AWS Certified CloudOps Engineer - Associate (SOA-C03)

Inventory the workload, its owners, dependencies and normal behavior. Distinguish CloudWatch metrics from logs, CloudTrail activity and application traces. Choose a symptom the operator can act on, a time window and a notification destination. For a metric that appears only on errors, decide whether missing data means healthy operation; for a continuously emitted heartbeat, absence may indicate a failure.

Reviewable practice outputCreate a one-page signal map with each metric or log source, its owner, an actionable threshold, missing-data treatment and an expected responder. Record how you would test the notification without causing an incident.

Start with customer impact and the first observed change. Compare application and infrastructure signals over the same time window, then inspect relevant logs, deployment history and CloudTrail events. Separate a failed dependency from a failed caller. Escalate when the evidence indicates a wider service or account issue. Make a reversible change only after writing what improvement you expect to observe.

Reviewable practice outputDraft an incident timeline for a fictional latency spike: impact, hypothesis, two observations that might disprove it, a rollback trigger and the evidence needed to close the incident.

Read utilization and service limits alongside customer-facing latency. Decide whether the right response is tuning, scaling, a quota request or a different workload schedule. Review autoscaling activity and network or storage cost drivers before changing capacity. An alarm about cost should lead to an investigation; it does not itself impose a spending cap.

Reviewable practice outputPrepare a capacity review with current demand, a scaling signal, the expected effect of one change and a way to verify both performance and cost after the change.

Define recovery time and acceptable data loss for the workload. Map them to backups, replication and availability choices; each protects against a different failure. Confirm the backup policy covers the right resource and retention period. Restore a selected recovery point in an isolated environment, validate application data and capture the measured recovery time before trusting the procedure.

Reviewable practice outputWrite a recovery checklist for a sample database, including the recovery-point selection, isolation boundary, validation query, owner, measured elapsed time and cleanup steps.

Read CloudFormation templates as intended state. Review changes and dependencies before applying them, then compare actual resource configuration with the template after manual incident changes. Drift detection covers supported resources and specified properties; it does not prove every property is correct. Document whether an out-of-band change should be codified or reverted before the next deployment.

Reviewable practice outputPrepare a change record for a fictional security-group update: template change, review and approval evidence, safe rollout check, drift finding and a rollback decision.

Identify the calling principal, its role trust, identity permissions, resource policy and any explicit deny before editing access. Separate workload credentials from human administration. Use CloudTrail and configuration evidence to answer what changed and who could perform the action, while respecting retention, account and Region coverage. Do not repair a narrowly scoped failure by attaching broad administrator access.

Reviewable practice outputCreate a redacted access trace for a sample failed S3 read, naming the principal, resource, required action, policy boundaries and one specific test that confirms the least-privilege fix.

Follow a request through DNS, VPC route tables, security groups, network ACLs and the selected load-balancing or endpoint path. Inspect both the forward route and the return path. A healthy DNS response is not proof of connectivity, and an open network path is not data authorization. Use service-specific health and access logs to decide which layer is actually failing.

Reviewable practice outputDraw a private application-to-S3 path with its DNS result, endpoint route and identity decision. Mark the first observation that would separate routing from permission failures.

Combine the five domains in a small operational runbook: detect, diagnose, mitigate, restore and learn. For each practice-test mistake, record the missing observation or boundary rather than memorizing an answer letter. Revisit the official guide because AWS updates exam guides, and verify the exam code when booking.

Reviewable practice outputProduce a runbook and a domain-tagged mistake log. For three weak decisions, write the evidence that would make the correct action safer than the closest alternative.