SOA-C03 · Domain 1 of 5

SOA-C03 Domain 1: Monitoring, Logging, Analysis, Remediation, and Performance Optimization

This is the largest CloudOps domain. It covers instrumenting AWS workloads with CloudWatch and CloudTrail, analyzing logs and audit data to find problems, automatically remediating issues, and optimizing performance across compute, storage and other resources.

Exam weight
22%
Official task statements
3
Estimated questions estimate
~11
Suggested study time estimate
20–30 hrs

About 11 min read Reviewed October 2026

Overview

Monitoring, Logging, Analysis, Remediation and Performance Optimization is the foundation of the CloudOps role. It has three task statements. The first covers implementing metrics, alarms, filters and remediation using CloudWatch metrics and alarms, the CloudWatch agent for memory and disk metrics, CloudWatch Logs and Logs Insights, metric filters, dashboards and EventBridge for event-driven remediation. The second covers analysis and troubleshooting using CloudWatch Logs Insights, CloudTrail for API auditing, and AWS Config for configuration history. The third, moved in from the retired cost-and-performance domain, covers performance optimization for compute, storage and other resources.

At 22%, this is a top-weighted domain and the operational heart of the certification. The exam rewards knowing which signal reveals which problem, how to automate a fix with EventBridge and Systems Manager, and how to read CloudTrail versus CloudWatch. These skills recur in the reliability, deployment and networking domains.

How it's tested

SOA-C03 questions are operational, asking how to monitor, investigate or remediate a described situation. In this domain they give a symptom, a monitoring gap or a performance problem and ask which service, metric or automation resolves it, favoring managed monitoring and event-driven remediation. Read the symptom carefully before choosing.

  • Right monitoring signal

    A visibility gap is described, and you choose the metric, log, filter or the CloudWatch agent that provides it.

  • Analysis tool

    An investigation need is described, and you choose CloudWatch Logs Insights, CloudTrail or AWS Config.

  • Automated remediation

    A recurring issue is described, and you choose EventBridge with Systems Manager or Lambda to fix it automatically.

Reasoning it through

An operator needs to alarm on an EC2 instance's memory usage, but the metric is missing from CloudWatch. By default EC2 publishes CPU, network and disk I/O, but not memory or disk space, which come from inside the guest. Installing and configuring the CloudWatch agent publishes memory and disk metrics as custom metrics, which can then trigger an alarm, so the agent is the answer.

Task statements 3

Official task statements from the Amazon Web Services outline, in outline order.

1.1 Implement metrics, alarms, filters, and remediation using AWS monitoring and logging servicesCloudWatch metrics, alarms, the agent, Logs, metric filters, dashboards and EventBridge remediation.
What it means
This covers CloudWatch metrics and alarms, the CloudWatch agent for memory and disk metrics from instances and containers, CloudWatch Logs and log groups, metric filters that turn log patterns into metrics, dashboards, and EventBridge rules that trigger automated remediation through Systems Manager Automation or Lambda.
What to understand
CloudWatch collects metrics and logs, but memory and disk-space metrics require the CloudWatch agent because they come from inside the guest. Metric filters extract metrics from log text. Alarms act on thresholds, and EventBridge routes events to remediation actions. Automated remediation reduces manual operations toil.
How it shows up
A monitoring gap or recurring issue is described, and you must choose the metric, agent, filter or EventBridge-driven remediation.
Common confusion
Assuming EC2 publishes memory and disk-space metrics by default; these require the CloudWatch agent.
1.2 Perform analysis and troubleshooting using logs and auditing dataCloudWatch Logs Insights, CloudTrail and AWS Config for investigation.
What it means
This covers querying logs with CloudWatch Logs Insights, auditing API activity with CloudTrail to see who did what and when, and using AWS Config to review configuration history and compliance, in order to analyze and troubleshoot operational problems.
What to understand
CloudWatch Logs Insights queries log content for patterns and errors. CloudTrail records API calls for auditing and tracing changes. AWS Config records how resource configurations changed over time and evaluates them against rules. Each answers a different question: what happened in logs, who made an API call, and how configuration changed.
How it shows up
An investigation need is described, and you must choose Logs Insights, CloudTrail or AWS Config.
Common confusion
Confusing CloudTrail with AWS Config; CloudTrail records API activity, while AWS Config records configuration state and changes.
1.3 Implement performance optimization strategies for compute, storage, and other resourcesRight-sizing, instance and storage performance, and optimization tooling.
What it means
This covers optimizing performance and cost-efficiency of compute and storage: right-sizing instances, choosing instance and volume types for the workload, using Compute Optimizer and Trusted Advisor recommendations, caching, and tuning storage throughput and IOPS. It was consolidated from the retired cost-and-performance domain.
What to understand
Performance optimization matches resources to actual usage: right-sizing removes over-provisioning, the correct EBS volume type delivers the needed IOPS, and caching reduces load. Compute Optimizer and Trusted Advisor surface recommendations. Monitoring data from the other tasks drives these decisions.
How it shows up
A performance or efficiency problem is described, and you must choose the right-sizing, storage or caching optimization.
Common confusion
Treating performance optimization as only cost reduction; it also improves throughput and latency by matching resources to the workload.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • CloudWatch metrics and alarms

    Numerical signals and threshold-based alarms for AWS resources.

    Remember
    Alarms trigger notifications or actions on thresholds.
    Tested as
    Core monitoring questions.
    Trap
    Expecting memory metrics without the agent.

  • CloudWatch agent

    Software that publishes memory, disk-space and custom metrics from inside instances and containers.

    Remember
    Required for memory and disk-space metrics.
    Tested as
    Monitoring-gap questions.
    Trap
    Assuming these metrics appear by default.

  • CloudWatch Logs and Logs Insights

    Centralized log storage and a query tool for log content.

    Remember
    Logs Insights queries log text for patterns.
    Tested as
    Analysis questions.
    Trap
    Confusing log analysis with API auditing.

  • Metric filters

    Rules that turn log patterns into CloudWatch metrics.

    Remember
    They let you alarm on log content.
    Tested as
    Monitoring questions.
    Trap
    Expecting to alarm on raw logs without a filter.

  • CloudTrail

    Records AWS API activity for auditing and tracing changes.

    Remember
    It answers who did what and when.
    Tested as
    Auditing questions.
    Trap
    Confusing it with CloudWatch or Config.

  • AWS Config

    Records configuration history and evaluates compliance.

    Remember
    It answers how configuration changed over time.
    Tested as
    Compliance and change questions.
    Trap
    Confusing it with CloudTrail.

  • EventBridge

    An event bus that routes events to targets for automated remediation.

    Remember
    It triggers Systems Manager or Lambda on events.
    Tested as
    Remediation questions.
    Trap
    Doing remediation manually where events could automate it.

  • Systems Manager Automation

    Runbooks that perform remediation and operational tasks.

    Remember
    Often triggered by EventBridge for auto-remediation.
    Tested as
    Remediation questions.
    Trap
    Overlooking it for repeatable fixes.

  • Right-sizing

    Matching instance or volume size to actual usage.

    Remember
    It improves both performance and cost.
    Tested as
    Optimization questions.
    Trap
    Treating it as cost-only.

  • Compute Optimizer and Trusted Advisor

    Services that recommend right-sizing and best-practice improvements.

    Remember
    They surface optimization recommendations.
    Tested as
    Optimization questions.
    Trap
    Expecting automatic remediation from recommendations.

  • Anomaly detection

    CloudWatch feature that learns normal patterns and flags deviations.

    Remember
    It alarms on unusual behavior without fixed thresholds.
    Tested as
    Monitoring questions.
    Trap
    Using only static thresholds for variable metrics.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

CloudWatch vs. CloudTrail vs. AWS Config

ConceptMeaningKey differenceCommon trap
CloudWatch Metrics, logs and alarms Performance and operational monitoring Using it for API auditing
CloudTrail Records API activity Who did what and when Confusing it with Config
AWS Config Configuration history and compliance How configuration changed Confusing it with CloudTrail

Default metrics vs. CloudWatch agent metrics

ConceptMeaningKey differenceCommon trap
Default EC2 metrics CPU, network, disk I/O from the hypervisor No agent needed Expecting memory here
Agent metrics Memory, disk space and custom metrics From inside the guest via the agent Assuming they appear by default

Manual vs. automated remediation

ConceptMeaningKey differenceCommon trap
Manual remediation An operator fixes each occurrence Slow and repetitive Using it for recurring issues
Automated remediation EventBridge triggers Systems Manager or Lambda Fast, repeatable, less toil Not automating recurring fixes

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Memory without the agent

    What candidates pick
    Create a memory-usage alarm directly from default EC2 metrics.
    Why it looks right
    CloudWatch already has EC2 metrics.
    Why it's wrong
    Memory and disk-space metrics come from inside the guest and require the CloudWatch agent.

    Clue to watch for The needed metric is memory or disk space on EC2.

  2. CloudTrail for config history

    What candidates pick
    Use CloudTrail to see how a resource's configuration changed over time.
    Why it looks right
    CloudTrail records activity.
    Why it's wrong
    CloudTrail records API calls; AWS Config records configuration state and change history.

    Clue to watch for The need is configuration change history or compliance.

  3. Config for who did it

    What candidates pick
    Use AWS Config to find who made an API call.
    Why it looks right
    Both track changes.
    Why it's wrong
    AWS Config records configuration state; CloudTrail records who made the API call.

    Clue to watch for The need is the identity and time of an API action.

  4. Manual recurring fixes

    What candidates pick
    Have an operator manually fix a frequently recurring issue.
    Why it looks right
    It works each time.
    Why it's wrong
    EventBridge with Systems Manager Automation or Lambda remediates recurring issues automatically.

    Clue to watch for The same issue recurs and should be fixed automatically.

  5. Alarm on raw logs

    What candidates pick
    Create an alarm directly on log text without a metric filter.
    Why it looks right
    The data is in the logs.
    Why it's wrong
    A metric filter turns the log pattern into a metric that an alarm can act on.

    Clue to watch for The alert must be based on a pattern appearing in logs.

  6. Optimization is cost-only

    What candidates pick
    Treat a performance problem as purely a cost-cutting exercise.
    Why it looks right
    Optimization often saves money.
    Why it's wrong
    Right-sizing and the correct resource type also improve throughput and latency.

    Clue to watch for The issue is slow performance, not just spend.

Answer framework

For any Domain 1 operations scenario, use these steps to find the answer SOA-C03 expects.

  1. Identify whether the need is monitoring, analysis, remediation or performance optimization, since each uses different tools.
  2. For monitoring, choose the metric or log source, remembering the CloudWatch agent is required for memory and disk-space metrics, and use metric filters to alarm on log patterns.
  3. For analysis, choose Logs Insights for log content, CloudTrail for who made an API call, and AWS Config for how configuration changed.
  4. For remediation, automate recurring fixes with EventBridge triggering Systems Manager Automation or Lambda rather than acting manually.
  5. For performance, right-size resources and choose the correct instance or storage type, using Compute Optimizer and Trusted Advisor recommendations, and document the change.

Practice question

A CloudOps engineer must create a CloudWatch alarm on the memory utilization of several EC2 instances, but the memory metric does not appear in CloudWatch. What should the engineer do FIRST?

Want more like this? The SOA-C03 practice test has questions for every domain.

Checklist

0 of 10

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Start with the three observability tools and fix their roles firmly, because the exam tests the distinction constantly: CloudWatch for metrics, logs and alarms, CloudTrail for API auditing, and AWS Config for configuration history and compliance. Drill scenarios that ask which one answers a given question.

Next, learn the monitoring details that trip people up: the CloudWatch agent for memory and disk metrics, metric filters for alarming on log patterns, and anomaly detection for variable metrics. Then master automated remediation with EventBridge triggering Systems Manager Automation or Lambda, since reducing manual toil is central to the CloudOps role.

Finally, cover performance optimization: right-sizing, correct storage types, and the recommendation services. Hands-on practice in a free-tier account, building an alarm, a metric filter and an EventBridge remediation rule, cements these. Afterwards, move to Domain 2, reliability and business continuity, which uses this monitoring to keep workloads available. Hands-on practice in a free-tier AWS account cements these operational skills far faster than reading, and reviewing missed practice questions by domain shows where to focus next.

FAQ

How much of SOA-C03 is Domain 1?

Monitoring, Logging, Analysis, Remediation and Performance Optimization is 22% of the scored content, tied for the largest domain. It absorbed the old cost-and-performance domain's performance tasks.

Why don't memory metrics appear in CloudWatch by default?

Memory and disk-space usage come from inside the guest operating system, which the hypervisor cannot see, so the CloudWatch agent must be installed to publish them.

What is the difference between CloudTrail and AWS Config?

CloudTrail records API activity, answering who did what and when. AWS Config records how resource configurations changed over time and evaluates compliance.

How do I automate remediation?

Use EventBridge to detect an event and trigger a target such as a Systems Manager Automation runbook or a Lambda function to fix the issue without manual intervention.

How do I alarm on a pattern in my logs?

Create a metric filter that matches the log pattern and produces a metric, then set a CloudWatch alarm on that metric.

Is this exam the same as SysOps Administrator?

It is the successor. SOA-C03 renamed the certification to CloudOps Engineer and replaced SOA-C02, which retired on 29 September 2025, adding containers and reorganizing the domains.

How does Domain 1 connect to the rest of the exam?

The monitoring and analysis here drive reliability, deployment, security and networking operations, so this observability foundation recurs throughout.

Other Cloud Computing certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 1 knowledge

You have covered monitoring, logging, analysis, remediation and performance optimization. Test whether you can pick the right observability tool and automate a fix under exam conditions.

Take the SOA-C03 practice test Check your SOA-C03 readiness

Keep going