SOA-C02 cheat sheet: AWS Certified SysOps Administrator – Associate

Monitoring, logging, and remediation

CloudWatch: metrics and alarms (including composite alarms combining multiple conditions, and anomaly-detection alarms based on historical baselines), Logs Insights for querying log data directly, and dashboards for visibility.
CloudTrail records API activity for audit and troubleshooting; multi-region and organization trails give a consolidated view across accounts.
AWS Config evaluates resources against rules (managed or custom) for compliance drift, with remediation actions that can run automatically.
EventBridge routes events by pattern match to targets, useful for triggering automated remediation when a monitoring condition fires.

RDS Multi-AZ (a synchronous standby for failover) vs. read replicas (asynchronous, for read scaling, promotable to standalone) — know which solves which problem.
Backup strategies: automated snapshots, AWS Backup for centralised policy across services, and the four DR strategies (backup and restore, pilot light, warm standby, multi-site active/active) trading cost against RTO/RPO.
Auto Scaling: health checks, lifecycle hooks, and scaling policies (target tracking, step, scheduled) keep capacity matched to demand and replace unhealthy instances automatically.
S3 versioning and cross-region replication protect against accidental deletion and regional failure respectively — know they're separate, both-optional features.

CloudFormation: stacks, nested stacks (reusable components) vs. StackSets (deploy the same stack across accounts/regions), drift detection, and change sets to preview an update before applying it.
Systems Manager Automation runs documented runbooks (execution roles, target maps) for repeatable operational tasks across many instances at once.
Elastic Beanstalk manages the underlying infrastructure for a deployed application, including rolling and blue/green deployment options with automatic rollback.
AWS CDK and SAM both extend CloudFormation with higher-level syntax for defining infrastructure as code, particularly for serverless applications.

IAM: roles for workloads (never long-lived keys), permissions boundaries (a ceiling on what an identity can be granted) vs. SCPs (an organization-wide ceiling), and Access Analyzer for finding unintended external access.
KMS: automatic annual key rotation for AWS-managed keys, a mandatory waiting period before a deleted key is actually destroyed, and envelope encryption as the underlying pattern.
GuardDuty (threat detection), Security Hub (consolidated findings), and Inspector (vulnerability and CIS-benchmark scanning) work together for ongoing security visibility.
Secrets Manager rotates credentials automatically via a Lambda function; Parameter Store SecureString encrypts values but doesn't natively rotate them.

VPC endpoints keep traffic to AWS services off the public internet — interface endpoints (ENI-based, most services) vs. gateway endpoints (route-table based, S3 and DynamoDB only).
Route 53 routing policies: simple, weighted, latency-based, failover, and geolocation — each solves a different traffic-distribution problem.
ELB types: ALB (Layer 7, path/host routing, supports Lambda targets), NLB (Layer 4, extreme performance, static IP support), and health checks that determine which targets receive traffic.
Direct Connect gives a dedicated private network connection to AWS; VPN over the internet is the faster-to-provision but less consistent alternative.

Compute Optimizer analyses actual usage and recommends right-sizing for EC2, Auto Scaling groups, and other resources.
Purchasing options: On-Demand (no commitment), Savings Plans/Reserved Instances (discount for commitment), Spot (deep discount, interruptible) — combining them in one Auto Scaling group is a common cost-optimization pattern.
Cost Explorer and Cost and Usage Reports give visibility into spend; Trusted Advisor's cost checks flag idle or underutilized resources automatically.
S3 storage classes and lifecycle policies move data to cheaper tiers automatically as it ages, without manual intervention.

Reading a summary is the easy part. Take the free 10-question diagnostic to see which of these domains you actually have, then drill the rest.