SCS-C02
AWS Certified Security - Specialty
AWS Certified Security - Specialty Exam Guide: SCS-C03 Preparation and Study Roadmap
AWS Certified Security - Specialty SCS-C03 validates advanced technical ability to secure AWS products, services, workloads, and architectures. It is aimed at people responsible for cloud security, with AWS describing the target candidate as having the equivalent of 3–5 years of experience securing cloud solutions. This guide helps you decide whether your current experience is sufficient, which domains deserve the most study time, how to practise the measured skills, and when to schedule the exam through an authorized delivery option.
What does AWS Certified Security - Specialty validate?
The exam tests whether you can design, implement, operate, and troubleshoot security controls across AWS environments rather than simply identify the names of security services. AWS specifically includes data classification, encryption, secure internet protocols, production security services, security operations, and decisions that balance cost, security, and deployment complexity.
The current exam is AWS Certified Security - Specialty SCS-C03. AWS states that SCS-C03 began use on December 2, 2025. Its scope is organized around six content domains: Detection, Incident Response, Infrastructure Security, Identity and Access Management, Data Protection, and Security Foundations and Governance.
The practical implication is important: preparation should connect services to requirements. A question may ask how to reduce an incident’s blast radius, preserve evidence, prevent unnecessary network access, centralize account controls, or protect a key across Regions. Memorizing isolated service descriptions is less useful than understanding the security decision each service supports.
The exam is not a general architecture assessment. AWS lists designing cryptographic algorithms, analyzing traffic on the packet level, architecting overall cloud deployments, managing end-user compute resources, and training machine learning models as out of scope. Do not spend preparation time trying to turn the certification into a general networking, software development, or cryptography exam.
Decide whether the certification fits your role
This certification is a strong fit if your work includes cloud security design, identity at scale, multi-account governance, vulnerability management, incident response, audit response, logging and monitoring, encryption, or disaster-recovery controls. AWS’s recommended knowledge also includes software supply chain risks and developing firewall rules at scale for layers 3–7.
AWS’s certification page additionally describes an intended audience with five years of IT security experience designing and implementing security solutions and at least two years of hands-on experience securing AWS workloads. The exam guide describes the target candidate as having the equivalent of 3–5 years of experience securing cloud solutions. Treat both descriptions as experience guidance, not as an application prerequisite.
If your AWS experience is mostly introductory, begin with the shared responsibility model, IAM fundamentals, account structure, networking, storage, compute, and core monitoring before starting specialty-level question practice. If you already operate security controls, use the domain tasks to identify gaps rather than studying every AWS service equally.
How is the SCS-C03 exam structured?
The exam contains 65 multiple-choice or multiple-response questions, and the exam duration is 170 minutes. The exam includes 50 questions that affect your score and 15 unscored questions that do not affect your score. Unanswered questions are scored as incorrect, and AWS states that there is no penalty for guessing.
Question types can include multiple choice, multiple response, ordering, and matching. Multiple-choice questions have one correct response and three distractors. Multiple-response questions have two or more correct responses among five or more options. Ordering questions require a sequence of 3–5 responses, while matching questions require every pair to be matched correctly.
Your result is reported as a scaled score of 100–1,000, and the minimum passing score is 750. Because the score is scaled, do not translate a practice percentage directly into an official pass prediction. Use practice results to locate weak objectives, diagnose reasoning errors, and decide whether to schedule or postpone.
The listed exam languages are English, Japanese, Korean, Brazilian Portuguese, Simplified Chinese, and Latin American Spanish. AWS offers the exam through Pearson VUE testing centers or online proctoring. AWS lists the exam cost as 300 USD and directs candidates to its exam-pricing information for foreign-exchange details.
Use the exam format to plan your time
The 170-minute duration creates a time-management decision, but the official material does not prescribe a question-by-question pace. A practical approach is to move steadily, mark questions that require extended comparison, and return to them after completing the questions you can answer confidently.
Read the requirement before evaluating the services in the options. Identify constraints such as least privilege, centralized management, forensic preservation, cross-Region operation, minimal operational overhead, or the need to contain rather than immediately destroy a resource. Then eliminate answers that solve a different problem.
For multiple-response questions, verify every selected option against the requirement. For ordering and matching questions, slow down enough to check the full sequence or every pair; AWS states that ordering questions require the correct responses in the correct order and matching questions require all pairs to be correct for credit.
Do not leave items unanswered. If you cannot resolve a question after a careful pass, make the best supported selection and use any available review process rather than assuming an unanswered item is safer.
Which domains carry the most scored content?
The official SCS-C03 blueprint assigns the largest scored-content weighting to Identity and Access Management at 20%. Infrastructure Security carries 18%, Data Protection carries 18%, Detection carries 16%, Incident Response carries 14%, and Security Foundations and Governance carries 14%. Use these labels with the percentages when allocating study time.
The weights are a prioritization aid, not a reason to ignore the smaller domains. The domains overlap in realistic security scenarios: an incident may require detection, identity analysis, log correlation, network containment, data protection, and governance decisions in one case.
Start by mapping your experience to tasks in all six domains. Then give additional review time to high-weight domains where you lack hands-on practice. A candidate strong in IAM but weak in detection should not simply follow the weighting; the detection gap may produce errors across incident-response questions as well.
Detection: turn security telemetry into useful decisions
Detection covers monitoring, logging, alerting, and troubleshooting. It is not enough to know that CloudTrail, CloudWatch, GuardDuty, Security Hub, or Security Lake exists; you must decide which sources to collect, where to store them, how to analyze them, and how to correct missing or misleading telemetry.
Task 1.1 includes designing and implementing monitoring and alerting for an AWS account or organization. The skills include workload monitoring, aggregating security events, creating metrics, alerts, and dashboards, and automating regular assessments and investigations with examples such as AWS Config conformance packs, Security Hub, and Systems Manager State Manager.
Task 1.2 focuses on logging solutions. Study how requirements determine sources and destinations. The blueprint includes organization CloudTrail trails, a dedicated CloudWatch logging account, the CloudWatch Logs agent, Security Lake, third-party integrations, CloudWatch Logs Insights, Athena, OpenSearch Service, Lambda, and Amazon Managed Grafana.
Network context matters. AWS specifically identifies VPC Flow Logs, transit gateway flow logs, and Route 53 Resolver logs as examples of sources selected according to network design, threats, and attacks. Practise explaining what each source can reveal and what it cannot reveal.
Task 1.3 tests troubleshooting. Work through failure chains: a service is producing no logs, a delivery permission is wrong, an agent is misconfigured, a log group is not receiving events, or an alert is based on an incomplete source. Your notes should record the symptom, likely control, permission or configuration check, and remediation.
Incident Response: connect preparation, evidence, containment, and recovery
Incident Response covers both preparing for security events and handling them. The official skills move from response plans and runbooks to service preparation, testing, automated remediation, forensic artifact preservation, log correlation, finding validation, containment, eradication, recovery, and root-cause analysis.
For Task 2.1, build a response sequence rather than a list of products. Consider how access is provisioned before an incident, how tools are deployed, how blast radius is minimized, and how protections such as Shield Advanced are configured. AWS also names Systems Manager OpsCenter, Fault Injection Service, Resilience Hub, Step Functions, Automated Forensics Orchestrator for Amazon EC2, Application Recovery Controller, and Lambda as examples in this task.
Task 2.2 expects you to handle affected resources and evidence. Study the distinction between capturing and storing relevant logs as forensic artifacts, searching and correlating events, validating AWS security-service findings, containing and eradicating threats, restoring backups, and conducting root-cause analysis with a service such as Amazon Detective.
A common mistake is to choose the most destructive action first. In scenario practice, ask whether the requirement is evidence preservation, containment, eradication, or recovery. A response that deletes a resource may remove useful evidence; a response that only investigates may leave an active threat exposed. The correct action depends on the stated incident phase and business constraint.
Infrastructure Security: secure the edge, compute, and network
Infrastructure Security examines controls around network edge services, compute workloads, and network connectivity. The domain rewards requirement-based selection: protect the application edge, harden the workload, control administrative access, scan and patch resources, and segment or restrict traffic appropriately.
For edge security, practise selecting controls based on anticipated threats and attacks. The blueprint includes CloudFront headers, AWS WAF, AWS IoT policies, S3 CORS, Shield Advanced, geography and geolocation rules, rate limiting, client fingerprinting, third-party WAF rules, and OCSF-formatted integrations. Distinguish an edge rule from a workload or identity control.
For compute, study hardened EC2 AMIs and container images, instance profiles, service roles, execution roles, vulnerability scanning, automated patching, secure administrative access, and pipeline security. AWS gives Amazon Inspector, GuardDuty, Systems Manager Patch Manager, Systems Manager Session Manager, EC2 Instance Connect, Amazon Q Developer, and Amazon CodeGuru Security as examples.
SCS-C03 explicitly includes Skill 3.2.7, implementing protections and guardrails for generative AI applications, including protections informed by the GenAI OWASP Top 10 for LLM Applications. Add this to your study list instead of assuming older security notes cover the current blueprint.
For network controls, compare security groups, network ACLs, and AWS Network Firewall by their role and operating context. Also study Site-to-Site VPN, Direct Connect, MACsec, AWS Verified Access, north/south and east/west protections, isolated subnets, and methods for identifying unnecessary network access such as Network Access Analyzer and Amazon Inspector network reachability findings.
Identity and Access Management: reason about authentication and authorization
Identity and Access Management has the highest SCS-C03 scored-content weighting at 20%, so it deserves deliberate practice. Focus on how identities, roles, policies, federation, permissions boundaries, resource policies, organization controls, and workload identities combine to allow only the required action in the required context.
Do not study IAM as a collection of policy statements alone. For each scenario, identify the principal, the requested action, the resource, the account or organization boundary, and conditions such as network, encryption, or authentication context. Then determine whether the issue is authentication, authorization, privilege scope, credential handling, or centralized governance.
Review the difference between human administrative access and workload access. The Infrastructure Security blueprint specifically calls out instance profiles, service roles, and execution roles. Secure administrative access examples include Systems Manager Session Manager and EC2 Instance Connect, so practise choosing controlled access paths instead of assuming direct network administration is required.
The appendix maps earlier SCS-C02 identity and access tasks into SCS-C03 tasks, including authentication and authorization strategies. It also maps SCS-C02 Task Statement 6.1 to SCS-C03 authorization strategies and central deployment and management of AWS accounts. This is a reason to study account governance and identity together rather than as unrelated chapters.
Data Protection: match classification, encryption, and key control
Data Protection requires you to protect data in transit, data at rest, confidential information, credentials, secrets, and cryptographic key materials. Start each study scenario by identifying the data classification, lifecycle, access path, required encryption boundary, key ownership, and recovery or audit requirement.
The blueprint includes controls for data in transit and data at rest, along with secure internet protocols and encryption mechanisms. Study how protection requirements differ for data stored in services, data moving between resources, and data exchanged across hybrid or multi-Region environments.
SCS-C03 adds inter-resource encryption-in-transit examples involving Amazon EMR, Amazon EKS, SageMaker AI, and Nitro encryption. It also adds the distinction between imported key material and AWS-generated key material, masking sensitive data through CloudWatch Logs data protection policies or SNS message data protection, and creating and managing keys and certificates across one or multiple Regions using examples such as customer managed KMS keys and AWS Private Certificate Authority.
A useful preparation exercise is to create a decision table. Put the requirement in one column, the protected data or channel in another, the AWS mechanism in a third, and operational consequences in a fourth. Include rotation, permissions, regional scope, availability, logging, and recovery where relevant. This prevents a common mistake: selecting encryption without addressing who controls the key or how the protected service uses it.
Security Foundations and Governance: make controls repeatable
Security Foundations and Governance connects the shared responsibility model, account strategy, compliance evaluation, secure and consistent deployment, and organizational security operations. Study this domain as the control layer that makes detection, identity, infrastructure, and data protection consistent across accounts and environments.
The official outline includes implementing a secure and consistent deployment strategy for cloud resources and evaluating the compliance of AWS resources. Review how preventive, detective, and responsive controls differ, how account-level requirements are applied consistently, and how evidence can support an audit or investigation.
AWS expects candidates to make decisions that account for tradeoffs between cost, security, and deployment complexity. In practice questions, do not automatically choose the most elaborate architecture. First identify the minimum control that satisfies the requirement, then consider whether the question prioritizes centralized management, operational simplicity, stronger isolation, faster remediation, or reduced cost.
The appendix records changes from SCS-C02 to SCS-C03, including the removal of identifying security gaps through architectural reviews and cost analysis from Task 6.4. Use the current SCS-C03 domain tasks as your authority, especially when an older course or practice set uses the previous exam structure.
How should you prepare if you are starting now?
Begin with the official SCS-C03 exam guide and domain pages, then build a gap-led plan around the tasks rather than around a random service catalog. Confirm that every study resource matches SCS-C03, because the appendix identifies additions, deletions, and recategorizations from SCS-C02.
First, perform a baseline review without trying to memorize answers. For each domain, mark yourself as confident, familiar, or uncertain on the task statements. Record concrete gaps such as log-source selection, cross-account monitoring, containment sequencing, WAF design, role selection, inter-resource encryption, or compliance automation.
Next, study in connected blocks. A detection block can combine CloudTrail, VPC Flow Logs, CloudWatch Logs, Security Hub, Security Lake, and log analysis. An incident block can use those outputs to practise validation, evidence preservation, containment, recovery, and root cause. This mirrors the way security work crosses service boundaries.
Use hands-on work where it is safe and available, but do not treat a lab as proof that you understand every scenario. After each exercise, write the requirement, the control selected, the permissions involved, the failure mode, and the alternative you rejected. That explanation is more valuable than copying a console sequence.
Use practice questions only as a diagnostic tool. Review why each distractor fails, which requirement it overlooks, and whether the error came from service knowledge, policy reasoning, sequencing, or reading. Do not rely on exam dumps or leaked questions; memorization does not establish the measured security skill and cannot guarantee a passing result.
A practical six-stage study sequence
A staged sequence keeps broad coverage while giving additional attention to the highest-weight domains. Adjust the time spent in each stage to your experience and baseline results; the official materials provide domain weightings, not a required study duration.
Stage 1: establish the AWS security model
Review shared responsibility, account and organization structure, identity at scale, core networking, compute, storage, logging, encryption, backup, and recovery concepts. The goal is not exhaustive service coverage; it is enough foundation to understand why a security control is appropriate.
Stage 2: build detection and logging fluency
Map workload requirements to telemetry. Practise organization logging, storage and retention decisions, event aggregation, alert creation, log analysis, normalization, correlation, and troubleshooting missing data. Include network-specific sources and the permissions needed for delivery.
Stage 3: rehearse incident response
Write short runbooks for preparation, detection validation, evidence capture, containment, eradication, recovery, and root-cause analysis. Add an automated remediation path and a testing method. Make each runbook state what must be preserved before an irreversible action.
Stage 4: secure infrastructure paths
Compare edge controls, compute hardening, roles, vulnerability scanning, patching, administrative access, pipeline protections, generative-AI guardrails, network segmentation, hybrid connectivity, and unnecessary-access analysis. Use small architecture sketches to show traffic direction and trust boundaries.
Stage 5: consolidate identity and data protection
Work through authorization decisions, cross-account access, workload roles, key policies, certificates, encryption in transit, encryption at rest, secrets, masking, and regional key management. Explain the operational tradeoff behind each choice instead of writing only a product name.
Stage 6: validate readiness against tasks
Return to the official task statements and explain each one without notes. Then complete mixed practice under timed conditions, review every error, and revisit only the weak objectives. Schedule when your evidence shows consistent reasoning across domains, not merely when you have finished a video course.
What mistakes commonly waste preparation time?
The most expensive mistakes are studying the wrong version, confusing service recognition with design ability, ignoring troubleshooting, and treating every question as a request for the strongest possible control. Correct these by anchoring study to SCS-C03 task statements and by explaining the requirement before selecting a service.
Using SCS-C02 material without checking the comparison appendix can leave gaps in current objectives. SCS-C03 adds validation of security-service findings, edge and third-party integrations, generative-AI protections, inter-resource encryption in transit, key-material distinctions, data masking, and multi-Region key and certificate management.
Another mistake is treating the domain percentages as a complete study plan. Identity and Access Management has 20% of scored content, while Infrastructure Security and Data Protection each have 18%, Detection has 16%, Incident Response has 14%, and Security Foundations and Governance has 14%. Those labels should guide prioritization, but a weak foundational area can undermine performance in several domains.
Avoid learning controls without failure modes. Ask what happens when a log source is absent, a role lacks permission, a key cannot be used in the required Region, a security group permits an unintended path, a finding is inaccurate, or a containment action damages evidence. Troubleshooting and response questions depend on these distinctions.
Do not overinvest in out-of-scope work. Designing cryptographic algorithms, packet-level traffic analysis, overall cloud deployment architecture, end-user compute management, and machine learning model training are not the exam’s target tasks. Study the security controls around those systems where the blueprint names them, but do not broaden preparation indefinitely.
Finally, do not infer that a practice score maps directly to the official result. The exam uses a scaled score of 100–1,000, includes unscored content, and provides section-level feedback that AWS cautions candidates to interpret carefully. Use results to improve decisions, not to create false precision.
When should you schedule the exam?
Schedule after you can explain the current SCS-C03 domains and tasks, resolve scenario-based tradeoffs without relying on service-name recognition, and complete mixed practice with a repeatable review method. Choose a testing center or online proctoring according to the delivery conditions you can reliably manage.
Before booking, verify the current exam page for availability, registration instructions, language, pricing, and delivery policies. The official page lists Pearson VUE testing centers and online proctoring, the listed languages, a 170-minute duration, 65 multiple-choice or multiple-response questions, and a listed cost of 300 USD.
Do not schedule solely because you have completed a fixed number of study days. A better trigger is task coverage: you can describe how to collect and analyze evidence, design a response plan, secure edge and compute paths, control identities, protect data, and apply governance across accounts.
If a baseline reveals a major gap, postpone rather than trying to compensate with memorized question patterns. If your weakness is narrow, schedule and use the remaining preparation for targeted review. Keep checking the official AWS page for any delivery or registration information that may change.
A final-week checklist
Confirm that your materials identify SCS-C03. Review the six domain names and their official task statements. Revisit the areas where you confuse similar controls, especially logging versus monitoring, authentication versus authorization, containment versus recovery, security groups versus network ACLs, and service-managed versus customer-managed key responsibilities.
Practise reading for constraints: organization-wide scope, cross-account requirements, hybrid connectivity, forensic preservation, least privilege, network direction, workload type, compliance evidence, and cost or operational complexity. These constraints often determine the answer more than the service names do.
Prepare a short comparison sheet for recurring choices. Include the problem solved, the relevant control, the prerequisite or permission, the evidence produced, and the limitation. Keep it concise enough to review without replacing understanding with last-minute cramming.
On exam day, answer every question, use the review facility where available, and reserve attention for ordering and matching items that require complete correctness. Do not let one ambiguous scenario consume the time needed for questions you can solve.
What happens after you earn the certification?
AWS certifications are valid for three years from the date earned, after which candidates must recertify to keep the credential current and active. Treat recertification as a reason to maintain working knowledge of AWS security changes, not as a substitute for practical security operations.
Keep your preparation notes as an operational reference. Update them when your organization changes its account structure, logging design, identity model, network segmentation, key strategy, incident runbooks, or vulnerability-management pipeline. The strongest long-term benefit comes from turning exam concepts into repeatable controls and tested response procedures.
For professional development, revisit the SCS-C03 task statements periodically and compare them with the security decisions you make at work. New additions in the current blueprint, including generative-AI guardrails, inter-resource encryption, data masking, and cross-Region key and certificate management, are especially useful prompts for reviewing whether existing controls still match current workloads.
Use the official recertification policy for the current renewal rules and options. Do not assume that a past exam date, study resource, or older certification version describes the requirements that apply when you next need to renew.
Conclusion
The most reliable preparation path is requirement-first study: understand the SCS-C03 task statements, connect related AWS controls, practise troubleshooting and incident sequencing, and use mixed questions to expose weak reasoning. Give extra attention to Identity and Access Management, Infrastructure Security, Data Protection, and Detection according to their labeled scored-content weightings, while retaining coverage of Incident Response and Security Foundations and Governance. Before scheduling, verify the official AWS exam page and confirm that your knowledge reflects SCS-C03 rather than an older exam version.
Related exams
- ANS-C01 exam — Amazon AWS Certified Advanced Networking - Specialty
- AWS-Certified-Machine-Learning-Specialty-MLS-C01 exam — AWS Certified Machine Learning - Specialty
- AXS-C01 exam — AWS Certified Alexa Skill Builder-Specialty