AWS Certified CloudOps Engineer - Associate

Build evidence-driven diagnosis first. A CloudOps answer should connect customer symptoms to metrics, logs, traces, API events, network evidence, and safe remediation.

• Configure default, detailed, custom, and high-resolution CloudWatch metrics deliberately
• Deploy and troubleshoot the unified CloudWatch agent on EC2 and current container patterns
• Use Logs Insights, metric filters, dashboards, alarms, composite alarms, SNS, and retention controls
• Create cross-account observability with OAM sinks and source links
• Distinguish CloudTrail API activity, Config history, service logs, application logs, and VPC Flow Logs
• Route and troubleshoot events with EventBridge rules, buses, Pipes, Scheduler, retries, and DLQs
• Run predefined and custom Systems Manager Automation runbooks with rate and permission controls
• Diagnose EC2, EBS, S3 transfer/storage, EFS/FSx, RDS, connection, and placement performance
• Measure cost with the performance signal instead of treating cost as a retired sixth domain
• Inject CPU, memory, disk, connection, no-data, permission, and target-delivery failures

Separate elasticity, availability, and data recovery. They solve different failure modes and have different costs.

• Configure EC2 Auto Scaling target tracking, scheduled actions, warm-up, health checks, and mixed capacity where appropriate
• Use CloudFront or ElastiCache for justified caching and understand managed database scaling
• Operate ALB/NLB health, target registration, connection draining, and Route 53 health checks
• Implement Multi-AZ compute and database patterns and test actual failover behavior
• Define RTO and RPO for each application dependency
• Create AWS Backup plans, assignments, lifecycle, vault, copy, monitoring, and compliance controls
• Protect supported recovery points across Regions and accounts and evaluate Vault Lock carefully
• Use S3 and supported file-system versioning where requirements call for object/version recovery
• Compare backup/restore, pilot light, warm standby, and active/active from RTO, RPO, and cost
• Restore data and applications in isolation and measure end-to-end recovery, not only job completion

Make operations repeatable through versioned artifacts, infrastructure as code, controlled deployment, and fleet automation.

• Build and distribute tested AMIs and container images with EC2 Image Builder
• Create and update resources with CloudFormation and understand AWS CDK synthesis and deployment
• Review change sets, stack events, rollback, drift, imports, dependencies, and replacement behavior
• Deploy baselines across accounts and Regions with StackSets and share supported resources with AWS RAM
• Compare rolling, immutable, blue/green, canary, and instance-refresh deployment strategies
• Use Git and a reviewed Terraform plan/state workflow when third-party IaC is a stated requirement
• Onboard managed nodes through Systems Manager without routine inbound SSH
• Use Quick Setup patch policies, custom baselines, canaries, scan/install schedules, hooks, and compliance timestamps
• Automate existing-resource operations with Run Command, State Manager, Inventory, OpsCenter, and Automation
• Design every event-driven action for idempotency, least privilege, retries, timeouts, DLQs, and rollback

Troubleshoot the complete authorization path and combine preventive, detective, and responsive controls across accounts.

• Operate IAM roles, federation, MFA, password policies, resource policies, conditions, boundaries, and temporary credentials
• Use CloudTrail, IAM Access Analyzer, and policy simulation to diagnose access rather than adding administrator access
• Implement Organizations, SCPs, delegated administration, and IAM Identity Center permission sets safely
• Enforce approved Region and service selections with tested exceptions and rollback
• Record and assess compliance with Config rules, organization conformance packs, and read-only aggregators
• Classify data and protect it with KMS, S3 controls, ACM/TLS, Secrets Manager, or Parameter Store as appropriate
• Trace SSE-KMS access through identity, bucket, key, grant, condition, and explicit-deny layers
• Review Trusted Advisor, Security Hub, GuardDuty, Inspector, Config, and current security finding workflows
• Automate reversible quarantine or remediation while preserving evidence and human approval for impact
• Audit root use, policy changes, key changes, backup changes, and failed authorization

Finish with end-to-end path troubleshooting and game days that combine all five domains.

• Configure subnets, routes, internet/NAT/egress-only gateways, endpoints, PrivateLink, peering, security groups, and NACLs
• Audit DNS Firewall, WAF, Shield, and Network Firewall configurations within the stated scope
• Optimize NAT, endpoint, cross-AZ, cross-Region, and internet data paths for cost and reliability
• Configure Route 53 public/private DNS, Resolver, routing policies, health, and query logging
• Operate CloudFront and Global Accelerator from protocol, cache, routing, health, and performance requirements
• Troubleshoot with VPC Flow Logs, ELB logs, WAF logs, CloudFront logs, container logs, and CloudWatch network monitoring
• Diagnose hybrid and private connectivity without assuming the first observed deny is the root cause
• Resolve stale CloudFront content with cache-key/TTL analysis, urgent invalidation, and versioned objects
• Run patch, backup, restore, failover, alarm, runbook, IAM-denial, blocked-flow, DNS, and cache game days
• Complete fresh mixed-domain scenarios and explain why every distractor fails the requirement