Certification Acquisition Memo: "CloudOps" and "DVA" [Passed]

First

This is Okarin from the Shikoku office

This article is about my experience passing
the AWS Certified CloudOps Engineer - Associate (formerly AWS Certified SysOps Administrator - Associate) and AWS Certified Developer - Associate exams

This article assumes that you have already obtained AWS SAA certification

[2024 Graduate] It's been half a year since I got my CLF. I've also got my SAA, so I'll write about my study methods and tips for passing

 

The results for each category are as follows:

It's going to be a very close call, but if I pass, that's great! That's the kind of attitude I have

 

 

study method

 

About the services used

In my previous article, I mentioned using resources like Udemy and Ping-t, but for these two exams (CloudOps and DVA), I studied solely using CloudTech

Last time I took the SAA exam, I spent a lot of time trying out different study methods to find one that suited me, so this time I decided to stick with just one service

https://kws-cloud-tech.com/

There are various plans available, but considering the future, I chose the " Lifetime Membership " plan

*The following is the price I paid when I signed the contract

Since it's a one-time purchase plan, it's quite expensive

However, Beyond Co., Ltd. provides incentive payments for passing certification exams.
This time, I used the incentive payment from my previous SAA certification, so it was practically free.
As a card gamer, "advantage" is the most fitting word to describe it.

In any case, this service offers quite comprehensive preparation for AWS certifications, so I think it's perfectly fine to consider it an investment

I used this service to solve practice problems in the format of the actual exam for a little less than two hours a day.
My study period was about six months for CloudOps and about six months for DVA.
Since DVA overlapped considerably with the scope of CloudOps and SAA, I think those six months were a bit of wasted study time.

As a general guideline, if you can score around 80% on the practice tests in the workbook, you should be fine

What I've noticed while studying is that this exam (both the old and new versions) has many questions that are based on the premise of resolving incidents and similar situations

 

I recall writing about this in my SAA exam blog, but in both exams, questions of the following format are not very common. They're
not completely absent, but I felt that there were only about 3 to 5 questions of this type.

Which service is best for [specific situation]?

①××

②▽▽

③？？

Rather, the vast majority of questions were of the following format:

I'm using ○○ and I'm experiencing problems like ●●

The customer is requesting △△, and we would like it to be achieved under the most favorable conditions possible

What is the solution to this problem?

Most problems fall into this category, often involving either "meeting the customer's requirements" or "resolving an ongoing incident."

 

As I believe I mentioned in the AWS SAA blog, I don't think you can deal with these kinds of problems by simply memorizing

Simply memorizing service names, like in a typical English vocabulary book, won't be enough to pass the exam

To pass the exam, I think it's perfectly fine to study by solving practice problems like those offered by the service mentioned above, and understanding the types of requests that may come in different situations

I think your score will naturally improve as you gain more experience and become able to handle a wider range of situations. That being said,
I think the best way to learn is to actually build a service hands-on.

Fortunately, CloudTech, which I mentioned above, includes diagrams in its explanations, making it easy to understand the process and flow

Even without hands-on practice, it might be easier to make some progress in your studies

First, decide on the exam date

I wasn't fixated on passing on the first try; I approached it with the intention of taking it several times to check my current knowledge and abilities.
As I wrote in my previous article, if you aim to pass on the first try, you inevitably end up postponing the exam.

In my favorite manga, "World Trigger" (by Daisuke Ashihara, Volume 28, Chapter 247), there's a line that goes like this:

When there is no deadline for a goal, it can be difficult to properly recognize failure

"Carve it down." You
carve out the elements necessary to climb the next step in front of you,
further carving them out within that step
to create small steps that you can take.
That action is called effort.

Without a deadline, you might keep postponing the exam, thinking "I'm not ready yet," and you won't even see what you're lacking.
That's why it's best to first set a deadline by booking an exam date, and then work backward from there, taking small steps to achieve it.

Please note that if you fail an AWS certification exam, you cannot retake it for 14 days.
If you plan to take the exam multiple times, it's a good idea to factor this period into your plan.

The exam fee is certainly not cheap, but from a card gamer's perspective, it's a necessary sacrifice.
It's much faster to pay the exam fee and check your current skill level than to waste time agonizing over when to take it.
If you think of it as buying time with money, I highly recommend it.
It's like discarding one card and drawing two, so I recommend using it actively.
By the way, if you pass an AWS certification exam, you will receive a voucher that gives you 50% off the fee for your next exam.

Where to check: You can check this in the "Benefits" section of your AWS Certified Account
. Expiration date: There is an expiration date, so check it as soon as possible.

 

AWS Certified CloudOps Engineer - Associate (SOA-C03)

Exam Overview and Differences from Existing Exams

The differences between the old SysOps exam (SOA-C02) and the new CloudOps exam (SOA-C03) are explained in the AWS blog below

*This is in English

https://aws.amazon.com/jp/blogs/training-and-certification/exam-update-and-new-name-for-operations-certification/

 

The following are the additional and enhanced test areas:

• Containers
• Modern services and features
• Multi-account, multi-region architecture
• Automation and IaC

Knowledge of container systems is required

Examples include "ECS" and "Fargate"

However, these topics are also covered in the AWS SAA exam, so even if they are added, I don't think you'll need to study them from scratch

However, it's a good idea to review when and how to use each of them so you don't forget

Upon reviewing the other details, it seems that the emphasis was placed on "qualifications that prove knowledge and skills in implementation, operation, and maintenance."

There are no differences between the old and new versions in terms of exam duration, number of questions, or cost, so please rest assured

Furthermore, laboratory testing for SOA-C02 was discontinued in 2023, and C03 is now only available as a multiple-choice test

SOA (C03)
Exam Time: 130 minutes
Exam Questions: 65 questions
Exam Fee: 20,000 yen (excluding tax)

SOA (C02)
Exam Time: 130 minutes;
Number of Questions: 65;
Exam Fee: 20,000 yen (excluding tax)

Stuck

Here are some of the things I found particularly difficult while studying CloudOps (SOA-C03)

There may be some inaccuracies in my understanding, but I hope this is helpful

You might read the following example and think, "I wish they'd explain the specifications and environment a bit more," but the actual exam is written in a much more confusing way, so please get used to it

Setting communication permission rules using network ACLs

Example of an incident

A timeout is occurring when connecting from the instance to the Aurora MySQL cluster (port 3306).
We want to be able to reliably connect to the database from the new subnet (172.18.11.0/24).

The solution is as follows:

In the answer choices, options ① and ② are often presented together, so it's easier to remember them as a set

*NACL stands for Network ACL

① Inbound rules: Add source 172.18.11.0/24 and TCP 3306 to the NACL on the DB subnet side with ALLOW

② Outgoing rules: Add the destination 172.18.11.0/24 and TCP 1024-65535 to the NACL on the DB subnet side with ALLOW

The reason ② is necessary is because NACL is stateless.
Return communication from the DB uses ephemeral ports (1024-65535), so the sender also needs to explicitly allow it.
On the other hand, security groups are stateful, so return communication is automatically allowed.
This difference is often tested.
It's a very basic concept that appears quite frequently, so it's worth remembering.

 

If a custom NACL is also configured on the app's subnet, a reverse rule (send 3306, receive 1024-65535) is also required on that side

 

I want to visualize CloudFront access logs on S3

Example of an incident

I want to analyze logs without setting up additional servers and visualize the results as a dashboard

solution

Analysis: Since the logs are already in S3, we can query them directly using Athena

Visualization: QuickSight can be used to create dashboards

 

Choose an answer that satisfies both of these conditions

To add to that, Glue is sometimes suggested as an option for this type of problem. However,
since Glue is a service for ETL (data transformation and processing) and data cataloging, it's more natural to use Athena if you're simply analyzing S3 logs as they are.

Another option is to use Redshift instead of Athena.
However, Redshift requires setting up a cluster and loading data.
If the condition is "no additional servers to be set up," then the serverless Athena + QuickSight configuration, which does not require loading, is the correct solution.

 

CloudFormation Deletion Policy

This policy is extremely troublesome

The content itself is simple, but when it comes down to the actual test, it's the kind of problem that tends to get jumbled up in your head and you end up making mistakes

The behavior during deletion is summarized below

It's important to note that an S3 bucket cannot be deleted unless it's empty, and even if you specify Delete, the deletion of the stack will fail

The way it's asked varies depending on the question, but if you understand the difference between Retain and Snapshot, and the resources that can be used with Snapshot, I think it's a piece of cake

If you have the time, it's also a good idea to learn about "UpdateReplacePolicy," which determines how resources are replaced during updates

 

 

ECS scaling policy

Example of an incident

A web application running on ECS experiences a surge in access every Monday morning at 9 AM, causing slow response times because scaling out can't keep up.
We want to resolve this with minimal operational effort.

solution

Since the increase in access is regular and predictable, the correct approach is to increase the number of servers in advance using predictive scaling or scheduled scaling

There are four types of ECS scaling policies, and the key to distinguishing them is by looking at the keywords in the problem statement

Note that predictive scaling uses historical data for training, so it's not suitable for randomly occurring access.
Conversely, for one-off events with a fixed date and time, scheduling is a more reliable approach.

AWS Certified Developer - Associate

Exam Overview

The exam I took was the current DVA-C02

The following is an overview of the exam

Basically, since it's an Associate level certification, there isn't a significant difference in exam fees compared to CloudOps or SAA

The exam will cover the following four areas:

For those taking the exam: Regarding switching to DVA-C03

The DVA is scheduled to switch to a new version (DVA-C03).
Registration for the C03 exam will begin on October 27, 2026, and the last day to take the current C02 exam is November 30, 2026 (the C03 exam will be available from December 1).
Many of those taking the exam from now on will likely be taking the C03, so please check the official website for the latest information.

Exam Guide

In C03, the structure of the four fields remains the same, but new content related to AI will be added

- AI Security (New Task)

Controlling access to AI services,
controlling data privacy (such as settings to prevent input/output from being used for model training),
content filtering and prompt injection countermeasures,
security of AI agent interactions (such as tool usage authorization and human approval flows), and
protection of sensitive information included in monitoring logs.

 

AI-assisted development

AI-powered development, including code generation, reviews, and test automation, will be relevant to all areas of development

Up until now, DVA (Data Avatar) has primarily focused on AWS SDKs and serverless implementations.
The explicit inclusion of the perspective of "how to safely integrate AI" is a significant change.

On the other hand, prompt engineering, RAG design, AI model selection, and SageMaker AI are outside the scope, so it seems that expertise in AI is not required.
Also, existing areas such as DynamoDB and testing have had their skills reorganized and integrated.

Please note that the "key points to remember" in this article are based on my experience at C02

 

Key points to keep in mind

The DVA exam overlaps considerably with the SAA and CloudOps exams, so I was able to get through most of it without much difficulty.
Basically, if you've passed CloudOps, you should be able to score around 60%.
In fact, I took the exam twice, and even on my first attempt, which I failed, I scored around 70%.

Of all the things I studied, I was glad I learned about the differences between the Code families. I
didn't have much trouble with the other topics because I had many opportunities to work with them in my job.

 

Differences between the Code family (CodeCommit / CodeBuild / CodeDeploy / CodePipeline, etc.)

The names are similar, and the questions often involve configurations that combine multiple services, which can easily lead to confusion.
I remembered it by thinking it was like the Keith series from the manga "ARMS."

The most important point is that "CodePipeline itself does neither build nor deploy."
CodePipeline is merely the "director" that connects the various services; the actual work is done by CodeBuild and CodeDeploy.
Be careful, as some options include misunderstandings such as "build with CodeDeploy" or "deploy to EC2 using only CodeBuild."

Another thing that can easily be confused is the name of the configuration file

buildspec.yml → CodeBuild (Writes build instructions)
appspec.yml → CodeDeploy (Writes deployment instructions and hooks)

It's helpful to be able to distinguish between "build" and "app" as the services being referred to

CodeDeploy deployment method

CodeDeploy is frequently tested on deployment methods.
Since this is a common topic, memorizing it will be a good way to score points.

 

*Canary and Linear are traffic switching settings used for blue/green deployments of Lambda and ECS

If you want "no downtime" and "a quick rollback," choose Blue/Green.
If you want to "try it out with a limited number of users first," choose Canary. Remembering this will make choosing easier.

Note that when deploying to EC2 or on-premises using CodeDeploy, you will need to install the CodeDeploy agent on the server.
This is another point that sometimes comes up as a trick question, so please keep it in mind.

summary

This time, I've put together a brief summary of study methods and points where I got stuck regarding two certifications: CloudOps and DVA

Finally, here are just three pieces of advice for those who will be taking the exam in the future

First, you need to set a deadline for deciding on the exam date
, otherwise you'll remain "unprepared" indefinitely.

Instead of rote memorization and
aiming for 80% on practice tests in workbooks , it's important to understand "what kind of requests come in what kind of situations."

If you have CloudOps,
the areas you can target in DVA overlap considerably, so I don't think you need to spend six months on it like I did.

My next goal is to obtain the SAP certification, rather than another Associate certification, since my SAA renewal deadline is approaching next year.
Passing the SAP exam will also recertify my SAA, so I can renew and advance my certification at the same time.
It's like killing two birds with one stone.

Thank you for reading to the end