Skip to content
CertGPS

AWS Certified Security - Specialty

Proves you can secure a multi-account AWS organization, from detection and incident response to KMS keys, now tested on the SCS-C03 exam

AdvancedAmazon Web Services

The exam

Exam cost
$300
Study time
4-6 months
Passing score
750 (scale of 100–1,000)
Valid for
3 years

Before you book

  • None required
  • Recommended: five years of IT security experience designing and implementing security solutions
  • Recommended: two or more years of hands-on experience securing AWS workloads

What it covers

Security domains

Career

US pay and outlook from the Bureau of Labor Statistics for the closest BLS occupation to each role this certification fits. BLS doesn't report pay by certification, and counts most of these roles only within a wider occupation, so the figures describe that occupation, not the role or the credential.

Where people with it work

  1. Entry level

  2. Mid level

  3. Senior level

Where it leads

  1. Certified Information Systems Security Professional

    Expert

    Comes before. Adds the governance and risk breadth that this AWS-focused exam leaves out

  2. AWS Certified Security - Specialty

    You are here

Study guide

Last updated

AWS Security Specialty Study Guide: SCS-C03, Its Six Domains and a Lab Plan

AWS Certified Security - Specialty checks whether you can secure a whole AWS organization: logging across accounts, key management, permission guardrails and incident response. The exam is now SCS-C03, which replaced SCS-C02 on December 2, 2025. Before you buy a course or a practice test, check that it was written for the new code, because the domains were reorganized and several topics were added or dropped.

Who should sit it, and who should wait

AWS pitches it at people with five years of IT security experience designing and implementing security solutions, plus at least two years of hands-on work securing AWS workloads. The exam guide sets the bar a little lower, at the equivalent of three to five years securing cloud solutions. Either way, that's a cloud security engineer, a security architect on an AWS-heavy team, or the DevSecOps lead who owns the guardrails. No earlier certification is required, though AWS notes that candidates commonly hold Solutions Architect - Associate or Professional first.

Wait if you haven't yet run AWS in production. The questions assume you know how Organizations, CloudTrail and KMS behave once there are dozens of accounts. If your employer runs mostly on Azure, Microsoft's Cloud and AI Security Engineer Associate is the better spend, and on Google Cloud it's Professional Cloud Security Engineer. For a credential that isn't tied to one console, look at CCSP.

SCS-C03 at a glance

SCS-C03
In use sinceDecember 2, 2025 (SCS-C02 ran until December 1, 2025)
Questions65: 50 scored and 15 unscored, not marked as such
Question typesMultiple choice, multiple response, ordering and matching
Time170 minutes
Passing score750 on a 100–1,000 scale; compensatory, so no per-domain minimum
Price$300; taxes may apply
DeliveryPearson VUE test center or online proctored
LanguagesEnglish, Japanese and Korean; Portuguese (Brazil), Simplified Chinese and Spanish (Latin America) retire after December 31, 2026
PrerequisitesNone required; five years in IT security and two years securing AWS workloads recommended
ValidityThree years

How the six domains split

  • Detection: 16%
  • Incident Response: 14%
  • Infrastructure Security: 18%
  • Identity and Access Management: 20%
  • Data Protection: 18%
  • Security Foundations and Governance: 14%

Identity and Access Management is now the largest domain, up from 16% in SCS-C02, and most of the skills listed under it are troubleshooting tasks. You're expected to design attribute-based and role-based access, use permission boundaries and session policies, work with Amazon Verified Permissions and IAM Roles Anywhere, and explain an authorization failure with IAM Policy Simulator or IAM Access Analyzer. AWS removed "components and impact of a policy" from the outline. Our reading is that it now assumes you can read a policy and asks you to fix one.

SCS-C02's "Threat Detection and Incident Response" and "Security Logging and Monitoring" have been rebuilt as Detection and Incident Response, 30% together. Expect organization-wide CloudTrail trails, a dedicated logging account, Amazon Security Lake, queries in Athena and CloudWatch Logs Insights, Route 53 Resolver and transit gateway flow logs, forensic capture of logs, and Amazon Detective for root cause.

The additions tell you where AWS thinks the job has moved. Skill 3.2.7 covers guardrails for generative AI applications and points to the OWASP Top 10 for LLM Applications. Others cover ingesting data in Open Cybersecurity Schema Framework (OCSF) format, masking sensitive data in CloudWatch Logs and Amazon SNS, imported versus AWS-generated key material, and keys and private certificates across Regions. Host-based firewalls, TCP/IP basics, VPC Reachability Analyzer, S3 static website hosting and the AWS Security Finding Format were dropped. The governance domain names service control policies, resource control policies, declarative policies, AI service opt-out policies and centralized root access for member accounts, features recent enough that an older course may skip them.

The outline is narrower than "security" suggests. AWS lists designing cryptographic algorithms, packet-level traffic analysis, architecting whole cloud deployments and training machine learning models as out of scope. It's an exam about choosing and configuring AWS controls.

A lab plan built on a real organization

Read the six domain pages of the exam guide first. Each skill carries example services in brackets, and those brackets are the closest thing AWS publishes to a reading list. Then build a sandbox AWS Organization that isn't your employer's, and work through it roughly in this order:

  1. Set up AWS Control Tower with a log archive account and an organization trail, then delegate Amazon GuardDuty and AWS Security Hub administration to a security account (Tasks 1.2 and 6.1).
  2. Write a service control policy and a resource control policy that collide with an identity policy, and use Access Analyzer and Policy Simulator to explain the denial (Task 4.2).
  3. Create a customer managed KMS key with a key policy and grants, import your own key material, add a multi-Region replica, and require TLS on an S3 bucket through its bucket policy (Domain 5).
  4. Run an incident drill: generate GuardDuty sample findings, route them through Amazon EventBridge to a Systems Manager automation that isolates an instance and snapshots its volume (Tasks 2.1 and 2.2).
  5. Put AWS WAF with a rate-based rule in front of CloudFront, and add an AWS Network Firewall rule group to a VPC (Domain 3).

Several of these services bill by usage, so tear the lab down between sessions.

For practice, AWS's Exam Prep Plan on AWS Skill Builder bundles the Official Practice Question Set, AWS Builder Labs, AWS Jam, AWS SimuLearn and the Official Pretest. Save the Pretest for the last week, as a readiness check. We'd put about half your hours into the lab, a quarter into the documentation for services you haven't used, and the rest into timed practice. You get 170 minutes for 65 questions, roughly 2.6 minutes each, and the long scenario stems use most of it.

Renewal, retakes and next steps

The certification lasts three years. You can renew by passing the latest version of the exam, which adds three years and accepts the 50% discount voucher in your AWS Certification Account. Or you can maintain it through AWS Skill Builder, which needs a paid subscription, opens within 90 days of expiry and adds one year. If you fail, you wait 14 calendar days and pay the full fee again; there's no cap on attempts. Once you pass, you can't sit the same exam for two years unless AWS releases a new exam code.

Earning any AWS certification also gives you 50% off your next AWS exam. Where to go from here depends on the gap you want to close:

  • CISSP if you're moving toward architecture or leadership and need the governance breadth this exam leaves out.
  • CCSP to show the same skills in vendor-neutral terms.
  • CKS if your workloads run on Amazon EKS, since the SCS-C03 outline names EKS only once, for encryption between nodes.

Our view

The certification is respected because it assumes organization-scale AWS and because the SCS-C03 refresh names recent features such as resource control policies and centralized root access. The criticism is fair, too. It's a multiple-choice test of which AWS feature fits a scenario, so it rewards product knowledge that ages quickly, and it can't show that you built anything. At $300 it's worth it if you secure AWS every day or want a cloud security role at an AWS shop. If your work is vendor-neutral risk and governance, spend the money on CISSP or CCSP instead.

Sources