SOA-C03 cheat sheet

Monitoring, Logging, Analysis, Remediation, and Performance Optimization

CloudWatch Metrics, Alarms, and Log Filters for SOA-C03

• Default EC2 metrics never include memory or disk-space utilization — collecting those requires the CloudWatch agent.
• Standard EC2 monitoring is 5-minute metrics; detailed monitoring is 1-minute, costs extra, and adds frequency, not new metrics.
• Custom metrics are 1-minute standard resolution or 1-second high resolution; high-resolution alarms evaluate on 10- or 30-second periods.
• Metric filters turn log patterns into alarmable metrics but only match data ingested after creation; subscription filters stream the events themselves to Kinesis Data Streams, Firehose, or Lambda.
• An alarm has three states — OK, ALARM, INSUFFICIENT_DATA — and M-out-of-N datapoints plus a deliberate treat-missing-data choice keep it from flapping or lying.
• Composite alarms combine child alarms with AND/OR/NOT to suppress noise, and they act by notifying (SNS), not by taking EC2 or scaling actions.
• An alarm notification needs an SNS topic in the same Region and a confirmed subscription — "alarm fired, no email" means check the subscription first.
• CloudTrail answers who did what and when (API audit, management vs data events); CloudWatch answers how the system is performing.

Automated Remediation: EventBridge, Runbooks, and EC2 Recovery (SOA-C03)

• StatusCheckFailed_System means AWS infrastructure under the instance failed — the recover action migrates it to healthy hardware, preserving instance ID, IP addresses, and EBS volumes.
• StatusCheckFailed_Instance means an OS-level problem (exhausted memory, corrupted filesystem, bad network config, failed kernel) — recovery can't fix it; reboot or repair the OS.
• Auto Scaling remediates fleets by terminating and replacing unhealthy instances — replacement, not repair; add ELB health checks so failing the load balancer counts as unhealthy.
• An EventBridge rule that never fires: check the event pattern against a real sample event, confirm the rule is enabled, verify target permissions, and confirm the event reaches that bus in that Region.
• Input transformers reshape event JSON before delivery — enrich or trim the payload with no Lambda in the middle.
• AWS-prefixed Automation runbooks like AWS-RestartEC2Instance are predefined; author custom YAML/JSON runbooks for multi-step, workload-specific remediation, and prefer runbooks over custom code for least operational overhead.
• State Manager associations continuously reapply desired configuration — the drift-correction answer; Run Command is for ad hoc execution at scale without SSH.
• AWS Health Dashboard events (account-specific issues and planned maintenance) flow into EventBridge, turning upcoming hardware retirements into proactive remediation triggers.

EC2, EBS, S3 and RDS Performance Optimization for SOA-C03

• Compute Optimizer turns CloudWatch history into over/under-provisioned classifications with specific EC2, EBS, and Lambda recommendations — Trusted Advisor only flags, it doesn't size.
• A T-family instance that slows under sustained load has drained its CPU credits — check CPUCreditBalance; fix with unlimited mode or a fixed-performance family.
• gp3 includes 3,000 IOPS and 125 MiB/s at any size and decouples performance from capacity; gp2 ties IOPS to size and throttles when BurstBalance hits zero.
• Elastic Volumes modifies volume type, size, and IOPS on a live attached volume — gp2 to gp3 migration needs no downtime.
• The instance's own EBS-optimized throughput cap can bottleneck before any volume limit — if volumes look healthy but storage is slow, check the instance ceiling.
• Multipart upload for large objects, Transfer Acceleration for distant clients, DataSync for bulk or recurring transfers, prefixes for request-rate parallelism.
• EFS = Linux NFS, FSx for Windows = SMB with Active Directory, FSx for Lustre = HPC/ML scratch, FSx for NetApp ONTAP = multiprotocol.
• RDS Proxy pools connections to absorb connection storms; read replicas offload reads; Performance Insights names the top SQL and wait events behind DB load.

Reliability and Business Continuity

Auto Scaling and Elasticity: EC2, Caching, and Database Scaling

• "Keep a metric near a value" (for example, average CPU at 50%) → target tracking, the default scaling-policy answer.
• Simple scaling is legacy: one adjustment per cooldown; prefer target tracking or step scaling for reactive load.
• Fix a flapping ASG with target tracking, longer instance warmup, or wider thresholds — not a shorter cooldown.
• Alarms in breach but nothing launching → desired equals max, or launches are failing; read the activity history and check quotas.
• Redis when the cache needs replication, failover, or persistence; Memcached for simple horizontal ephemeral caching.
• RDS read replicas are asynchronous — alarm on ReplicaLag; Aurora runs up to 15 low-lag replicas behind a reader endpoint.
• DynamoDB throttling means the wrong capacity mode or limits: on-demand for spiky traffic, provisioned plus auto scaling for steady traffic.
• CloudFront and ElastiCache absorb load before it reaches compute — raise the cache hit ratio before resizing the fleet.

High Availability: ELB and Route 53 Health Checks, Multi-AZ Design

• "Static IP per AZ", UDP, or extreme TCP performance → NLB; path, host, or header routing → ALB.
• All targets unhealthy is systemic: health-check path or port, a security group blocking probes from the ALB, or an app-wide non-2xx response.
• 502 = bad response or reset from a target; 503 = no healthy (or no registered) targets; 504 = target timeout.
• Route 53 health checkers live outside your VPC — health-check private resources with alarm-based checks.
• Failover routing is active-passive: a PRIMARY record with a health check (or Evaluate Target Health on an alias) and a SECONDARY that serves only when the primary fails.
• The RDS Multi-AZ standby is never readable — synchronous, automatic-failover availability; read replicas are asynchronous, readable, and promoted manually.
• ELB heals within a Region in seconds; Route 53 fails over across Regions at DNS speed, limited by TTL caching.
• One NAT gateway shared across AZs is a single-AZ dependency — deploy one per AZ for static stability.

Backup, Restore, and Disaster Recovery Strategies on AWS

• RPO = maximum acceptable data loss, RTO = maximum acceptable downtime — translate every scenario into these two numbers first.
• AWS Backup centralizes schedules, retention, cold-storage lifecycle, and cross-Region/cross-account copies; tag-based resource assignment is the at-scale answer.
• RDS automated backups (retention up to 35 days) enable point-in-time restore; manual snapshots are kept until you delete them.
• DynamoDB PITR restores to any second in the last 35 days; on-demand backups persist until deleted.
• Every restore creates a NEW resource with a new endpoint or name — repointing the application belongs in the runbook.
• S3 versioning turns a delete into a delete marker — remove the marker to restore; replication needs versioning and copies only new objects by default.
• DR patterns by rising cost and falling RTO/RPO: backup and restore → pilot light → warm standby → multi-site active/active; pick the cheapest that meets the objectives.
• Multi-AZ is availability, not backup — corruption replicates to the standby; and an untested restore proves nothing about RTO or RPO.

Deployment, Provisioning, and Automation

CloudFormation, StackSets, and golden images: provisioning for SOA-C03

• Deregistering an AMI does not delete its EBS snapshots — delete them separately or storage costs continue.
• A change set previews every Add/Modify/Remove and flags Replacement — a replaced resource is deleted and recreated, so check stateful resources first.
• Stack policies protect resources during updates; DeletionPolicy Retain or Snapshot protects them at deletion and replacement time.
• A resource changed outside CloudFormation is the cue for drift detection — it reports drift but never reverts it.
• ROLLBACK_COMPLETE after a failed create means delete and recreate; UPDATE_ROLLBACK_FAILED is recovered with continue update rollback.
• Read the first failure event in the stack's event history — later failures are usually cascades.
• StackSets deploy one template to many accounts and Regions (org integration auto-deploys to new accounts); AWS RAM shares one existing resource instead of duplicating it.
• Every subnet loses 5 IP addresses to AWS reservations — size CIDRs for peak scale-out, not steady state.

Systems Manager and event-driven automation: managing resources for SOA-C03

• A managed instance needs three things: a running SSM Agent, an instance profile with AmazonSSMManagedInstanceCore, and a network path to the Systems Manager endpoints.
• Shell access without SSH keys, bastion hosts, or open inbound ports → Session Manager, with sessions logged to CloudWatch Logs or S3.
• Configuration that must stay enforced and self-correct → a State Manager association, not a one-off script.
• OS patching with approval rules, maintenance windows, and compliance reporting → Patch Manager running AWS-RunPatchBaseline (Scan reports, Install applies).
• EventBridge rules are the automation router: match an event pattern or a schedule, then invoke Lambda, runbooks, or queues.
• S3 Event Notifications deliver to Lambda, SQS, or SNS; enable EventBridge on the bucket when you need richer filtering or more targets.
• Prefer managed, declarative automation over custom Lambda code whenever the question asks for the least operational overhead.

Security and Compliance

IAM, AWS Organizations, and Compliance Tools for CloudOps (SOA-C03)

• Only IAM identity and resource policies grant access — SCPs and permissions boundaries can only cap it, and an explicit deny anywhere always wins.
• Enforce MFA with a Deny policy conditioned on aws:MultiFactorAuthPresent — the account password policy cannot require MFA.
• Cross-account access needs an allow on both sides: the caller's identity policy and the target's resource-based policy.
• Who did it → CloudTrail. Would this policy allow it → IAM policy simulator. What is exposed outside the account → IAM Access Analyzer.
• Block Regions org-wide with an SCP on aws:RequestedRegion (exempting global services via NotAction) — IAM policies cannot reach every account.
• SCPs do not affect the management account, and "SCP allows but user still denied" just means no IAM policy grants the action.
• AWS Config detects noncompliance and can auto-remediate via SSM Automation runbooks; conformance packs deploy rule sets at scale.
• Trusted Advisor flags open security groups, missing root MFA, and public S3 buckets — you remediate, ideally via EventBridge automation.

Data Protection on AWS: KMS, ACM, Secrets, and Security Services (SOA-C03)

• You cannot encrypt an existing EBS volume or RDS instance in place — snapshot, copy the snapshot with encryption, restore, and cut over.
• The KMS key policy is the primary authority: an IAM allow is useless if the key policy neither permits the principal nor delegates to IAM.
• ACM certificates auto-renew only while their DNS validation records exist; imported certificates never auto-renew.
• Enforce TLS on S3 with a bucket-policy Deny when aws:SecureTransport is false; on an ALB, redirect the HTTP listener to HTTPS.
• Secrets Manager when you need automatic rotation (managed for RDS); Parameter Store SecureString for free, static, KMS-encrypted secrets.
• GuardDuty = active threats, Inspector = CVEs and vulnerabilities, Macie = sensitive data in S3, Config = configuration compliance, Security Hub = aggregation and standards.
• GuardDuty analyzes CloudTrail, VPC Flow Logs, and DNS logs — it detects threats; it never blocks them.
• Findings → EventBridge rule → SNS plus Lambda/SSM runbook is the standard automated remediation loop for every findings service.

Networking and Content Delivery

VPC Networking and Private Connectivity for SOA-C03

• A subnet is public only if its route table sends 0.0.0.0/0 to an internet gateway and its instances have public IPs.
• Every subnet loses five IPs: network address, VPC router, DNS resolver, future-use, and broadcast.
• IPv6 outbound-only means an egress-only internet gateway — there is no IPv6 NAT.
• Security groups are stateful and allow-only; NACLs are stateless, ordered by rule number, can deny — and need ephemeral-port rules.
• Private S3 or DynamoDB access at no cost is a gateway endpoint; most other services need an interface endpoint (PrivateLink).
• VPC peering is never transitive and requires non-overlapping CIDRs; many-VPC transitive routing is Transit Gateway.
• Every Site-to-Site VPN connection provides two tunnels — configure both for high availability.
• NAT data-processing charges on S3 traffic are the exam's favorite cost cut: add a gateway endpoint.

Route 53 DNS and CloudFront Content Delivery for SOA-C03

• Alias records work at the zone apex and are free to query when targeting AWS resources; CNAMEs cannot sit at the apex.
• On-prem must resolve VPC names: inbound Resolver endpoint. VPCs must resolve on-prem domains: outbound endpoint plus forwarding rules.
• Failover routing is active-passive with health checks; multivalue answer returns up to eight healthy records but is not a load balancer.
• Lower a record's TTL well before a migration so cached answers age out fast, then raise it after the cutover.
• Public DNS query logs cover queries to your public zone; Resolver query logs cover queries from inside your VPCs.
• CloudFront custom-domain certificates must come from ACM in us-east-1 — no other Region works.
• Prefer versioned object names over invalidations; invalidations bill per path beyond the monthly free allowance, and a wildcard counts as one path.
• Static anycast IPs, TCP/UDP, or instant regional failover means Global Accelerator; caching HTTP content means CloudFront.

AWS Network Troubleshooting: VPC Flow Logs and the Layered Diagnosis Method

• Security groups are stateful; network ACLs are stateless — a rejected reply to an accepted request is always a NACL problem.
• ACCEPT then REJECT for the same flow in VPC Flow Logs means a NACL is blocking the return on ephemeral ports 1024-65535.
• No flow-log record at all means packets never reached the ENI — suspect routing or DNS, not security rules.
• A NAT gateway must sit in a public subnet with an IGW route; the private subnet routes 0.0.0.0/0 to the NAT gateway.
• VPC peering is non-transitive and needs routes on both sides; Transit Gateway needs routes in both the VPC and TGW route tables.
• VPC Reachability Analyzer names the exact blocking component through static analysis, without sending a packet.
• Low CloudFront hit ratio: shrink the cache key, raise TTLs, and version object names instead of invalidating.
• VPN tunnel up but no traffic: check static routes or BGP propagation first, then security groups for the on-premises CIDR.