Study guide · Exam overview
The format, passing score, and six content domains of the AWS Certified Security – Specialty exam, plus the detection, identity, and encryption choices worth practicing before you book SCS-C03.
Exam version notice: This overview follows the AWS Certified Security – Specialty Exam Guide (SCS-C03), version 1.0, published March 26, 2026, and the AWS certification page, reviewed in October 2026. SCS-C03 replaced SCS-C02 on December 2, 2025. Domain weights are 16%, 14%, 18%, 20%, 18%, and 14%. Simplified Chinese, Spanish (Latin America), and Portuguese (Brazil) versions of this exam retire after December 31, 2026. Pricing, languages, and delivery options can change. Confirm them on the AWS certification site before you register. Items tagged Extra are useful context the guide places out of scope. Account-wide architecture that is not a security control sits on the Solutions Architect Professional overview.
SCS-C03 checks whether you can secure AWS workloads. The exam guide describes the target candidate as someone with the equivalent of 3–5 years securing cloud solutions. The AWS certification page describes five years of IT security experience and two or more years of hands-on work securing AWS workloads. The work is to see the threat, respond to the event, protect the edge and the compute, control the network, authenticate and authorize at least privilege, protect data in transit and at rest, and govern many accounts from one place.
A question usually gives a constraint: a finding that must page the right team, an instance that must be contained without destroying evidence, an HTTP flood that is not a port scan, a member account that must not create a public bucket, a key you must be able to delete, or a log that must not show a card number. Two options often both exist as real services. The better answer is the one that meets the constraint with the control the stem named.
The target candidate is not expected to design cryptographic algorithms, analyze traffic at the packet level, architect an entire cloud deployment, manage end-user computers, or train machine learning models. Overall architecture belongs on the Solutions Architect path and the Professional path. Pipeline design belongs on the DevOps path.
Figures below come from the AWS certification page and the SCS-C03 exam guide, version 1.0, reviewed in October 2026.
| Specification | SCS-C03 |
|---|---|
| Level | Specialty. There is no required prerequisite certification. Candidates commonly earn Solutions Architect – Associate or Professional first. |
| Number of questions | 65. Fifty affect your score. Fifteen are unscored and are not identified on the exam. |
| Question types | Multiple choice (one correct answer and three distractors), multiple response (two or more correct answers out of five or more options), ordering (3–5 steps, all in the correct order), and matching (3–7 pairs, all matched). |
| Length of test | 170 minutes. AWS offers an additional 30 minutes for eligible non-native English speakers who request the ESL accommodation before they register. |
| Passing score | 750 on a scaled range of 100–1,000. Scoring is compensatory: you pass the exam as a whole, not each domain. |
| Recommended experience | The exam guide says 3–5 years securing cloud solutions. The certification page says five years of IT security experience and two or more years securing AWS workloads. |
| Exam price | Specialty exams are listed at 300 USD. Taxes and local-currency prices can differ. Confirm the current fee before you book. |
| Delivery | Pearson VUE, at a test center or with online proctoring. Languages listed by AWS include English, Japanese, Korean, Portuguese (Brazil), Simplified Chinese, and Spanish (Latin America). AWS says the last three retire after December 31, 2026. |
| Validity | Three years. Recertify by passing the latest version of this exam. Confirm the policy with AWS. |
Unanswered questions are scored as incorrect. There is no penalty for guessing, so answer every question. A scaled score of 750 is not the same thing as 75 percent of the questions. Ordering and matching award credit only when the whole task is correct. The exam uses official short names, and the in-exam Help lists the matching full service names.
These percentages are the share of scored content in the SCS-C03 exam guide. The 200 practice questions on this site follow the same weights.
See the anomaly, keep the log, and notice when the alert never arrives.
Plan the response, keep the evidence, contain the resource, then find the cause.
Pick the layer that matches the threat, then harden the workload behind it.
The largest domain. Prove who it is, then allow only what the task needs.
Encrypt the path, encrypt the object, and keep the key and the secret where they belong.
One organization, the same baseline in every account, and evidence when an auditor asks.
Learn the in-scope services from the SCS-C03 exam guide. The same map is in the core notes and flashcards.
| Security need | Prefer | Remember |
|---|---|---|
| A threat such as an unusual API call | Amazon GuardDuty | Amazon Inspector finds a vulnerable package. Amazon Macie finds sensitive data in S3. They are not the same finding. |
| One inbox for findings | AWS Security Hub | Amazon Security Lake stores normalized logs. A dashboard is not a finding standard. |
| API history the member cannot stop | An organization CloudTrail trail | A trail the member account owns can be stopped by that account. |
| Evidence before you terminate | Logs and a snapshot, then containment | Deleting the instance first destroys what the investigation needed. |
| An HTTP request pattern | AWS WAF | AWS Shield is DDoS protection. AWS Network Firewall sits on the VPC path, not on the HTTP rule. |
| A shell with no inbound SSH | Systems Manager Session Manager | EC2 Instance Connect still uses SSH. An open port 22 is the opposite of the requirement. |
| A ceiling on a member account | A service control policy | An SCP does not grant permission. A permissions boundary limits one principal, not the whole account. |
| A person who needs AWS access | IAM Identity Center | Amazon Cognito is for your application's users. A long-term IAM user key is a poor workforce pattern. |
| A key you can audit and rotate | AWS KMS | AWS CloudHSM is the dedicated HSM you operate. Imported key material is not the same as a key AWS generated. |
| A secret that must rotate | AWS Secrets Manager | An AMI and a public object freeze or expose the value. |
| The same stack in many accounts | CloudFormation StackSets | AWS Config reports drift after the resource exists. An SCP can deny the API before it exists. |
| Audit evidence and AWS reports | AWS Audit Manager and AWS Artifact | Audit Manager collects your evidence. Artifact is where you download AWS compliance reports. |
| Extra Packet captures and cipher design | Leave both outside this exam | The guide lists packet-level analysis and designing cryptographic algorithms as out of scope. |
| Extra Payment Cryptography and MWAA | Do not pick them as the security control | The exam guide lists AWS Payment Cryptography and Amazon MWAA as out of scope. |
| Extra Training a model | Leave model training off the study list | Guardrails for a generative AI application are in scope. Training the model is not. |
Multiple choice has one correct response and three distractors. Multiple response has two or more correct responses out of five or more options. The stem tells you how many to choose. Select every response that completes the statement, and nothing extra. Ordering asks you to place 3–5 steps in the correct order. Matching asks you to pair every prompt. The exam guide says you receive credit for those tasks only when the whole order or every pair is correct.
Distractors are real services that solve a nearby problem. If the need is “find a vulnerable package,” GuardDuty is the nearby wrong answer because it looks for threats, not CVEs. If the need is “stop a member account from leaving the organization,” an IAM policy in that account is the nearby wrong answer because the account can change its own policy. If the need is “encrypt a Direct Connect link,” the circuit alone is the nearby wrong answer because Direct Connect is not encrypted until you add MACsec or a VPN.
Words such as MOST, BEST, and LEAST are the constraint. MOST cost-effective still has to meet the security requirement in the stem. LEAST operational overhead usually means a managed service. There is no published penalty for a wrong guess. A blank answer is incorrect.
A practical sequence once you can already name GuardDuty, an IAM role, and a KMS key.
Say whether you need a threat, a vulnerable package, sensitive data, or a log you can query. The service follows that sentence.
Keep the log and the snapshot. Isolate the resource and revoke the credential. Disable an exposed key before you read what it did.
WAF for HTTP. Shield for DDoS. A security group for the instance. Network Firewall for the VPC path. Session Manager when SSH must stay closed.
IAM allows. A permissions boundary, a session policy, and an SCP only limit. Access Analyzer reads the resource policy you already published.
KMS for a managed key, CloudHSM when you must run the HSM, imported material when you must supply it, and Secrets Manager when the password must rotate.
Use the six flashcard decks, then the original questions at about two and a half minutes each. Review every explanation and return to domains below 75 percent. Aim for a steady 85 percent before you book.
The overview, core notes, flashcards, and practice exams are all published.
Exam format, the 750 passing score, domain weights, and a study plan.
Reference notes for detection, response, infrastructure, identity, data protection, and governance.
50 recall cards in six decks, plus memory notes for findings, containment, ceilings, and keys.
200 original questions with custom exams, explanations, and a score report by domain.
The current exam is SCS-C03, AWS Certified Security – Specialty. It replaced SCS-C02 on December 2, 2025. The exam guide in use here is version 1.0, published March 26, 2026. Confirm the code on the AWS certification page before you book.
Results use a scaled score from 100 to 1,000. The minimum passing score is 750. You do not need a passing score in every domain. A scaled score is not the percentage of questions you answered correctly.
The exam has 65 questions and a 170-minute time limit. Fifty questions affect your score. Fifteen are unscored and are not labeled. The exam guide lists multiple choice, multiple response, ordering, and matching.
There is no required prerequisite certification. The exam guide describes 3–5 years securing cloud solutions. The AWS certification page describes five years of IT security experience and two or more years securing AWS workloads. Candidates often earn Solutions Architect – Associate or Professional first.
SCS-C02 ended on December 1, 2025. SCS-C03 is the exam you take now. A credential you already earned stays valid until its own expiration date. Recertify by passing the latest version of this exam.
This certification is valid for three years. Recertify by passing the latest version of this exam. Confirm the current policy with AWS before your expiration date.
No. The practice questions on this site are original. They are not AWS exam items, and a practice score does not predict a result.
Service names and prices change. Use the current AWS exam guide and the AWS certification site as the authority when they differ from these notes.
Useful companions while you study.
Generate strong random passwords with custom length, characters, symbols, and security options.
Encode text and files to Base64 or decode Base64 data with UTF-8 support.
Convert structured data between JSON and YAML with formatting and validation.
Compare two text blocks and highlight added, removed, and changed content.
Exam versions, objectives, prices, languages, and retirement dates can change. Verify the details on the AWS certification page before you register.
Certicab provides general informational, educational, and convenience resources. Calculations, conversions, estimates, and learning materials may contain errors or become outdated. Financial, tax, medical, legal, and travel information is not professional advice. Verify important results and current requirements with qualified professionals or authoritative sources. Protect sensitive files and personal information, review each tool’s privacy limitations, and use only content you are authorized to process. You are responsible for how you use and share results. Study resources are independent and do not guarantee exam success or imply certification-provider endorsement. Amazon Web Services, AWS, and related marks are trademarks of Amazon.com, Inc. or its affiliates. Certicab is not affiliated with, endorsed by, or sponsored by Amazon.
Certi