Read this the night before or on exam morning. It assumes you’ve studied the notes. It’s here to refresh, not to teach.
Exam day
- 65 questions in 130 minutes: 50 scored and 15 unscored questions you can’t identify. Multiple choice (one correct of four) and multiple response (two or more correct of five or more).
- Scaled score 100 to 1,000; you need 720. Compensatory scoring: you pass on the total, not per domain.
- About 2 minutes per question. Unanswered counts as wrong and there’s no penalty for guessing, so answer everything and flag the long ones.
- Domain weights: monitoring, logging, analysis, remediation and performance 22%; reliability and business continuity 22%; deployment, provisioning and automation 22%; networking and content delivery 18%; security and compliance 16%.
- This exam replaces SOA-C02 (SysOps Administrator). There are no hands-on labs in C03; it’s all scenario questions. Designing architectures and pipelines is out of scope; operating, troubleshooting and remediating them is in.
How to read an operations question
Read the last sentence first, then find the constraint words.
| The question says | Pick |
|---|---|
| Least operational overhead | The managed or native feature: AWS Backup, Config remediation, Systems Manager, target tracking |
| Automatically / without manual intervention | Alarm or EventBridge rule → SSM Automation or Lambda |
| Most cost-effective | The cheapest option that still meets the stated RTO, RPO and performance |
| Without downtime / no restart | Elastic Volumes, rolling or blue/green, read replica promotion, Multi-AZ failover |
| Memory or disk space on EC2 | CloudWatch agent (not a default metric) |
| Across accounts and Regions | StackSets, cross-account observability, Organizations features, RAM |
| Existing and new resources | Config rules, service-managed StackSets with auto-deploy |
| Securely / least privilege | IAM roles, private endpoints, KMS customer managed keys, Secrets Manager |
| Troubleshoot connectivity | Walk the path: SG, route table, NACL, gateway, destination; Reachability Analyzer and flow logs |
Elimination: answers needing SSH, a bastion, a cron job on EC2 or a custom server are usually wrong. In Choose TWO questions, the picks are two parts of one solution.
Troubleshooting orders
- Event rule doesn’t fire: right bus → pattern matches → rule enabled → target permission → same Region → DLQ and
FailedInvocations. - Alarm never notifies: SNS topic policy allows CloudWatch → KMS key policy on the topic → subscription confirmed → alarm actions enabled.
- Instance not managed by SSM: SSM Agent running → instance profile with
AmazonSSMManagedInstanceCore→ route to SSM endpoints. - Unhealthy ALB targets: target SG allows the ALB SG → path returns the matcher code → port → timeout.
- Access denied: identity policy → explicit deny → SCP → permission boundary → resource policy → KMS key policy → condition.
- Private instance can’t reach the internet: NAT route → NAT in public subnet → EIP → IGW route → NACL ephemeral ports.
- CloudFormation failure: read the earliest failed event;
ROLLBACK_COMPLETEmust be deleted; subnet IPs, quotas and PassRole are common.
Numbers worth knowing
| Fact | Value |
|---|---|
| EC2 basic vs detailed monitoring | 5 minutes vs 1 minute |
| CloudWatch Logs default retention | Never expires |
| CloudTrail event history | 90 days of management events |
| S3 multipart upload | Recommended over 100 MB, required over 5 GB; max object 5 TB; max 10,000 parts |
| S3 request rate | 3,500 writes and 5,500 reads per second per prefix |
| EBS gp3 baseline | 3,000 IOPS, 125 MB/s; up to 16,000 IOPS and 1,000 MB/s |
| EBS st1 and sc1 | Never boot volumes |
| RDS automated backup retention | 0 to 35 days; PITR to about 5 minutes ago, always a new instance |
| DynamoDB PITR | 35 days |
| Aurora | 6 copies across 3 AZs; up to 15 replicas |
| ASG default cooldown | 300 seconds |
| ALB idle timeout | 60 seconds; deregistration delay 300 seconds |
| Reserved IPs per subnet | 5 |
| KMS key deletion wait | 7 to 30 days |
| KMS automatic rotation | Customer managed keys, same key ID kept |
| Lambda | 15 minute max; async invoke retries twice |
| SCPs | Don’t grant; skip the management account and service-linked roles |
| Spread placement group | Max 7 instances per AZ |
Services that look alike
| Pair | Difference |
|---|---|
| Gateway vs interface endpoint | Gateway: S3 and DynamoDB, free, route-based. Interface: PrivateLink ENI, most services, private DNS, cost |
| VPC peering vs Transit Gateway | Peering is one-to-one, not transitive. TGW is hub-and-spoke and transitive |
| Security group vs NACL | SG: stateful, allow only, per ENI. NACL: stateless, allow and deny, per subnet |
| CloudFront vs Global Accelerator | CloudFront caches HTTP content. Global Accelerator gives static anycast IPs for TCP/UDP, no cache |
| Alias vs CNAME | Alias works at the apex and for AWS targets. CNAME can’t be at the apex |
| Secrets Manager vs Parameter Store | Secrets Manager rotates and costs per secret. Parameter Store SecureString is free, no native rotation |
| Config vs SCP | Config detects (and remediates). SCP prevents |
| GuardDuty vs Inspector vs Macie | Threats; vulnerabilities; sensitive data in S3 |
| Run Command vs Automation vs State Manager | One command now; multi-step workflow; keep a desired state |
| Multi-AZ vs read replica | Availability (sync, not readable) vs read scale and DR (async) |
| EFS vs FSx Windows vs FSx Lustre | Linux NFS; Windows SMB; HPC |
| Drift detection vs change set | Compare live state to template; preview an update before running it |
DR in one line each
Backup and restore (hours, cheapest) → pilot light (core running, scale up on failover) → warm standby (small full copy, scale up) → active/active (near zero, costliest). Aurora Global Database and DynamoDB global tables serve low RPO across Regions; Elastic Disaster Recovery handles servers.
Last checks
- Name changes: CodeCommit is closed to new customers, OpsWorks is gone, AWS Chatbot is part of Amazon Q Developer in chat applications, paid Support plans are now Business Support+, Enterprise Support and Unified Operations.
- When two answers both work, choose the one that is native, automatic and least privilege.