Content domains
The 6 domains of SOA-C02, with every task statement and its objectives from the official guide. Study a whole domain, or drill a single task.
1Monitoring, Logging, and Remediation
20% of examStudy domain
1.1Implement metrics, alarms, and filters by using AWS monitoring and logging services23 q>
Knowledge of
- Amazon CloudWatch metrics, alarms, dashboards, and Logs
- CloudWatch Logs Insights and the CloudWatch agent
- AWS CloudTrail logs and event history
- Notification services and integrations (for example, Amazon SNS, Service Quotas, AWS Health events)
Skills in
- Identifying, collecting, analyzing, and exporting logs (for example, CloudWatch Logs, CloudWatch Logs Insights, CloudTrail logs)
- Collecting metrics and logs using the CloudWatch agent
- Creating CloudWatch alarms
- Creating metric filters
- Creating CloudWatch dashboards
- Configuring notifications (for example, Amazon SNS, Service Quotas, CloudWatch alarms, AWS Health events)
1.2Remediate issues based on monitoring and availability metrics23 q>
Knowledge of
- Troubleshooting and corrective actions from notifications and alarms
- Amazon EventBridge rules and targets
- AWS Systems Manager Automation documents (runbooks)
- AWS Config rules and remediation
Skills in
- Troubleshooting or taking corrective actions based on notifications and alarms
- Configuring Amazon EventBridge rules to trigger actions
- Using AWS Systems Manager Automation documents to take action based on AWS Config rules
2Reliability and Business Continuity
16% of examStudy domain
2.1Implement scalability and elasticity22 q>
Knowledge of
- AWS Auto Scaling plans and policies
- Caching strategies and services
- Amazon RDS replicas and Amazon Aurora Replicas
- Loosely coupled architectures
- Horizontal scaling compared with vertical scaling
Skills in
- Creating and maintaining AWS Auto Scaling plans
- Implementing caching
- Implementing Amazon RDS replicas and Amazon Aurora Replicas
- Implementing loosely coupled architectures
- Differentiating between horizontal scaling and vertical scaling
2.2Implement high availability and resilient environments22 q>
Knowledge of
- Elastic Load Balancing and Amazon Route 53 health checks
- Single Availability Zone compared with Multi-AZ deployments
- Fault-tolerant workloads (for example, Amazon EFS, Elastic IP addresses)
- Route 53 routing policies
Skills in
- Configuring Elastic Load Balancer and Amazon Route 53 health checks
- Differentiating between the use of a single Availability Zone and Multi-AZ deployments (for example, Amazon EC2 Auto Scaling groups, Elastic Load Balancing, Amazon FSx, Amazon RDS)
- Implementing fault-tolerant workloads (for example, Amazon EFS, Elastic IP addresses)
- Implementing Route 53 routing policies (for example, failover, weighted, latency based)
2.3Implement backup and restore strategies22 q>
Knowledge of
- Automated snapshots and backups (for example, RDS snapshots, AWS Backup, Amazon Data Lifecycle Manager)
- RTO and RPO and retention policies
- Database restore techniques (for example, point-in-time restore, promote read replica)
- Amazon S3 versioning, lifecycle rules, and Cross-Region Replication
- Disaster recovery procedures
Skills in
- Automating snapshots and backups based on use cases (for example, RDS snapshots, AWS Backup, RTO and RPO, Amazon Data Lifecycle Manager, retention policy)
- Restoring databases (for example, point-in-time restore, promote read replica)
- Implementing versioning and lifecycle rules
- Configuring Amazon S3 Cross-Region Replication
- Executing disaster recovery procedures
3Deployment, Provisioning, and Automation
18% of examStudy domain
3.1Provision and maintain cloud resources25 q>
Knowledge of
- AMI creation and management (for example, EC2 Image Builder)
- AWS CloudFormation authoring and troubleshooting
- Multi-Region and multi-account provisioning (for example, AWS RAM, CloudFormation StackSets, IAM cross-account roles)
- Deployment strategies (for example, blue/green, rolling, canary)
- Deployment issue remediation (for example, service quotas, subnet sizing, permissions)
Skills in
- Creating and managing AMIs (for example, EC2 Image Builder)
- Creating, managing, and troubleshooting AWS CloudFormation
- Provisioning resources across multiple AWS Regions and accounts (for example, AWS Resource Access Manager, CloudFormation StackSets, IAM cross-account roles)
- Selecting deployment scenarios and services (for example, blue/green, rolling, canary)
- Identifying and remediating deployment issues (for example, service quotas, subnet sizing, CloudFormation and AWS OpsWorks errors, permissions)
3.2Automate manual or repeatable processes25 q>
Knowledge of
- Automation services (for example, AWS OpsWorks, AWS Systems Manager, AWS CloudFormation)
- Automated patch management (for example, Systems Manager Patch Manager)
- Scheduled task automation (for example, Amazon EventBridge, AWS Config)
Skills in
- Using AWS services (for example, OpsWorks, Systems Manager, CloudFormation) to automate deployment processes
- Implementing automated patch management
- Scheduling automated tasks by using AWS services (for example, EventBridge, AWS Config)
4Security and Compliance
16% of examStudy domain
4.1Implement and manage security and compliance policies24 q>
Knowledge of
- IAM features (for example, password policies, MFA, roles, SAML, federated identity, resource policies, policy conditions)
- Access auditing and troubleshooting tools (for example, CloudTrail, IAM Access Analyzer, IAM policy simulator)
- Service control policies and permission boundaries
- AWS Trusted Advisor security checks
- Multi-account governance (for example, AWS Control Tower, AWS Organizations)
Skills in
- Implementing IAM features (for example, password policies, MFA, roles, SAML, federated identity, resource policies, policy conditions)
- Troubleshooting and auditing access issues by using AWS services (for example, CloudTrail, IAM Access Analyzer, IAM policy simulator)
- Validating service control policies and permission boundaries
- Reviewing AWS Trusted Advisor security checks
- Validating AWS Region and service selections based on compliance requirements
- Implementing secure multi-account strategies (for example, AWS Control Tower, AWS Organizations)
4.2Implement data and infrastructure protection strategies24 q>
Knowledge of
- Data classification schemes
- Encryption key creation, management, and protection (for example, AWS KMS)
- Encryption at rest and in transit (for example, AWS KMS, AWS Certificate Manager, VPN)
- Secrets storage (for example, AWS Secrets Manager, Systems Manager Parameter Store)
- Security findings and reports (for example, AWS Security Hub, Amazon GuardDuty, AWS Config, Amazon Inspector)
Skills in
- Enforcing a data classification scheme
- Creating, managing, and protecting encryption keys
- Implementing encryption at rest (for example, AWS Key Management Service [AWS KMS])
- Implementing encryption in transit (for example, AWS Certificate Manager, VPN)
- Securely storing secrets by using AWS services (for example, AWS Secrets Manager, Systems Manager Parameter Store)
- Reviewing reports or findings (for example, AWS Security Hub, Amazon GuardDuty, AWS Config, Amazon Inspector)
5Networking and Content Delivery
18% of examStudy domain
5.1Implement networking features and connectivity22 q>
Knowledge of
- Amazon VPC components (for example, subnets, route tables, network ACLs, security groups, NAT gateway, internet gateway)
- Private connectivity options (for example, Systems Manager Session Manager, VPC endpoints, VPC peering, VPN)
- AWS network protection services (for example, AWS WAF, AWS Shield)
Skills in
- Configuring a VPC (for example, subnets, route tables, network ACLs, security groups, NAT gateway, internet gateway)
- Configuring private connectivity (for example, Systems Manager Session Manager, VPC endpoints, VPC peering, VPN)
- Configuring AWS network protection services (for example, AWS WAF, AWS Shield)
5.2Configure domains, DNS services, and content delivery22 q>
Knowledge of
- Amazon Route 53 hosted zones and records
- Route 53 routing policies (for example, geolocation, geoproximity)
- DNS resolution (for example, Route 53 Resolver)
- Amazon CloudFront and S3 origin access identity (OAI)
- Amazon S3 static website hosting
Skills in
- Configuring Route 53 hosted zones and records
- Implementing Route 53 routing policies (for example, geolocation, geoproximity)
- Configuring DNS (for example, Route 53 Resolver)
- Configuring Amazon CloudFront and S3 origin access identity (OAI)
- Configuring S3 static website hosting
5.3Troubleshoot network connectivity issues22 q>
Knowledge of
- VPC configuration interpretation (for example, subnets, route tables, network ACLs, security groups)
- Network logs (for example, VPC Flow Logs, ELB access logs, AWS WAF web ACL logs, CloudFront logs)
- CloudFront caching behavior and troubleshooting
- Hybrid and private connectivity troubleshooting
Skills in
- Interpreting VPC configurations (for example, subnets, route tables, network ACLs, security groups)
- Collecting and interpreting logs (for example, VPC Flow Logs, Elastic Load Balancer access logs, AWS WAF web ACL logs, CloudFront logs)
- Identifying and remediating CloudFront caching issues
- Troubleshooting hybrid and private connectivity issues
6Cost and Performance Optimization
12% of examStudy domain
6.1Implement cost optimization strategies23 q>
Knowledge of
- Cost allocation tags
- Resource utilization tools (for example, AWS Trusted Advisor, AWS Compute Optimizer, AWS Cost Explorer)
- AWS Budgets and billing alarms
- EC2 purchasing options (for example, Spot Instances)
- Managed services for cost efficiency (for example, Amazon RDS, AWS Fargate, Amazon EFS)
Skills in
- Implementing cost allocation tags
- Identifying and remediating underutilized or unused resources by using AWS services and tools (for example, Trusted Advisor, AWS Compute Optimizer, Cost Explorer)
- Configuring AWS Budgets and billing alarms
- Assessing resource usage patterns to qualify workloads for EC2 Spot Instances
- Identifying opportunities to use managed services (for example, Amazon RDS, AWS Fargate, EFS)
6.2Implement performance optimization strategies23 q>
Knowledge of
- Compute right-sizing based on performance metrics
- Amazon EBS metrics and volume configuration
- Amazon S3 performance features (for example, S3 Transfer Acceleration, multipart uploads)
- Amazon RDS performance features (for example, Performance Insights, RDS Proxy)
- Enhanced EC2 capabilities (for example, enhanced networking, instance store, placement groups)
Skills in
- Recommending compute resources based on performance metrics
- Monitoring Amazon EBS metrics and modifying configuration to increase performance efficiency
- Implementing S3 performance features (for example, S3 Transfer Acceleration, multipart uploads)
- Monitoring RDS metrics and modifying the configuration to increase performance efficiency (for example, Performance Insights, RDS Proxy)
- Enabling enhanced EC2 capabilities (for example, enhanced network adapter, instance store, placement groups)