Hub, Amazon GuardDuty, AWS Config, Amazon Inspector, AWS Security Agent)2
Skill 5.1.1Configure a VPC2
Skill 5.1.2Configure private networking connectivity2
Skill 5.1.3Audit AWS network protection services in a single account1
Skill 5.1.4Optimize the cost of network architectures2
Skill 5.2.1Configure DNS1
Skill 5.2.2Implement Route 53 routing policies, configurations, and query logging1
Skill 5.2.3Configure content and service distribution1
Skill 5.3.1Troubleshoot VPC configurations2
Skill 5.3.2Collect and interpret networking logs to troubleshoot issues1
Skill 5.3.4Identify and troubleshoot hybrid connectivity issues and private connectivity issues1
Skill 1.3.2Analyze Amazon EBS performance metrics, troubleshoot issues, and optimize volume types to improve performance and reduce cost2
Skill 1.3.3Implement and optimize S3 performance strategies (for example, AWS DataSync, S3 Transfer Acceleration, multipart uploads, S3 Lifecycle policies) to enhance data transfer, storage efficiency, and access patterns1
Skill 2.2.1Configure and troubleshoot Elastic Load Balancing (ELB) and Amazon Route 53 health checks3
Skill 1.3.4Evaluate and select shared storage solutions (for example, Amazon EFS, Amazon FSx, Amazon S3 Files), and optimize the solutions (for example, EFS lifecycle policies) for specific use cases and requirements1
Skill 2.3.2Use various methods to restore databases (for example, point-in-time restore) to meet recovery time objective (RTO), recovery point objective (RPO), and cost requirements1
Skill 2.3.4Follow disaster recovery procedures and best practices (for example, backup and restore, pilot light, warm standby, active/active)1
Skill 1.3.5Monitor Amazon RDS metrics (for example, Amazon RDS Performance Insights, CloudWatch alarms) and modify configurations to increase performance efficiency (for example, Performance Insights proactive recommendations, RDS Proxy)2
Skill 2.1.3Configure and manage scaling in AWS managed databases (for example, Amazon RDS, DynamoDB)1
Skill 2.2.2Configure fault-tolerant systems (for example, Multi-AZ deployments)2

A domain and a path are separate products. What you own is the union of what you bought, so a stage you already own is never sold to you twice: the game offers the cheapest way to unlock the stage in front of you. Path $15, exam $150.