Study SOA-C03 CloudWatch, CloudTrail, and Alarms: key concepts, common traps, and exam decision cues.
On this page
This lesson covers the first operational question SOA-C03 asks again and again: how do you know what changed, what failed, and who should react? AWS expects CloudOps engineers to understand which signal comes from metrics, which comes from logs or audit trails, and how alarms and notifications should be routed.
Composite alarm: CloudWatch alarm that evaluates multiple other alarms together to reduce noise or enforce a more meaningful condition.
Audit trail: Record of actions and changes, such as API calls, that helps explain who did what and when.
What AWS is really testing here
AWS wants you to distinguish:
metrics from logs from audit history
raw signal collection from actionable alarm logic
noisy notifications from meaningful routed notifications
one-account visibility from multi-account or multi-Region operational views
High-yield chooser
If the requirement is mainly about…
Strong lane
numeric thresholds, trends, or service health state
CloudWatch metrics and alarms
change history, API activity, or who altered a resource
CloudTrail and audit records
central operational visibility across environments
dashboards
telling the right responders what happened
SNS-backed notifications
Common traps
using logs when the real question is about threshold alarms
assuming every alert should page immediately
forgetting that dashboards can aggregate across accounts and Regions
mixing audit history with runtime metrics
Decision order that usually wins
Decide whether the question is mainly about runtime condition, log detail, audit history, or notification routing.
If the real need is who changed what and when, go to CloudTrail before CloudWatch.
If the real need is thresholds, trends, or state transitions, go to CloudWatch metrics and alarms first.
If the real need is noise reduction, think composite alarms and better alarm logic before adding more pages.
If the real need is who needs to know, finish with the SNS or notification path, not with more dashboards.