ExamPark
Course menuSCS-C03

Exams / SCS-C03 / Study guide

AWS Certified Security – Specialty (SCS-C03) study guide

What the SCS-C03 exam tests, domain by domain, and how to tell the right answer from the nearly right one. Each topic links to fuller study notes and free practice questions.

Last checked against the official exam guide and AWS documentation · How we write our content

About the SCS-C03 exam

The AWS Certified Security – Specialty exam checks whether you can design, build and run security controls across AWS workloads and whole organizations: detecting threats, responding to incidents, protecting identities and data, and governing many accounts. It is aimed at people with the equivalent of 3 to 5 years of experience securing cloud solutions.

SCS-C03 replaced SCS-C02. The last day to take SCS-C02 was December 1, 2025, so study from the SCS-C03 exam guide and not from older SCS-C02 notes.
Questions 65: 50 scored and 15 unscored, which aren’t marked
Time 170 minutes
Question types Multiple choice (one answer from four), multiple response (two or more from five or more), ordering (put three to five responses in order) and matching (match responses to three to seven prompts)
Score Scaled from 100 to 1,000; 750 to pass
Scoring model Compensatory: you need to pass overall, not in each domain
Guessing An unanswered question counts as wrong, and there is no penalty for a wrong answer, so answer everything
Price 300 USD

Check the official certification page for local pricing, languages and booking options before you book. The SCS-C03 exam guide lists the skills under each domain, and it is the document to check these notes against.

What the exam really tests

Specialty questions describe a company with a real security problem: an alert nobody saw, an exposed bucket, a partner that needs access, or a regulator asking for evidence. The right answer fixes the problem with controls that work across many accounts. A few themes run through the whole exam:

  • Detect early. Turn logs from every account into findings and alerts that someone acts on, using GuardDuty, Security Hub, CloudTrail and logs you can query.
  • Respond in order. Prepare first, then contain, preserve evidence, investigate, recover and learn. Automate the steps that repeat.
  • Limit access. Temporary credentials, least privilege, cross-account trust and workforce federation through IAM Identity Center.
  • Protect data. Encrypt in transit and at rest with KMS key policies in mind, keep traffic on private paths and keep backups recoverable.
  • Govern at scale. SCPs and RCPs, delegated administrators, guardrails in infrastructure as code and compliance checks that run continuously.
  • Secure new workloads. Containers, CI/CD pipelines and generative AI applications need the same controls as anything else.

How to read a Security Specialty question

  1. Read the last sentence first to find the qualifier: LEAST operational overhead, MOST secure, MOST cost-effective, or fewest changes to the existing setup.
  2. List the hard constraints: which accounts and Regions, what kind of data is involved, which compliance rule applies and what has already happened.
  3. Check the phase. If an incident is underway, the right answer isolates the affected resource before anyone investigates in depth, and it preserves evidence before anything is changed or deleted.
  4. Eliminate options that break a constraint, use a retired or closed service, or destroy evidence.
  5. Between the rest, pick the option that meets the qualifier with managed controls.

Ordering questions give three to five steps and ask for the sequence, so learn the order of common procedures. For incident response, that means detect and triage, contain, preserve evidence, investigate and scope, eradicate, recover, and then review lessons learned. Matching questions pair three to seven prompts, such as scenarios, with responses such as services or settings, and each response is used at most once. Multiple response questions state how many answers to choose, so keep checking the remaining options after you find one that works.

How the domains add up

Identity and Access Management is the largest domain at 20%. Infrastructure Security and Data Protection follow at 18% each, then Detection at 16%. Incident Response and Security Foundations and Governance are 14% each. The domains overlap: a detection question may turn on a KMS key policy, and an incident response question may depend on an SCP that governance put in place.

Domain 1: Detection 16%

This domain is 16% of the exam and covers how a security team learns about threats and changes in an AWS environment. It includes threat detection with GuardDuty, Macie and Security Hub, alerting with CloudWatch metrics, alarms and EventBridge rules, organization-wide CloudTrail and log archive design, Security Lake and OCSF, querying logs with Logs Insights, Athena and OpenSearch, network and DNS logs such as VPC Flow Logs and Route 53 Resolver query logs, and fixing gaps when logs or alerts stop arriving.

Domain 2: Incident Response 14%

This domain is 14% of the exam and covers preparing for security events before they happen. It includes incident response plans, runbooks and the AWS Security Incident Response service, testing response with tabletop exercises, GuardDuty sample findings and Fault Injection Service, automated remediation with EventBridge, Systems Manager Automation, Step Functions and Lambda, capturing forensic evidence without destroying it, containing and recovering from an event, and scoping what happened with Amazon Detective and logs.

An automated workflow that contains a compromised EC2 instance A GuardDuty finding about an EC2 instance matches an EventBridge rule, which starts a Step Functions workflow. The workflow detaches the instance from its Auto Scaling group, swaps in an isolation security group, snapshots its EBS volumes, and notifies responders through SNS. Amazon Detective is then used to scope what happened. GuardDuty EC2 finding EventBridge rule Step Functions workflow 1. Detach from Auto Scaling group 2. Swap to an isolation security group 3. Snapshot EBS volumes as evidence 4. Notify responders through SNS Amazon Detective scope what happened
An automated containment workflow. A GuardDuty finding matches an EventBridge rule, and Step Functions detaches the instance from its Auto Scaling group so it isn’t terminated and replaced, swaps in a security group with no rules, and snapshots its volumes before anyone touches it. The instance keeps running so memory can still be captured, and Detective helps scope the incident.

Domain 3: Infrastructure Security 18%

This domain is 18% of the exam and covers protecting the network edge and the workloads behind it. It includes AWS WAF rules, rate limiting and bot control, DDoS protection with Shield Advanced, securing CloudFront origins, hardened AMIs and container images from EC2 Image Builder, instance profiles and execution roles, vulnerability scanning and patching, secure administrative access, code and pipeline scanning, guardrails for generative AI applications, security groups and network ACLs, Network Firewall, secure hybrid connectivity and network segmentation.

Protecting a web application at the edge Users reach CloudFront, which has an AWS WAF web ACL attached and Shield Advanced protection. CloudFront forwards to a load balancer that accepts traffic only from CloudFront, which sends it to app servers in private subnets. Users Edge, Shield Advanced CloudFront TLS, caching AWS WAF web ACL rules, rate limits Load balancer CloudFront only accepts traffic only via a VPC origin or the CloudFront prefix list App servers private subnets
Defense at the edge. CloudFront terminates TLS and absorbs traffic across its edge locations, AWS WAF filters requests and rate-limits abusive clients, and Shield Advanced adds DDoS response support and cost protection. The origin must accept traffic only from CloudFront, through a CloudFront VPC origin or a security group that allows only the CloudFront managed prefix list, so attackers can’t go around the edge.

Domain 4: Identity and Access Management 20%

This domain is the largest at 20% of the exam and covers how people and workloads prove who they are and what they may do. It includes workforce identity and MFA with IAM Identity Center, customer sign-in with Amazon Cognito, temporary credentials from STS and S3 presigned URLs, workload identity outside AWS with IAM Roles Anywhere and OIDC federation, cross-account access, attribute-based and role-based access control, least-privilege policies with permissions boundaries and session policies, policy evaluation when access is denied, IAM Access Analyzer findings and fine-grained app authorization with Amazon Verified Permissions.

How AWS evaluates a request within one account, simplified A decision flow. If any policy has an explicit deny, the request is denied. Next, resource control policies and service control policies must allow it, or it is denied. If a resource-based policy allows it, it is allowed. Otherwise the identity-based policy, then any permissions boundary, then any session policy must each allow it, or it is denied. If all allow it, it is allowed. Request Deny Any explicit Deny? yes RCPs allow it? no SCPs allow it? no Resource policy allows? Identity policy allows? no Boundary allows? no Session policy allows? no yes Allow
How AWS decides a request within one account, simplified. An explicit Deny anywhere wins. RCPs and SCPs must allow the action, and then a resource-based policy that allows it is usually enough. Otherwise the identity policy must allow it, and a permissions boundary or session policy, if there is one, must allow it too. Cross-account requests need both accounts to allow them.

Domain 5: Data Protection 18%

This domain is 18% of the exam and covers protecting data while it moves, while it is stored and while it must stay recoverable. It includes requiring TLS, private access to services through VPC endpoints and PrivateLink, encryption between nodes and services, encryption at rest with KMS and CloudHSM, KMS key policies, grants and imported key material, data integrity with S3 Object Lock and Glacier Vault Lock, retention and lifecycle rules, secure backups that resist ransomware, secrets rotation with Secrets Manager, and masking sensitive data in logs and messages.

Envelope encryption with a KMS data key Step one: the application calls KMS GenerateDataKey and receives a data key in plaintext and encrypted form. Step two: it encrypts the data with the plaintext key, then deletes that key. Step three: it stores the encrypted data together with the encrypted data key. GenerateDataKey KMS returns a new data key, plaintext and encrypted Encrypt the data in the application with the plaintext key, then delete that key Store both the KMS key itself never leaves KMS Stored object Encrypted data Encrypted data key
Envelope encryption. A KMS key encrypts at most 4 KB directly, so services ask KMS for a data key, encrypt the data locally with the plaintext copy, then throw that copy away. The encrypted data key is stored next to the data. To read it, KMS decrypts the data key, which is checked against the key policy and logged in CloudTrail.

Domain 6: Security Foundations and Governance 14%

This domain is 14% of the exam and covers how security is set and enforced across the whole organization. It includes Organizations, Control Tower and delegated administrators, service control policies and resource control policies, root user protection and centralized root access, secure infrastructure as code with StackSets and CloudFormation Guard, tag policies, central policies with Firewall Manager, sharing resources securely with AWS RAM and Service Catalog, compliance rules and remediation with AWS Config and Security Hub CSPM, and audit evidence from AWS Artifact, Config, Security Hub CSPM and the Well-Architected Tool, plus what AWS Audit Manager does, although it is now closed to new customers.

A 6-week study plan

This plan assumes about an hour on weekdays and a longer, hands-on session at the weekend. Time follows the domain weights: identity (20%) gets the most attention, then infrastructure and data protection (18% each), detection (16%), and incident response and governance (14% each). If you already run security across several AWS accounts at work, four or five weeks may be enough. If governance or incident response is new to you, add a seventh week.

Week Focus Do this
1 Baseline and identity Take the free practice exam in timed mode and note your weak areas. Then workforce identity with IAM Identity Center and MFA, customer sign-in with Amazon Cognito, temporary credentials from STS and presigned URLs, and workload identity with IAM Roles Anywhere and OIDC.
2 Access control Cross-account trust policies and resource policies, least privilege with permissions boundaries and session policies, policy evaluation logic, IAM Access Analyzer findings, attribute-based access control with tags, and fine-grained app authorization with Amazon Verified Permissions.
3 Infrastructure edge and workloads AWS WAF rules and bot control, Shield Advanced and DDoS response, CloudFront origin access, hardened images from EC2 Image Builder, vulnerability scanning and patching with Inspector, secure admin access with Session Manager, code and pipeline scanning, and guardrails for generative AI applications.
4 Network controls and encryption Security groups against network ACLs, Network Firewall, DNS Firewall, hybrid connectivity with Site-to-Site VPN, Direct Connect and MACsec, and segmentation with Network Access Analyzer. Then TLS enforcement, VPC endpoints and endpoint policies, KMS key policies and grants, CloudHSM and imported key material.
5 Data protection and detection Object Lock and Vault Lock, AWS Backup with ransomware protection, Secrets Manager rotation and log masking. Then GuardDuty, Macie, Security Hub, organization trails, Security Lake, log queries with Logs Insights and Athena, VPC Flow Logs and Route 53 Resolver query logs, and fixing logs and alerts that stop arriving.
6 Incident response, governance and practice Incident response plans and the AWS Security Incident Response service, game days with Fault Injection Service, automated remediation, forensic capture, containment, and Amazon Detective. Then SCPs and RCPs, Control Tower, delegated administrators, StackSets and CloudFormation Guard, AWS Config and Security Hub CSPM. Finish with full timed practice exams and review every wrong answer.

How to use practice questions well

  • Time yourself. Do full 65-question sets in 170 minutes, because stamina matters on a long scenario exam.
  • Find the qualifier. Many wrong options work but cost more, need more effort to run or break one constraint.
  • Read the wrong options. They are usually real services solving a neighboring problem, or the right service set up the wrong way.
  • Don’t memorize questions. The real exam won’t reuse them, so learn the reasoning behind each answer.

Frequently asked questions

How hard is the SCS-C03 exam?

It is a specialty exam, so it goes deeper than the associate exams and assumes hands-on experience. Questions are long scenarios with four or five plausible answers. Many wrong options work but break one constraint, such as a qualifier like LEAST operational overhead or a rule about preserving evidence. Candidates who already secure AWS workloads usually find the services familiar and the wording the hard part.

How long should I study?

Most people who already work in cloud security study for about six weeks, with a few hours a week and one longer session at the weekend. If you are new to AWS security, plan for longer, and spend time in the console turning on each service so the names and settings stick.

Do I need any prerequisites?

No. AWS doesn’t require another certification first. The exam assumes working knowledge of IAM, VPC networking, KMS and CloudTrail, because those appear in almost every domain. If any of them are unfamiliar, learn them before you start the practice questions.

What changed from SCS-C02?

SCS-C03 replaced SCS-C02, and the last day for SCS-C02 was December 1, 2025. The exam guide for SCS-C03 sets the domains, their weights and the topics, and it now includes generative AI workloads, such as guardrails for generative AI applications. Security Hub is also described in two parts: Security Hub CSPM for standards and control checks, and the newer Security Hub for unified findings. A few services the exam guide names, such as AWS Audit Manager, CloudTrail Lake and SNS message data protection, closed to new customers in 2026. Know what they do, and know the current alternatives for a new design. Check every service name against the current exam guide.

Are ordering and matching questions on the exam?

Yes. The official exam guide lists ordering and matching alongside multiple choice and multiple response. Ordering questions give three to five responses and ask you to put them in the order the team should do them. Matching questions give three to seven prompts and ask you to match each one to a response. Practice both, because the order of incident response steps and the pairing of services with requirements are common topics.

Is the free practice exam the full length?

Yes. The free practice exam has 65 questions, the same as the real exam. Set aside 170 minutes and sit it in one go to get a realistic read on your pacing before you book.

Test yourself

The free SCS-C03 practice exam has 65 questions with an explanation for every option. No sign-up needed.

Take the free practice examReview questions untimed

Want to be sure you're ready? The 5 full-length practice sets add 325 new questions, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets