100+ Free AWS CloudOps Engineer (SOA-C03) Practice Questions

Pass your AWS Certified CloudOps Engineer – Associate (SOA-C03) exam on the first try — instant access, no signup required.

✓ No registration✓ No credit card✓ No hidden fees✓ Start practicing immediately

100+ Questions

100% Free

1 / 100

Question 1

Score: 0/0

An operations team needs an immediate notification when EC2 CPU utilization stays above 85% for 10 minutes. Which combination is the simplest implementation?

CloudWatch alarm with an SNS topic action

CloudTrail trail with email subscription

AWS Config rule with custom Lambda

EventBridge rule that polls CloudWatch every minute

to track

2026 Statistics

Key Facts: AWS CloudOps Engineer (SOA-C03) Exam

Sept 30, 2025

SOA-C03 Launch Date

AWS

65 / 130 min

Questions / Time

AWS

720/1000

Passing Score

AWS

$150

Exam Fee (USD)

AWS

3 years

Cert Validity

AWS

Lab removed

vs SOA-C02

AWS exam guide

SOA-C03 (renamed from SysOps Administrator) launched September 30, 2025 with 65 questions in 130 minutes and a 720/1000 passing score. The lab component is removed. Domains 1, 2, and 3 each weigh 22%, Domain 5 (Networking) weighs 18%, and Domain 4 (Security) weighs 16%. New 2026 scope adds containers (ECR, EKS) and IaC (AWS CDK, Terraform, Git). The certification is valid for 3 years and costs US$150.

Sample AWS CloudOps Engineer (SOA-C03) Practice Questions

Try these sample questions to test your AWS CloudOps Engineer (SOA-C03) exam readiness. Each question includes a detailed explanation. Start the interactive quiz above for the full 100+ question experience with AI tutoring.

1An operations team needs an immediate notification when EC2 CPU utilization stays above 85% for 10 minutes. Which combination is the simplest implementation?

A.CloudWatch alarm with an SNS topic action

B.CloudTrail trail with email subscription

C.AWS Config rule with custom Lambda

D.EventBridge rule that polls CloudWatch every minute

Explanation: A CloudWatch metric alarm on CPUUtilization with EvaluationPeriods=10/Period=60 (or 2/300) firing into an SNS topic produces immediate email or SMS notifications. This is the canonical CloudWatch pattern.

2A CloudOps engineer wants a single alarm that fires only when both CPUUtilization > 80% AND NetworkIn > 50 MB/s on the same instance. Which CloudWatch feature is purpose-built for this?

A.Anomaly detection band

B.Composite alarm using ALARM("cpu") AND ALARM("net")

C.Metric math expression with IF()

D.Contributor Insights rule

Explanation: Composite alarms combine multiple existing alarms with Boolean logic (AND, OR, NOT) and emit a single state, which reduces alarm noise and lets you require multiple conditions before paging.

3An EC2 fleet does not report memory or disk usage by default. What is the recommended way to publish these metrics to CloudWatch?

A.Enable detailed monitoring on the instance

B.Install the unified CloudWatch agent and configure it for memory and disk

C.Subscribe the EC2 instance to CloudTrail Insights

D.Enable AWS Compute Optimizer

Explanation: Memory and disk are guest-OS metrics that the hypervisor cannot see. The unified CloudWatch agent runs inside the OS, collects mem_used_percent and disk_used_percent, and publishes them as custom metrics under the CWAgent namespace.

4A team wants metric math to compute the 5-minute error rate as Errors/Requests * 100, returning NaN if Requests is zero. Which expression is correct?

A.SUM(METRICS()) * 100

B.IF(m_req > 0, m_err / m_req * 100)

C.ANOMALY_DETECTION_BAND(m_err, 2)

D.RATE(m_err)

Explanation: Metric math IF() guards against division by zero by returning NaN when the condition is false, producing a clean error-rate time series suitable for alarms.

5Which CloudWatch Logs Insights query returns the count of ERROR-level lines per 5-minute bin?

A.fields @message | filter @message like /ERROR/ | stats count() by bin(5m)

B.stats avg(@duration) by @logStream

C.parse @message "* ERROR *" as msg | display msg

D.filter level="ERROR" | sort @timestamp asc | limit 100

Explanation: The Logs Insights idiom for time-bucketed counting is filter the records, then stats count() by bin(5m). bin() groups by time interval and is the canonical way to chart error volume over time.

6A central security account must aggregate read-only views of CloudWatch dashboards and alarms from 30 member accounts without requesting cross-account roles each time. What is the simplest 2026 solution?

A.CloudWatch cross-account observability with a monitoring account and source accounts linked through Oversight

B.Manual STS AssumeRole into each member account from the security account

C.S3 replication of dashboard JSON between accounts

D.Resource Access Manager share of CloudWatch namespaces

Explanation: CloudWatch cross-account observability lets a designated monitoring account view metrics, logs, traces, and Application Insights from linked source accounts without per-call AssumeRole, ideal for organization-wide ops visibility.

7Which CloudWatch alarm pattern best handles a metric whose normal level shifts on weekends and holidays?

A.Static threshold alarm with 3 evaluation periods

B.Anomaly detection alarm using a 2 standard deviation band

C.Composite alarm OR-ing two static alarms

D.Contributor Insights alarm

Explanation: Anomaly detection learns a metric's seasonality (hour-of-day, day-of-week) and alarms when values fall outside the predicted band, making it the right fit for traffic that varies by day type.

8A CloudOps engineer needs to forward all VPC Flow Log records that match a rejected-traffic pattern to a Lambda function for real-time triage. Which feature is correct?

A.CloudWatch Logs metric filter

B.CloudWatch Logs subscription filter to Lambda

C.S3 event notification on the Flow Log bucket

D.CloudTrail Lake federated query

Explanation: Subscription filters on a log group stream matching events in near real time to Lambda, Kinesis Data Streams, or Firehose. Metric filters create a numeric metric, but a subscription filter is required to invoke Lambda per event.

9A compliance team needs to query 18 months of CloudTrail events with SQL across all accounts in an organization. Which option scales best with the lowest operational overhead?

A.Stream events to OpenSearch via subscription filters

B.Enable a CloudTrail Lake organization data store and run SQL queries

C.Athena over the central S3 trail with daily partitions

D.Replay events nightly through a Lambda transformer

Explanation: CloudTrail Lake provides a managed event data store with SQL querying, organization-wide aggregation, and configurable retention up to 7 years, eliminating partition management and OpenSearch operations.

10A CloudOps team wants to audit S3 GetObject API calls on a specific bucket. Which CloudTrail event type must be enabled?

A.Management events

B.Data events for S3

C.Insight events

D.Network activity events

Explanation: Object-level operations like GetObject and PutObject are S3 data events. They are off by default because of volume and cost; enable them per bucket or per prefix in the trail.

About the AWS CloudOps Engineer (SOA-C03) Exam

The AWS Certified CloudOps Engineer – Associate (SOA-C03) is the renamed successor to the AWS Certified SysOps Administrator – Associate (SOA-C02), which retired on September 29, 2025. SOA-C03 validates skills in monitoring, logging, analysis, and remediation; reliability and business continuity; deployment, provisioning, and automation; security and compliance; and networking and content delivery. New scope adds containers (Amazon ECR, Amazon EKS) and infrastructure-as-code (AWS CDK, Terraform, Git). The exam-lab component from SOA-C02 has been removed and the exam is now multiple choice and multiple response only.

Questions

65 scored questions

Time Limit

130 minutes

Passing Score

720/1000

Exam Fee

$150 (AWS / Pearson VUE)

AWS CloudOps Engineer (SOA-C03) Exam Content Outline

22%

Monitoring, Logging, Analysis, Remediation, and Performance Optimization

CloudWatch metrics/alarms/composite/anomaly, Logs Insights, CloudTrail Lake, Config rules and remediation, EventBridge, X-Ray, RDS Performance Insights, Compute Optimizer, Service Quotas, AWS Health

22%

Reliability and Business Continuity

Multi-AZ patterns, Auto Scaling (target tracking, predictive, lifecycle hooks, warm pools, instance refresh), ELB target group attributes, Route 53 routing and health checks, AWS Backup with Vault Lock, DR strategies, Resilience Hub, Aurora Global Database, DynamoDB Global Tables

22%

Deployment, Provisioning, and Automation

CloudFormation (drift, change sets, StackSets), AWS CDK constructs, Terraform with S3 + DynamoDB lock, CodePipeline + CodeDeploy (blue/green for EC2/ECS/Lambda), Systems Manager (Patch, Session, State, Run Command), Image Builder, Beanstalk, Amazon ECR, Amazon ECS, Amazon EKS with IRSA

16%

Security and Compliance

IAM policies and instance profiles, IAM Identity Center, MFA enforcement, KMS multi-Region keys, Secrets Manager rotation, S3 Block Public Access, GuardDuty, Security Hub, Inspector, Macie, AWS WAF, encryption at rest and in transit, SCPs

18%

Networking and Content Delivery

VPC, NAT Gateway HA, Transit Gateway, VPC endpoints (Gateway and Interface/PrivateLink), Route 53 routing/DNSSEC, CloudFront with OAC and CloudFront Functions, Global Accelerator, ALB/NLB attributes, Direct Connect with DX Gateway, Reachability Analyzer, Network Access Analyzer, Flow Logs

How to Pass the AWS CloudOps Engineer (SOA-C03) Exam

What You Need to Know

Passing score: 720/1000
Exam length: 65 questions
Time limit: 130 minutes
Exam fee: $150

Keys to Passing

Complete 500+ practice questions
Score 80%+ consistently before scheduling
Focus on highest-weighted sections
Use our AI tutor for tough concepts

AWS CloudOps Engineer (SOA-C03) Study Tips from Top Performers

1Treat Domain 1, 2, and 3 (each 22%) as the bulk of study time — together they are 66% of the exam

2Build muscle memory in CloudWatch (metric math, composite alarms, anomaly detection, Logs Insights stats by bin())

3Practice CloudFormation drift detection, change sets, and StackSets across accounts and Regions

4Get hands-on with the new C03 container scope: ECR lifecycle and enhanced scanning, ECS deployment circuit breakers, EKS IRSA

5Learn AWS CDK construct levels (L1/L2/L3) and Terraform S3 + DynamoDB lock patterns — both are now in scope

6Master AWS Backup plans with cross-Region copy actions and Vault Lock in compliance mode

7Know the network troubleshooting trio: Reachability Analyzer for path config, Network Access Analyzer for posture, VPC Flow Logs for actual traffic

8Take timed full-length practice exams under 130 minutes and target 80%+ before scheduling

Frequently Asked Questions

What changed when SysOps Administrator (SOA-C02) became CloudOps Engineer (SOA-C03)?

AWS retired SOA-C02 on September 29, 2025 and launched SOA-C03 (renamed AWS Certified CloudOps Engineer – Associate) on September 30, 2025. SOA-C03 keeps 65 questions, 130 minutes, a 720/1000 passing score, and a US$150 fee, but it removes the lab/exam-lab component and adds container topics (Amazon ECR and Amazon EKS) and infrastructure-as-code with AWS CDK, Terraform, and Git. The five-domain structure now combines Monitoring/Logging/Analysis/Remediation/Performance into a single 22% domain, and weights for Reliability (22%) and Deployment/Provisioning/Automation (22%) increased.

What are the SOA-C03 domain weights for 2026?

AWS publishes five domains for SOA-C03: Domain 1 – Monitoring, Logging, Analysis, Remediation, and Performance Optimization (22%); Domain 2 – Reliability and Business Continuity (22%); Domain 3 – Deployment, Provisioning, and Automation (22%); Domain 4 – Security and Compliance (16%); Domain 5 – Networking and Content Delivery (18%).

How many questions and how much time does SOA-C03 give?

SOA-C03 has 65 questions delivered in 130 minutes (typically 50 scored and 15 unscored pretest items). Question types are multiple choice (one correct answer) and multiple response (two or more correct). The exam-lab section that existed in SOA-C02 has been removed, so the entire 130 minutes is multiple choice/response.

What does the SOA-C03 exam cost and how is it scheduled?

The exam costs US$150 and is delivered by Pearson VUE in test centers or as an online proctored OnVUE session. Scheduling is done through aws.training. The certification is valid for 3 years and you can recertify by passing the current SOA-C03 exam or any current Professional or Specialty AWS exam.

What new topics does SOA-C03 add that were not in SOA-C02?

Major SOA-C03 additions: containers (Amazon ECR with lifecycle policies and enhanced scanning, Amazon ECS deployment circuit breakers and capacity providers, Amazon EKS with IRSA, managed node groups, and Fargate profiles); infrastructure-as-code beyond CloudFormation (AWS CDK constructs L1/L2/L3, Terraform with S3 backend and DynamoDB lock, Git-based pipelines); modern operations (CloudTrail Lake, cross-account observability, EventBridge Scheduler, AWS Resilience Hub, AWS Backup restore testing).

Who should take CloudOps Engineer Associate vs Solutions Architect Associate?

Solutions Architect Associate (SAA-C03) focuses on designing architectures ("how should we build this?") while CloudOps Engineer Associate (SOA-C03) focuses on operating, monitoring, and recovering AWS environments ("how do we keep this running and remediate fast?"). SOA-C03 goes deeper on observability, automated remediation, deployment patterns, backup vault locks, and incident response. AWS recommends 1+ year of AWS operations experience for SOA-C03.

How long should I study for SOA-C03?

Most candidates with hands-on AWS operations experience need 8–12 weeks at 8–10 hours per week (about 80–120 hours). Plan extra time on the new container and IaC topics if you have not used Amazon EKS, AWS CDK, or Terraform in production. Aim to score 80%+ on full-length practice exams before scheduling, and complete hands-on labs for CloudWatch, Systems Manager, AWS Backup, CloudFormation/CDK, and EKS.