Skip to content

AWS Certified Security - Specialty (SCS-C03)

The specialty exam for people who secure AWS workloads: logging and detection, incident response, edge and network controls, identity, encryption and multi-account governance. It is the current exam; SCS-C02 closed on December 1, 2025 and its guide is kept only as reference.

Exam Details

  • Exam Code: SCS-C03
  • Duration: 170 minutes
  • Questions: 65 (50 scored, 15 unscored); multiple choice, multiple response, ordering and matching
  • Passing Score: 750 on a 100-1,000 scale
  • Cost: $300 USD (AWS page, checked 2026-11-07)
  • Validity: 3 years
  • Recommended experience: five years of IT security and two or more years securing AWS workloads (AWS certification page)

Full detail and sources in the fact sheet.

Domains

Domain Weight Notes
1. Detection 16% 01
2. Incident Response 14% 02
3. Infrastructure Security 18% 03
4. Identity and Access Management 20% 04
5. Data Protection 18% 05
6. Security Foundations and Governance 14% 06

How this exam differs from Associate and Professional exams

The specialty exam assumes you know AWS and asks which security design fits a constraint: lowest operational effort, least privilege, works across accounts, survives a compromised administrator. The task statements start with verbs like "design", "implement" and "troubleshoot", and the troubleshooting tasks are real: a trail that is not delivering, a key policy that locks out a role, an SCP that blocks a service. Learn the services by what they prove or prevent, and always ask where the control lives (account, organization, resource, network).

IAM is the largest domain at 20%, and almost every other domain depends on it, so give it extra time.

Study sequence

  1. Identity and access management (20%) - policy evaluation, roles and trust, ABAC, Access Analyzer.
  2. Security foundations and governance (14%) - Organizations, SCPs, Control Tower, Config. It sets the guardrails the other domains sit inside.
  3. Data protection (18%) - KMS, secrets, Object Lock, backups, TLS.
  4. Infrastructure security (18%) - WAF, Network Firewall, security groups, endpoints, hardened images.
  5. Detection (16%) - CloudTrail, GuardDuty, Security Hub, Security Lake.
  6. Incident response (14%) - runbooks, forensics, containment, Detective.

Schedule in the practice plan.

Study resources