AWS CloudOps Engineer Associate (SOA-C03) exam guide

AWS Certified CloudOps Engineer – Associate is the new name for SysOps Administrator – Associate, and SOA-C03 is its exam. It has been the only version you can book since September 30, 2025: 65 questions, 130 minutes, 150 USD, and five domains about running workloads on AWS rather than designing or coding them.

This guide covers what the exam looks like as of October 2026, what happened to SysOps and to the people who already hold it, what changed from SOA-C02 (including a June 2026 update many study guides still miss), what each domain expects in practice, how it compares with the other associate exams, and how to prepare. Every exam fact was checked on AWS's certification page and exam guide on October 21, 2026.

SOA-C03 at a glance

As of October 2026, the exam has this format:

Full name: AWS Certified CloudOps Engineer – Associate, exam code SOA-C03.
Questions: 65, of which 50 are scored and 15 are unscored. The unscored ones are not marked, so treat every question as if it counts.
Time: 130 minutes.
Question types: multiple choice (one right answer out of four) and multiple response (two or more right answers out of five or more). Nothing else.
Passing score: 720 on a scale of 100 to 1,000. Scoring is compensatory, so you pass on your overall result, not domain by domain.
Price: 150 USD.
Delivery: at a Pearson VUE test centre or online with a remote proctor.
Languages: English, Japanese, Korean and Simplified Chinese. AWS says the Korean and Simplified Chinese versions retire after November 19, 2026.
Validity: three years.

There is no required prerequisite. AWS recommends about one year of experience deploying, managing and troubleshooting workloads on AWS, plus a year in a related operations role such as system administrator. It also expects you to know one scripting language, one major operating system, the basics of containers and their orchestration, CI/CD and Git, and both the AWS CLI and console.

You can find the official details on the CloudOps Engineer – Associate certification page and the SOA-C03 exam guide.

What happened to SysOps Administrator

AWS renamed the certification when it replaced the exam. SOA-C02, the SysOps Administrator – Associate exam, was in use until September 29, 2025. SOA-C03, under the CloudOps Engineer name, started the next day. The code kept its SOA prefix, and the exam guide's web address still contains "sysops-administrator-associate-03".

If you already hold SysOps Administrator, you don't need to do anything. AWS states that your certification stays valid for three years from the date you earned it, and the title is not changed retroactively. The CloudOps Engineer name goes only to people who pass SOA-C03, so a SysOps holder who wants the new title has to pass the new exam, typically when it is time to renew.

The content moved on as well. The new exam adds deploying CloudFormation and CDK stacks, running the CloudWatch agent on ECS and EKS, and enforcing compliance across accounts, and its in-scope list includes Amazon ECR, ECS and EKS.

What changed from SOA-C02 to SOA-C03

Six domains became five

AWS's comparison page lists the changes. The old sixth domain, Cost and Performance Optimization (12% of SOA-C02), is gone. Its performance tasks moved into the first domain, which was renamed from "Monitoring, Logging, and Remediation" to "Monitoring, Logging, Analysis, Remediation, and Performance Optimization". The freed-up weight went to the first three domains:

Monitoring and remediation: 20% in SOA-C02, 22% in SOA-C03.
Reliability and business continuity: 16%, now 22%.
Deployment, provisioning and automation: 18%, now 22%.
Security and compliance: 16%, unchanged.
Networking and content delivery: 18%, unchanged.

Cost didn't vanish completely. Network cost, Compute Optimizer and EBS cost choices are still in scope. What the guide puts out of scope is analysing total cost of ownership and managing billing.

New skills

The comparison page names several additions: installing the CloudWatch agent on EC2, ECS and EKS; deploying CloudFormation and AWS CDK stacks; enforcing compliance rules such as which Regions and services an account may use; and CloudWatch network monitoring. Amazon S3 static website hosting was removed, and VPNs moved from the security domain to networking.

The June 2026 revision

AWS published version 1.1 of the exam guide on June 1, 2026, so study plans written in 2025 may predate it. It added five services to the in-scope list: Amazon Bedrock, Kiro, AWS DevOps Agent, AWS Security Agent and the AWS Health Dashboard. It also edited individual skills. For example, monitoring now includes AI workloads, the disaster recovery task names pilot light, warm standby and active/active, and the compliance task names AWS Organizations, service control policies and IAM Identity Center.

AWS says it publishes guide revisions at least a month before the exam changes, so the v1.1 guide is the one to study from.

No labs

SOA-C03 has only multiple choice and multiple response questions. AWS lists Builder Labs as preparation material, but there are no hands-on labs inside the exam. If an older course tells you to practise for exam labs, it was written for a different version.

The five domains in practice

Here is what each domain asks you to do, in plain terms, with practice questions on the same skills. There is no SOA-C03 bank on this site yet, so the linked questions come from the DevOps Engineer – Professional and Solutions Architect – Associate banks. They test the same services from a slightly different angle.

Monitoring, logging, analysis, remediation and performance (22%)

This domain is the core of the job. You set up CloudWatch metrics, alarms and filters, including composite alarms and cross-account dashboards, and send notifications through SNS. You install the CloudWatch agent to collect what EC2 does not publish by default. A classic trap is that memory and disk space are missing from the console until the agent is running, which is exactly what this practice question on CloudWatch agent memory metrics tests.

Remediation means wiring a detected problem to a fix: EventBridge rules, Lambda functions and Systems Manager Automation runbooks. Performance covers choosing EBS volume types, S3 and file-system performance features, RDS Performance Insights and RDS Proxy, and EC2 placement groups.

Reliability and business continuity (22%)

Expect scaling questions (Auto Scaling, caching with CloudFront or ElastiCache, read replicas and DynamoDB scaling), high availability with load balancer and Route 53 health checks and Multi-AZ databases, and backup and restore with AWS Backup, point-in-time recovery and versioning. A common scenario: the load balancer marks an instance unhealthy, but Auto Scaling never replaces it. This practice question on Auto Scaling and ELB health checks walks through why.

Disaster recovery strategies are named in the v1.1 guide, so know how backup and restore, pilot light, warm standby and active/active trade recovery time against cost. The AWS disaster recovery strategies guide covers all four.

Deployment, provisioning and automation (22%)

This domain covers building AMIs and container images, deploying with CloudFormation and CDK, sharing resources across accounts with AWS RAM and StackSets, choosing a deployment strategy, and troubleshooting a deployment that failed. The second half is automating what already exists, mostly with Systems Manager: Run Command, State Manager, Patch Manager and Automation.

Patching is a favourite. Scanning for missing patches and installing them inside a maintenance window are two separate operations, and this practice question on patch compliance and maintenance windows turns on knowing the difference. Spotting manual changes is another, covered by this practice question on CloudFormation drift detection.

Security and compliance (16%)

You are expected to apply security controls rather than design them. That means IAM policies and troubleshooting access with CloudTrail, IAM Access Analyzer and the policy simulator; guardrails through AWS Organizations, service control policies and IAM Identity Center; Trusted Advisor and AWS Config conformance packs; encryption with KMS and certificates with ACM; secrets management; and findings from Security Hub, GuardDuty, Inspector and, since v1.1, AWS Security Agent.

Remediation also appears here, for findings from AWS Config, Security Hub and Trusted Advisor. This practice question on AWS Config remediation with an Automation document is a good test of whether you know where the retry setting lives. For the IAM basics, see the guide to IAM roles, users and policies.

Networking and content delivery (18%)

Networking covers VPC configuration, private connectivity with VPC endpoints, PrivateLink and peering, auditing protections such as Route 53 DNS Firewall, AWS WAF, Shield and Network Firewall, and keeping network costs down. DNS and content delivery mean Route 53 Resolver and routing policies, query logging, CloudFront and Global Accelerator. Troubleshooting means reading VPC Flow Logs, load balancer, WAF and CloudFront logs, and fixing hybrid connectivity.

Operations-flavoured networking questions often ask how to reach private instances safely. This practice question on Session Manager replacing a bastion host is typical. The VPC endpoints vs NAT gateway guide covers the private connectivity side.

The services to know, and what's out of scope

AWS's in-scope list is long and, in its own words, non-exhaustive. Beyond the obvious (EC2, VPC, CloudWatch, Systems Manager, CloudFormation, IAM, S3, RDS), these are the ones that set SOA-C03 apart from older material:

Containers: Amazon ECR, ECS and EKS.
Observability: Amazon Managed Service for Prometheus and Amazon Managed Grafana.
Governance: AWS Control Tower, Service Catalog and VPC IP Address Manager.
Resilience: Application Recovery Controller, Aurora Serverless v2, RDS Proxy and DAX.
AI and developer tools (added June 2026): Amazon Bedrock, Kiro, AWS DevOps Agent and AWS Security Agent.

The guide also lists job tasks that are out of scope for this exam: designing distributed architectures, designing CI/CD pipelines, designing hybrid or multi-VPC networks, developing software, defining security or governance requirements, capacity planning, cost and TCO analysis, and billing. Services named out of scope include AppConfig, Amazon MSK, EMR, Lightsail, the migration services, CloudHSM and the AI language and vision services such as Rekognition and Textract.

How SOA-C03 differs from the other associate exams

The three associate exams for builders and operators all cost 150 USD and use the same 65 questions in 130 minutes, so the difference is what they ask you to do:

Focus: CloudOps (SOA-C03) is about operating and fixing what is already running. Solutions Architect (SAA-C03) is about designing solutions against the Well-Architected Framework. Developer (DVA) is about writing, testing and deploying application code.
Typical question: CloudOps asks which setting, alarm or runbook fixes this incident. Solutions Architect asks which design meets these requirements. Developer asks which SDK call, API or deployment option makes this code work.
What's out of scope: CloudOps excludes designing architectures and pipelines and writing software. Developer excludes architecture and pipeline design.
What's changing: CloudOps changed in 2025 and was revised in June 2026. Developer moves from DVA-C02 to DVA-C03 on December 1, 2026. No new Solutions Architect – Associate version has been announced.
Renewal: CloudOps and Developer are both renewed by passing DevOps Engineer – Professional. Solutions Architect – Associate is renewed by Solutions Architect – Professional.

The AWS certification roadmap guide sets out the whole lineup if you are still choosing.

Who should take it, and in what order

Take SOA-C03 if your day is on-call rotations, dashboards, patching, backups and access requests: cloud operations engineers, cloud support engineers, system administrators moving to AWS, and SREs on AWS-heavy teams.

A sensible order for most operations people is:

Solutions Architect – Associate first if you are new to AWS, because it gives the broad service map that every other exam assumes. If you already run AWS workloads every day, start with CloudOps instead.
CloudOps Engineer – Associate.
DevOps Engineer – Professional. It covers much of the same ground at a harder level, and passing it renews your CloudOps certification. If you hold both DevOps Pro and an older SysOps certification, AWS says passing the latest DevOps Pro recertifies both.

You can take them in any order, since AWS has no prerequisites, but this order lets each exam build on the last. If you want practice for the professional step now, the DevOps Engineer – Professional practice tests cover monitoring, Systems Manager, Config and deployment in depth, and the full list of DevOps Pro questions is open to browse.

SOA-C03 cost and how to prepare

The exam costs 150 USD as of October 2026, plus any foreign-exchange charges. AWS's exam-policy page lists local prices too: the 150 USD tier is INR 12,829.50, payable in rupees only through the Pearson voucher store. Once you hold any AWS certification, AWS gives you a 50% discount voucher that you can use on recertification or any other exam.

For preparation, AWS's certification page links a four-step plan on AWS Skill Builder: a practice question set, then a pretest with courses and hands-on labs, then review with flashcards and exam-style questions, and finally an official practice exam. It also lists Builder Labs, AWS Cloud Quest, AWS Jam and SimuLearn. The page labels only AWS Training Live on Twitch as free, so check what your Skill Builder plan includes before counting on the rest. AWS's certification prep page says its Official Practice Question Sets are free.

A practical plan for someone with the recommended year of experience:

Read the v1.1 exam guide and the in-scope service list, and mark anything you have never touched.
Build it in a Free Tier account: a CloudWatch agent with alarms, a Config rule with remediation, a patch baseline with a maintenance window, a CloudFormation stack you then change by hand to see the drift, and an AWS Backup plan.
Work through practice questions in the same areas. The Solutions Architect – Associate practice tests cover the reliability and networking material, and its question list lets you jump straight to Auto Scaling, VPC and backup topics.
Finish with a timed practice exam, giving yourself the real exam's 130 minutes.

Frequently asked questions

Is my SysOps Administrator certification still valid?

Yes. AWS says existing SysOps Administrator – Associate certifications stay valid for three years from the date you earned them, and the title is not changed. You get the CloudOps Engineer title only by passing SOA-C03, or you can keep SysOps current until it expires.

Is the AWS CloudOps Engineer Associate certification worth it?

It is worth it if operations is your job or the job you want. It is the AWS associate exam built around operating workloads (monitoring, remediation, reliability and deployment make up 66% of it), and it leads straight into DevOps Engineer – Professional, which renews it. If you mainly design systems, Solutions Architect – Associate is the better first choice.

How hard is SOA-C03?

It is an associate exam with the same length and passing score as Solutions Architect – Associate (720 out of 1,000). Expect detailed questions: the exact CloudWatch, Systems Manager or Config setting that solves a problem. Without at least some hands-on time on those services, the questions are hard to answer from reading alone.

How much does the CloudOps Engineer exam cost?

150 USD as of October 2026, or INR 12,829.50 through the Pearson voucher store. A 50% voucher applies if you already hold an AWS certification.

Should I take Solutions Architect – Associate or CloudOps first?

If you are new to AWS, Solutions Architect – Associate first. It covers the widest map of services, and much of it reappears in CloudOps. If you already operate AWS every day, CloudOps first is fine, and it matches your work more closely.

Does SOA-C03 have exam labs?

No. As of October 2026, the exam has only multiple choice and multiple response questions. Builder Labs on Skill Builder are optional preparation, not part of the exam.