Exam Overview
The AWS Security Specialty (SCS-C03) is one of the most respected AWS certifications. It validates advanced expertise in AWS security — not just knowing what security services exist, but understanding how to design, implement, and troubleshoot security controls across complex AWS environments.
Unlike associate-level exams that test general AWS knowledge, the Security Specialty goes extremely deep into a specific domain. Questions involve real security scenarios: detecting a compromised EC2 instance, designing IAM policies that satisfy least-privilege across multiple accounts, or architecting encryption strategies that meet compliance requirements.
Here are the exam specifics.
| Detail | Value |
|---|---|
| Exam code | SCS-C03 |
| Questions | 65 |
| Time limit | 170 minutes |
| Passing score | 750/1000 (75%) |
| Cost | $300 USD |
| Recommended experience | 5+ years IT security, 2+ years AWS security |
| Validity | 3 years |
| Delivery | Pearson VUE (test center or online) |
Is the Security Specialty Hard?
Yes — it is one of the harder AWS certifications. The Security Specialty requires significantly more depth than associate-level exams and a higher passing threshold (75% vs. 72%).
The difficulty comes from several factors. IAM policy evaluation is a major topic, and the edge cases are genuinely complex. You need to understand how SCPs, permission boundaries, resource-based policies, session policies, and identity-based policies interact when all five are in play simultaneously.
Security incident scenarios require you to diagnose what happened and prescribe a remediation — not just know that GuardDuty exists, but understand exactly what finding type it would generate for a specific attack pattern, and what the appropriate response is.
Encryption is tested deeply. Not just "enable encryption at rest" but understanding KMS key policies, envelope encryption, how different services integrate with KMS, cross-account key usage, and which encryption option to use for specific compliance requirements.
That said, for security professionals with genuine hands-on experience designing and operating AWS security controls, the exam is manageable with 2-3 months of focused preparation. The difficulty is aligned with the domain expertise, not the exam format.
The Five Exam Domains
SCS-C03 is organized into five domains.
| Domain | Name | Weight |
|---|---|---|
| 1 | Threat Detection and Incident Response | 14% |
| 2 | Security Logging and Monitoring | 18% |
| 3 | Infrastructure Security | 20% |
| 4 | Identity and Access Management | 16% |
| 5 | Data Protection | 18% |
| - | Management and Security Governance | 14% |
Domain 1: Threat Detection and Incident Response (14%)
This domain tests your ability to detect, respond to, and recover from security incidents on AWS.
AWS GuardDuty is the centerpiece. You need to know the specific finding types GuardDuty generates and what each one means: UnauthorizedAccess (credentials used from unusual location), CryptoCurrency (EC2 communicating with mining pools), Trojan (EC2 communicating with known malicious IPs), and many others. Know how to enable GuardDuty across an organization with AWS Organizations, and how to aggregate findings to a central security account.
AWS Security Hub aggregates findings from GuardDuty, Inspector, Macie, Config, Firewall Manager, and third-party tools into a single view. Know how to enable it organization-wide, how compliance standards work (AWS Foundational Security Standard, CIS Benchmark, PCI DSS), and how to use Security Hub findings to prioritize remediation.
Incident response procedures: Know the AWS incident response workflow — detection (GuardDuty, CloudTrail anomalies), containment (isolate the instance: modify security group to deny all traffic, revoke IAM credentials, snapshot EBS volumes for forensics), investigation (forensic analysis from the snapshot, CloudTrail review), and recovery.
AWS Systems Manager Incident Manager automates incident response runbooks. EventBridge can trigger automated responses to security findings — for example, automatically isolating an EC2 instance when GuardDuty detects an active attack.
Domain 2: Security Logging and Monitoring (18%)
Comprehensive logging and monitoring is fundamental to security — you cannot detect or investigate incidents without the right logs.
AWS CloudTrail is the most important logging service for this exam. You need to know: the difference between management events (API calls that change AWS resources) and data events (S3 object-level operations, Lambda invocations — not logged by default), how to enable CloudTrail across an organization, how to prevent log tampering (log file validation, S3 bucket policies, S3 Object Lock), and how to stream CloudTrail events to CloudWatch Logs for real-time alerting.
Amazon CloudWatch covers monitoring EC2 metrics (CPUUtilization, NetworkIn/Out, disk I/O), creating CloudWatch Alarms for threshold breaches, CloudWatch Logs for log aggregation and analysis, CloudWatch Logs Insights for querying logs with a SQL-like syntax, and CloudWatch Dashboards for operational visibility.
AWS Config records the configuration state of AWS resources over time. It answers "what was the configuration of this security group on this date?" Config Rules check whether resources comply with security policies — you can use managed rules (like checking that all S3 buckets are not publicly accessible) or custom rules written in Lambda.
Amazon Macie uses machine learning to discover and protect sensitive data in S3. It automatically identifies buckets containing PII, financial data, credentials, and other sensitive content and generates findings when it detects risk. Know how to enable Macie across an organization and how its findings integrate with Security Hub.
VPC Flow Logs capture IP traffic going to and from network interfaces in your VPC. They are essential for network security monitoring, traffic analysis, and forensic investigation. Know how to enable them (stored in CloudWatch Logs or S3), what information they capture, and what they do not capture (application-layer content, DHCP traffic, DNS traffic to the VPC DNS server).
Domain 3: Infrastructure Security (20%)
The largest domain. It covers designing and implementing secure network architectures and protecting compute resources.
VPC security design: Security groups vs. NACLs in depth. Security groups are stateful (return traffic automatically allowed), instance-level, and support allow rules only. NACLs are stateless (you need explicit inbound and outbound rules), subnet-level, support both allow and deny rules, and are evaluated in rule number order. Know when to use each and how they interact.
VPC endpoints eliminate the need to send traffic to AWS services over the public internet. Gateway endpoints (for S3 and DynamoDB) modify route tables. Interface endpoints (for all other AWS services) create private IP addresses in your VPC. VPC endpoint policies control which resources, accounts, and actions are permitted through the endpoint.
AWS WAF protects web applications from common exploits (SQL injection, XSS, bot traffic). Know the components: Web ACLs, rule groups, managed rules (AWS managed rule groups and AWS Marketplace rules), and custom rules. WAF can be applied to CloudFront, ALB, API Gateway, and AppSync.
AWS Shield provides DDoS protection. Shield Standard (free, automatic) protects against common layer 3/4 attacks. Shield Advanced ($3,000/month) adds sophisticated DDoS mitigation, attack diagnostics, 24/7 DRT (DDoS Response Team) access, and cost protection against DDoS-related scaling charges.
EC2 security: Understand instance metadata service (IMDSv2 vs. IMDSv1 and why IMDSv2 mitigates SSRF attacks), Systems Manager Session Manager for shell access without SSH keys or open port 22, and EC2 Image Builder for creating and maintaining secure AMIs.
AWS Network Firewall is a managed firewall service that provides stateful and stateless packet filtering, application-layer inspection, and intrusion prevention. It sits in a dedicated firewall VPC and traffic is routed through it using Transit Gateway or VPC routing.
Domain 4: Identity and Access Management (16%)
IAM is deeply tested on this exam — more deeply than on any associate exam.
IAM policy evaluation logic: The exam tests complex multi-policy scenarios. The evaluation order is: explicit Deny always wins, then Organizations SCPs, then resource-based policies, then permission boundaries, then identity-based policies, then session policies. Understanding how each layer can restrict or allow access is essential.
AWS Organizations and SCPs: Service control policies set maximum permissions for accounts in an organization — they do not grant permissions, they restrict what can be granted. Know how to use SCPs to enforce security baselines across all accounts (for example, preventing anyone from disabling CloudTrail or creating public S3 buckets).
AWS IAM Identity Center (formerly SSO): Centralizes identity management across AWS accounts. Integrates with external identity providers (Azure AD, Okta) via SAML 2.0. Permission sets define what users can do in which accounts. This is the recommended approach for human access in multi-account environments.
IAM Roles Anywhere extends IAM roles to workloads outside AWS — on-premises servers, containers not running on AWS, CI/CD systems. Uses X.509 certificates for authentication. This eliminates the need for long-lived access keys for external systems.
Attribute-based access control (ABAC): A scaling approach to IAM permissions that uses tags to control access. Instead of creating a separate policy for every team or environment, you create policies that allow actions based on matching tags. Efficient for large organizations with many teams and resources.
Domain 5: Data Protection (18%)
Encryption is the central topic of this domain, tested at a depth well beyond the associate level.
AWS KMS: The exam goes deep into KMS key policy design, the difference between AWS-managed keys, customer-managed keys (CMK), and customer-provided keys, envelope encryption (how KMS protects data keys that in turn encrypt your data), and cross-account key usage. Know the key policy elements — key administrators, key users, and the grant mechanism for delegating KMS permissions.
Amazon S3 encryption options: SSE-S3 (AWS managed keys, simplest), SSE-KMS (customer-managed keys, most control, CloudTrail logs key usage), SSE-C (customer-provided keys, AWS never stores the key), and client-side encryption. Know when each is appropriate and what the compliance implications are.
SSL/TLS and certificate management: AWS Certificate Manager (ACM) provisions and manages SSL/TLS certificates for CloudFront, ALB, and API Gateway. Know the difference between ACM public certificates (for public-facing endpoints, validated by DNS or email) and ACM private CA (for internal services, requires your own CA hierarchy).
Amazon Macie for data discovery and protection: know how to configure Macie findings, sensitive data discovery jobs, and how to respond to a Macie finding that reveals exposed PII.
Secrets Manager vs. Parameter Store: Secrets Manager supports automatic secret rotation using Lambda functions, is designed specifically for secrets (database passwords, API keys), and integrates natively with RDS, Redshift, and DocumentDB. Parameter Store is simpler and cheaper, supports plain text and SecureString parameters, but does not rotate automatically.
Realistic Study Plan for SCS-C03
The Security Specialty requires 8-12 weeks of focused study for a well-prepared candidate with associate-level AWS experience. Plan for longer if you are new to security operations or AWS security services.
Weeks 1-2: Build the IAM foundation. IAM policy evaluation, Organizations and SCPs, Identity Center, permission boundaries, and cross-account access patterns. This is the most complex topic on the exam and deserves the most time.
Weeks 3-4: Study VPC security architecture. Security groups, NACLs, VPC endpoints (all types), Network Firewall, WAF, and Shield. Draw every VPC security scenario until the routing and policy logic is intuitive.
Weeks 5-6: Study detection and logging. GuardDuty (all finding types), Security Hub, CloudTrail (management vs. data events, log file validation), Config and Config Rules, Macie, VPC Flow Logs, and CloudWatch alarms.
Weeks 7-8: Study encryption and data protection. KMS key policies, envelope encryption, all S3 encryption options, ACM, Secrets Manager, and the Macie sensitive data discovery workflow.
Weeks 9-12: Full practice exams with targeted review. Take a practice exam, review every wrong answer, and return to study materials for gaps. Aim for three complete exams with 80%+ scores before booking the real exam.
You are ready when you can answer questions about multi-account security architectures, complex IAM policy scenarios, incident response workflows, and encryption design decisions quickly and confidently.