Browse AWS Certification Guides

SOA-C03 Networking and Content Delivery Guide

AWS SOA-C03 networking guide covering VPC connectivity, DNS, CloudFront, Global Accelerator, and troubleshooting decisions.

This chapter is where SOA-C03 tests whether you can operate AWS networking with the mindset of a CloudOps engineer instead of a diagram reader. AWS wants you to build the right path, protect it with the right control, direct users with the right DNS or delivery service, and then troubleshoot failures from evidence instead of guesswork.

I verified the current SOA-C03 Domain 5 task split against the AWS exam guide on May 11, 2026. AWS currently breaks this domain into three operational abilities:

  1. implement and optimize networking features and connectivity
  2. configure domains, DNS services, and content delivery
  3. troubleshoot network connectivity issues

Current weight in the exam guide

AWS currently weights Networking and Content Delivery at 18% of scored content.

What this domain is really testing

AWS wants you to prove that you can:

  • distinguish public, private, and hybrid paths
  • separate routing, filtering, private service access, and network protection
  • choose between Route 53, CloudFront, and Global Accelerator based on the actual requirement
  • optimize network cost without breaking reachability or protection
  • troubleshoot the intended path in the correct order instead of inspecting random controls

Work this domain in order

Lesson Official task fit Why it matters
5.1 VPC Connectivity & Protection Task 5.1 This is the path-building lane: subnets, routes, gateways, private connectivity, network protection, and cost-aware path choice.
5.2 DNS, CloudFront & Global Accelerator Task 5.2 This is the request-direction lane: Route 53, Resolver, query logging, CDN behavior, and global entry-path design.
5.3 Network Logs & Cache Failures Task 5.3 This is the troubleshooting lane: VPC configuration, network logs, CloudFront cache failures, and hybrid/private path diagnosis.

Fast routing inside this chapter

If the stem is really about… Go first to… What to look for
VPCs, subnets, route tables, NAT, endpoints, PrivateLink, VPN, Direct Connect, WAF, Shield, Resolver DNS Firewall, or network cost 5.1 VPC Connectivity & Protection path type, protection layer, private connectivity model, egress cost
Route 53 hosted zones, Resolver, query logging, routing policies, CloudFront, S3 origin access, or Global Accelerator 5.2 DNS, CloudFront & Global Accelerator DNS decision logic, CDN behavior, global entry path
flow logs, ELB logs, WAF logs, CloudFront logs, transit or hybrid failures, route mistakes, or stale content 5.3 Network Logs & Cache Failures intended path, evidence source, cache vs origin, hybrid route proof

Common domain traps

Trap Better thinking
“Private access to an AWS service just means use NAT.” NAT gives outbound internet-style egress; endpoints or PrivateLink are often the private-service answer.
“CloudFront and Global Accelerator are basically the same.” CloudFront is strongest for CDN and edge caching; Global Accelerator is strongest for global application entry-path performance.
“Network protection means security groups only.” The exam also expects WAF, Shield, Network Firewall, and Resolver DNS Firewall where appropriate.
“Troubleshooting should start with security groups.” First prove the intended route and connectivity model actually exist.

How strong SOA-C03 answers usually work

  1. Identify whether the path should be public, private, or hybrid.
  2. Choose the right routing or delivery service for that path.
  3. Apply the protection layer that matches the risk.
  4. When something fails, inspect the intended path before the packet filter.
  5. Keep cost optimization subordinate to connectivity correctness and security.

In this section

Revised on Monday, June 15, 2026
4. Security & Compliance
Study Plan