AWS Certified Security – Specialty (SCS-C03) is AWS's advanced security certification. It covers detection, incident response, infrastructure security, identity and access management, data protection, and multi-account governance. SCS-C03 replaced SCS-C02 on 2 December 2025. It adds protections for generative AI applications (the OWASP Top 10 for LLM applications), the OCSF log format, in-transit encryption between nodes, and new question types: ordering and matching.
This guide follows AWS's official exam guide: all six domains with weights, what changed from SCS-C02, an 8-week plan and 15 original scenario questions.
Quick facts (AWS, November 2026)
| Item | Detail |
|---|---|
| Exam code | SCS-C03 |
| Time | 170 minutes |
| Questions | 65 (50 scored, 15 unscored) |
| Question types | Multiple choice, multiple response, ordering, matching |
| Passing score | 750 on a 100–1,000 scale |
| Fee | USD 300 (plus applicable taxes and exchange charges) |
| Languages | English, Japanese, Korean, Portuguese (Brazil), Simplified Chinese, Spanish (Latin America); the last three retire after 31 December 2026 |
| Valid for | 3 years |
| Recommended experience | The certification page asks for 5 years of IT security experience and 2+ years securing AWS workloads; the exam guide describes 3–5 years securing cloud solutions |
Check the official Security Specialty page and SCS-C03 exam guide before booking.
Who should take SCS-C03?
- Cloud security engineers and SOC engineers working on AWS.
- DevOps and platform engineers who own IAM, KMS and guardrails across accounts.
- Architects who already hold Solutions Architect Associate and want to specialise in security.
AWS lists designing cryptographic algorithms, packet-level traffic analysis, overall cloud architecture, end-user computing and ML training as out of scope.
Domains and weights
| Domain | Weight |
|---|---|
| 1. Detection | 16% |
| 2. Incident Response | 14% |
| 3. Infrastructure Security | 18% |
| 4. Identity and Access Management | 20% |
| 5. Data Protection | 18% |
| 6. Security Foundations and Governance | 14% |
SCS-C02 vs SCS-C03: what changed?
- Restructured: "Threat Detection and Incident Response" and "Security Logging and Monitoring" became Domain 1 (Detection) and Domain 2 (Incident Response). Domain 6 was renamed Security Foundations and Governance. IAM went from 16% to 20%.
- Added: validating findings to judge an event's scope and impact; ingesting OCSF data and third-party WAF rules; guardrails for generative AI apps (OWASP Top 10 for LLM applications); inter-node encryption for EMR, EKS and SageMaker AI and Nitro encryption; imported vs AWS-generated key material; masking sensitive data in CloudWatch Logs and SNS; multi-Region KMS keys and AWS Private CA.
- Removed: ASFF, the AWS Security Incident Response Guide, host-based firewalls and hardening, basic TCP/IP and OSI concepts, Reachability Analyzer, TLS basics, private and public VIF design, policy-element basics and S3 static website hosting.
Domain 1: Detection (16%)
- Design monitoring and alerting for an account or organisation: GuardDuty, Security Hub, Config, Inspector, Macie, CloudWatch and EventBridge.
- Design and implement logging: CloudTrail (organisation trails), VPC Flow Logs, DNS query logs, WAF and load balancer logs, CloudWatch Logs, and centralised log accounts.
- Troubleshoot monitoring, logging and alerting, for example missing CloudTrail events or a broken log delivery permission.
Domain 2: Incident Response (14%)
- Design and test an incident response plan: runbooks, isolation steps, forensics accounts and game days.
- Respond to security events: validate findings, contain (isolate instances, revoke sessions, rotate keys), collect evidence (snapshots, memory), investigate with Detective and Athena, and recover.
# Contain a compromised EC2 instance: swap to an isolation security group and snapshot its volume
aws ec2 modify-instance-attribute --instance-id i-0abc123 --groups sg-isolation
aws ec2 create-snapshot --volume-id vol-0def456 --description "IR-2026-11-13 evidence"Domain 3: Infrastructure Security (18%)
- Network edge: CloudFront, AWS WAF (managed and third-party rules), Shield Advanced, OCSF integrations.
- Compute workloads: Inspector scanning, Systems Manager patching, IMDSv2, container and Lambda security, and guardrails for generative AI apps such as Bedrock Guardrails, input validation and least-privilege tool access.
- Network controls: security groups, NACLs, Network Firewall, Route 53 Resolver DNS Firewall, VPC endpoints and endpoint policies, PrivateLink.
Domain 4: Identity and Access Management (20%)
- Authentication: IAM Identity Center and federation (SAML, OIDC), MFA, temporary credentials with STS, Cognito for applications, IAM Roles Anywhere.
- Authorisation: identity- and resource-based policies, permissions boundaries, SCPs and resource control policies, ABAC with tags, session policies, IAM Access Analyzer and troubleshooting "access denied".
{
"Effect": "Deny",
"Action": "s3:*",
"Resource": ["arn:aws:s3:::payroll-data", "arn:aws:s3:::payroll-data/*"],
"Condition": { "Bool": { "aws:SecureTransport": "false" } }
}That bucket-policy statement denies any request not made over TLS, a classic exam pattern.
Domain 5: Data Protection (18%)
- Data in transit: ACM and AWS Private CA, TLS enforcement, inter-node encryption for EMR, EKS and SageMaker AI, VPN and MACsec.
- Data at rest: KMS customer managed keys, key policies and grants, S3 Object Lock, encryption by default for EBS and S3, backup encryption.
- Confidential data and keys: Secrets Manager rotation, imported vs AWS-generated key material, CloudHSM, multi-Region keys, masking in CloudWatch Logs and SNS.
Domain 6: Security Foundations and Governance (14%)
- Centrally deploy and manage accounts: Organizations, Control Tower, delegated administrators for security services.
- Secure, consistent deployments: CloudFormation and StackSets, Service Catalog, Firewall Manager, tagging.
- Evaluate compliance: Config rules and conformance packs, Security Hub standards, Audit Manager, Artifact.
8-week study plan
| Week | Focus | Lab |
|---|---|---|
| 1 | IAM deep dive: policy evaluation, boundaries, SCPs, ABAC, Access Analyzer | Debug three "access denied" cases with the policy simulator |
| 2 | Identity Center, federation, STS, Cognito | Federate a test identity provider to Identity Center |
| 3 | CloudTrail organisation trail, Flow Logs, central log account, Athena | Query CloudTrail in Athena for console logins without MFA |
| 4 | GuardDuty, Security Hub, Detective, Inspector, Macie | EventBridge rule that isolates an instance on a GuardDuty finding |
| 5 | WAF, Shield, Network Firewall, DNS Firewall, endpoint policies | WAF rate-based rule plus managed rule groups on CloudFront |
| 6 | KMS (key policies, grants, multi-Region keys, imported material), CloudHSM, ACM, Private CA | Cross-account encrypted S3 access with a customer managed key |
| 7 | Incident response runbooks, forensics, GenAI guardrails, Organizations and Control Tower | Practise a full incident drill; Bedrock Guardrails on a test app |
| 8 | Official practice questions, revision | Review every wrong answer; book the exam |
15 scenario questions with answers
These are original scenarios written for this guide, not exam questions.
1. GuardDuty reports an EC2 instance talking to a known crypto-mining domain. What do you do first?
Contain it: move it to an isolation security group (or remove it from the load balancer), snapshot volumes for evidence, then investigate.
2. An access key was pushed to a public GitHub repository. What are your first steps?
Deactivate and delete the key, check CloudTrail for its use, revoke any sessions it created, and remove the resources it launched.
3. API activity from all 40 accounts must land in one tamper-resistant place. How?
An organisation CloudTrail trail delivering to a log archive account's S3 bucket with Object Lock and restricted access.
4. Developers can create IAM roles but must never exceed a set of permissions. What do you use?
Permissions boundaries, required through policy conditions.
5. No one in the organisation may disable GuardDuty. How do you enforce it?
An SCP that denies GuardDuty disable and delete actions, with GuardDuty managed by a delegated administrator.
6. Access should depend on matching project tags on users and resources. What model is this?
Attribute-based access control (ABAC).
7. Regulators require that you control key material generated outside AWS. What do you use?
KMS keys with imported key material (or CloudHSM / an external key store where required).
8. Encrypted data must be decryptable in Mumbai and Singapore during a failover. What helps?
KMS multi-Region keys.
9. A web app suffers credential-stuffing attacks on its login page. What do you add?
AWS WAF with rate-based rules and managed rule groups (including account takeover prevention).
10. Instances must not be able to resolve known malicious domains. What do you configure?
Route 53 Resolver DNS Firewall.
11. Instances in a private subnet may only reach one specific S3 bucket. How?
An S3 gateway endpoint with an endpoint policy limited to that bucket, plus a bucket policy requiring that endpoint.
12. Phone numbers appear in application logs. How do you hide them?
A CloudWatch Logs data protection policy that masks the sensitive data.
13. A chatbot built on Bedrock must refuse off-topic requests and filter harmful content. What do you use?
Bedrock Guardrails (denied topics, content filters, sensitive information filters), following the OWASP Top 10 for LLM applications.
14. You must prove all S3 buckets block public access across accounts. How?
AWS Config rules (or a conformance pack) aggregated across the organisation, reported in Security Hub.
15. The security team wants to investigate how a compromised role was used across services. Which service helps visualise this?
Amazon Detective.
After SCS-C03
- Read the cybersecurity engineer career path and AI for cloud security engineers.
- Practise with AI security interview questions.
- Compare the Microsoft path in our SC-500 guide, and see live security jobs.
Cloud Soft Solutions in Ameerpet, Hyderabad teaches AWS, cloud security and AI security with hands-on labs. See the APEX AI, ML, Cloud and Cyber Security program and all courses.
📞 Call +91 96660 19191 · WhatsApp · Flat No. 513, 5th Floor, Nilagiri Block, Aditya Enclave, Ameerpet, Hyderabad
Frequently Asked Questions
When did SCS-C03 replace SCS-C02?
SCS-C03 has been in use since 2 December 2025; SCS-C02 was in use until 1 December 2025.
How long is the AWS Security Specialty exam?
170 minutes, with 65 questions: 50 scored and 15 unscored.
What is the passing score for SCS-C03?
750 on a scaled score of 100 to 1,000.
What question types are on SCS-C03?
Multiple choice, multiple response, ordering and matching.
Which SCS-C03 domain has the most weight?
Identity and Access Management, at 20% of scored content.
What's new in SCS-C03?
Guardrails for generative AI apps, OCSF integrations, inter-node encryption, imported key material, log data masking and multi-Region keys and Private CA.
