Prepare for AWS Certified Security - Specialty using the SCS-C03 tasks and current service documentation. Cover all six domains, practice explaining security decisions, and check which policies apply in an access scenario. This guide includes an original IAM example and a preparation checklist.
Which exam version should you study?
SCS-C03 replaced SCS-C02 on December 2, 2025. Match your preparation to the SCS-C03 task list.
The current domains include Detection, Incident Response, and Security Foundations and Governance. Older material organized around the SCS-C02 domain names needs to be mapped to the new outline, though individual supported explanations may still be useful.
The current guide includes tasks involving generative AI application controls, sensitive data masking, encryption, key material, and multi-Region key and certificate management. Check the detailed skills before deciding which lessons need updating.
What experience is recommended?
The current SCS-C03 guide targets candidates with the equivalent of three to five years of experience securing cloud solutions.
Its recommended background includes identity management, multi-account governance, incident response, vulnerability management, network security controls, encryption, and disaster recovery controls.
This is preparation guidance. AWS does not require a prior certification or an AWS training course. Compare your experience with the current tasks to decide what to practice before booking.
Sources used: AWS Certified Security - Specialty (AWS certification page) — Exam overview and FAQ sections; AWS Certified Security - Specialty Exam Guide (SCS-C03) — Exam content, content outline, and SCS-C02/SCS-C03 comparison appendix; AWS Certification FAQs — Schedule your exam and Exam scoring and content sections
What to expect on the exam
You have 170 minutes for 65 questions: 50 scored and 15 unscored questions that are not identified.
The certification page summarizes the format as multiple choice and multiple response. The detailed SCS-C03 exam guide also lists ordering and matching questions, so include those formats in your preparation.
For ordering questions, select the correct responses and place them in the correct order from a list of 3–5 responses. For matching questions, correctly pair all 3–7 prompts with responses. The guide requires the complete correct order or all correct pairs for credit.
The passing score is 750 on a scale of 100–1,000. It is a scaled score, not a raw requirement to answer 75% correctly. You pass on the overall result, without a separate passing requirement in every domain. Unanswered questions count as incorrect, and there is no penalty for guessing.
Most AWS exams do not show a pass or fail result immediately. Check your AWS Certification Account for detailed results within five business days.
Sources used: AWS Certified Security - Specialty (AWS certification page) — Exam overview and FAQ sections; AWS Certified Security - Specialty Exam Guide (SCS-C03) — Exam content, content outline, and SCS-C02/SCS-C03 comparison appendix; AWS Certification FAQs — Schedule your exam and Exam scoring and content sections
What to study in each domain
Use the six domains and your knowledge gaps together to plan your study time. A higher weight does not mean every candidate should study that domain first.
The percentages describe scored content, not guaranteed question counts. Use the detailed tasks and skills as your coverage map. The activities below are suggested ways to practice those topics.
The guide’s scope lists are not exhaustive. It distinguishes security aspects of services from broader service administration and excludes specified tasks such as training machine learning models, designing cryptographic algorithms, and packet-level traffic analysis.
| Domain | Weight | Topics and suggested practice |
|---|---|---|
| Detection | 16% | Monitoring, logging, and alerting. Review sample findings and logs and identify what additional information would support an investigation. |
| Incident Response | 14% | Response plans, forensic artifacts, scope, containment, recovery, and root cause analysis. Work through a paper incident and separate observed facts from assumptions. |
| Infrastructure Security | 18% | Edge, compute, and network security controls. Review a sample workload and identify which security requirements each proposed control addresses. |
| Identity and Access Management | 20% | Authentication and authorization design, evaluation, and troubleshooting. Trace a request through the policies actually specified in a scenario. |
| Data Protection | 18% | Encryption, secrets, key material, and sensitive data. Identify the protection requirements and key-management questions in a sample design. |
| Security Foundations and Governance | 14% | Multi-account governance, secure deployments, and compliance. Review a proposed control and identify its intended scope and the evidence needed to assess it. |
Practice: an identity allow and a bucket-policy deny
An applicable explicit deny overrides an allow. Check the request and policy scope before applying that rule to a scenario.
An identity-based policy is attached to an identity such as an IAM user. A resource-based policy is attached to a resource, such as an S3 bucket. AWS documents that an explicit deny in either policy overrides an allow for the same-account case used here.
Other policy types and request contexts need their own evaluation. Do not turn this example into a complete rule for all permissions boundaries, cross-account access, or encryption-key permissions.
Practice exercise
An IAM user has an identity policy allowing s3:GetObject on a fictional report object. The bucket belongs to the same account. Its bucket policy explicitly denies s3:GetObject on that object for every principal, including this user, and the deny’s conditions apply. There are no permissions-boundary, organization-policy, or encryption-key complications in this example. Is the request allowed? Would adding another identity allow override the denial? Which policy statement should you inspect when explaining the result?
Show answer
The request is denied. Another identity allow would not override the applicable deny. Inspect the matching deny statement in the bucket policy.
The identity policy allows the action, but the resource-based bucket policy explicitly denies the same request. AWS’s policy evaluation rule gives that deny precedence over the allow. This establishes why the request fails; it does not establish that the deny is a mistake. Determine the intended access and applicable requirements before considering a policy change.
Your preparation checklist
Use this suggested sequence to find and address gaps across the six domains.
AWS’s published preparation plan includes exam-style questions, learning and practice, and the Official Pretest as a readiness assessment. Adapt it to your starting point rather than assuming a particular course or sequence is an entry requirement.
- Review the SCS-C03 task list and map any older course material to it.
- Identify tasks you can explain, tasks you have practiced, and gaps needing further work.
- Use official practice questions to learn the formats, including the ordering and matching types in the detailed guide.
- Choose labs or paper scenarios for your gaps. Record the assumptions, expected result, and explanation.
- Revisit the IAM exercise and explain which deny applies and why another allow does not override it.
- Use the Official Pretest to identify remaining weaknesses, then review appointment instructions and language availability.
Sources used: AWS Certified Security - Specialty (AWS certification page) — Exam overview and FAQ sections; AWS Certified Security - Specialty Exam Guide (SCS-C03) — Exam content, content outline, and SCS-C02/SCS-C03 comparison appendix; Policy evaluation logic - AWS Identity and Access Management User Guide — Evaluating identity-based policies with resource-based policies, permissions boundaries, and SCPs/RCPs; AWS Certification FAQs — Schedule your exam and Exam scoring and content sections
Booking, fees, and languages
The listed fee is USD 300, with taxes and local-currency pricing where applicable. Pearson VUE offers test-center and online-proctored appointments.
AWS lists English, Japanese, Korean, Brazilian Portuguese, Simplified Chinese, and Latin American Spanish. The Portuguese, Simplified Chinese, and Spanish versions will retire after December 31, 2026. That announcement does not retire the English, Japanese, or Korean versions.
Confirm the code, language, and testing date on your booking. The standard policy permits cancellation or rescheduling up to 24 hours before the appointment. Read the full policy for exceptions relevant to your circumstances.
Sources used: AWS Certified Security - Specialty (AWS certification page) — Exam overview and FAQ sections; AWS Certification FAQs — Schedule your exam and Exam scoring and content sections
Keeping your certification current
AWS Certified Security - Specialty is valid for three years.
AWS lists recertification by passing the latest version of the exam before your credential expires. Check the current version and renewal requirements as that date approaches.
Sources used: AWS Certified Security - Specialty (AWS certification page) — Exam overview and FAQ sections
Sources used
Facts checked against official AWS sources: