Updated 1 Nov 2026 · 6 min read
On this page
What the AWS Certified Security Specialty (SCS-C03) is and who it is for
The exam guide says SCS-C03 is "intended for individuals who have a responsibility to secure cloud solutions". It covers data protection, encryption, AWS security services and decisions that weigh cost, security and deployment complexity.
It is not an entry level exam. The guide describes the target candidate as having the equivalent of three to five years of experience securing cloud solutions, and the certification page describes candidates with five years of IT security experience plus two or more years of hands-on experience securing AWS workloads. Designing cryptographic algorithms, packet-level traffic analysis and training machine learning models are out of scope.
SCS-C03 replaced SCS-C02 on 2 December 2025, with the first two domains rebuilt as Detection and Incident Response. The SCS-C03 exam guide is version 1.0, published 26 March 2026.
SCS-C03 at a glance
| Fact | Detail |
|---|---|
| Exam code | SCS-C03 |
| Questions | 65 (50 scored, 15 unscored) |
| Time allowed | 170 minutes |
| Passing score | 750 on a scaled score of 100 to 1,000 |
| Exam fee | US$300 |
| Languages | English, Japanese, Korean, Portuguese (Brazil), Simplified Chinese and Spanish (Latin America) |
| Where you sit it | Pearson VUE test centre or online proctored |
| Certification valid for | 3 years |
AWS says the Simplified Chinese, Spanish (Latin America) and Portuguese (Brazil) versions will be retired after 31 December 2026, so test in those languages by then or choose another. The certification page describes the format as multiple choice or multiple response, but the exam guide also lists ordering and matching questions. Prepare for all four.
What is on the exam
The guide splits the scored content into six domains, and no domain is small enough to skip.
Detection (16%). Monitoring, alerting and logging for an account or organisation: Amazon GuardDuty, AWS Security Hub, Amazon Macie, Amazon Security Lake, an organisation trail in AWS CloudTrail, and log analysis with CloudWatch Logs Insights and Amazon Athena. It also tests fixing missing logs.
Incident Response (14%). Writing and testing response plans, automating remediation with Systems Manager, Step Functions and Lambda, capturing logs as forensic artifacts, containing and recovering resources, and using Amazon Detective for root cause analysis.
Infrastructure Security (18%). At the edge: AWS WAF, CloudFront headers, Shield Advanced and rate limiting. For compute: hardened AMIs and container images, the right execution role, Amazon Inspector scans, patching and guardrails for generative AI applications. For the network: security groups, network ACLs, AWS Network Firewall, Direct Connect with MACsec and AWS Verified Access.
Identity and Access Management (20%). Authentication with IAM Identity Center, Amazon Cognito, MFA, federation and temporary credentials from AWS STS. Authorisation has the longer skill list: role trust policies, cross-account resource policies, ABAC and RBAC, permission boundaries, session policies, and diagnosing failures with the IAM Policy Simulator and IAM Access Analyzer.
Data Protection (18%). Enforcing TLS and private access through PrivateLink and VPC endpoints. At rest, you choose between AWS KMS and CloudHSM and between client-side and server-side encryption, then protect integrity with S3 Object Lock and design backups with AWS Backup. It also covers Secrets Manager rotation, imported versus AWS generated key material, and data masking.
Security Foundations and Governance (14%). AWS Organizations, AWS Control Tower, SCPs, RCPs and declarative policies, delegated administrators and centralised root access, plus consistent deployment with CloudFormation StackSets and compliance evidence from AWS Config, AWS Audit Manager and AWS Artifact.
Why people fail it
The first trap is outdated preparation written for SCS-C02. AWS's comparison removes topics older courses dwell on, such as the AWS Security Finding Format and fundamental TCP/IP concepts, and adds generative AI guardrails, OCSF integrations, data masking and multi-Region key management.
The second is policy evaluation. The guide puts identity policies, cross-account resource policies, role trust policies, permission boundaries, session policies and SCPs all in scope, so expect scenarios where several of them apply at once and you must work out whether access succeeds. KMS is the same: knowing a key policy exists is not enough, you need to know why a principal in another account is still denied.
Third, the detective services blur together. GuardDuty, Inspector, Macie, Detective and Security Hub each answer a different question, and all five are named in the exam guide, so learn exactly which job each one does.
Finally, the formats. Ordering and matching questions only score if everything is right. Unanswered questions count as wrong and there is no penalty for guessing, so never leave one blank.
A study plan that fits the exam
Eight weeks suits most people who already work with AWS security, roughly following the domain weights.
- Week 1: Authentication. Identity Center, Cognito, federation, MFA and STS. Try the free SCS-C03 practice questions cold to see where you stand.
- Week 2: Authorisation. Policy evaluation, cross-account access, ABAC, permission boundaries and IAM Access Analyzer.
- Week 3: Data at rest. KMS key policies and grants, CloudHSM, imported key material, Secrets Manager, Object Lock and AWS Backup.
- Week 4: Data in transit and the edge. TLS enforcement, PrivateLink, AWS WAF, Shield Advanced and CloudFront.
- Week 5: Compute and network security. Hardened images, Inspector, Patch Manager, generative AI guardrails, security groups, network ACLs and Network Firewall.
- Week 6: Detection. GuardDuty, Security Hub, Security Lake, organisation trails, VPC Flow Logs and fixing broken logging.
- Week 7: Incident response and governance. Runbooks, forensics, automated remediation, Detective, Organizations, Control Tower, SCPs, RCPs and Config.
- Week 8: Timed practice. Work through the 143-question SCS-C03 practice pack in timed sets, read the explanation for every miss, and revisit your weakest domain before you book.
On exam day
You sit SCS-C03 at a Pearson VUE test centre or online with a live proctor. At a test centre, arrive 15 to 30 minutes early with identification whose first and last names match your AWS Certification Account. Online, you can launch up to 30 minutes early, but if you are more than 15 minutes late, or your computer fails the system test, you lose the fee.
AWS does not schedule breaks. Online, you cannot leave the camera's view. At a test centre you can take an unscheduled break, but the clock keeps running. With 65 questions in 170 minutes you have about two and a half minutes each, so flag long scenarios. The exam uses short names for some AWS services, with full names behind the Help button. Non-native English speakers testing in English can request the ESL +30 accommodation for 30 extra minutes before registering. Results reach your AWS Certification Account within five business days.
Frequently asked questions
What happens if I fail SCS-C03?
You must wait 14 calendar days before retaking it. AWS sets no limit on attempts, but you pay the full fee each time. Scoring is compensatory, so you need to pass the exam overall, not each section, and your score report may show section-level feedback to help you target weak domains.
Do I need another AWS certification first?
No. AWS requires none, though it says candidates commonly earn Solutions Architect Associate or Professional first. Once you hold one AWS certification, you get a 50% discount on your next exam.
How do I keep the certification current?
It is valid for three years. Passing the latest version of the exam renews it for three more years, or you can maintain it for one more year through AWS Skill Builder with a paid subscription. Either way the certification must still be active.
Is the practice pack enough on its own?
No. The pack is practice, not a course. It shows how AWS frames security scenarios and where your gaps are, but this exam expects hands-on experience, so pair it with the official exam guide and time in a real AWS account. Start with the free sample to see whether the format suits you.
When you are ready to test yourself properly, get the full SCS-C03 practice pack, with a full refund if you do not pass.
Sources
The official pages the facts in this guide were checked against.
- docs.aws.amazon.com/aws-certification/latest/security-specialty-03/security-specialty-03.html
- aws.amazon.com/certification/certified-security-specialty/
- docs.aws.amazon.com/aws-certification/latest/security-specialty-03/security-specialty-03-appendix-b.html
- docs.aws.amazon.com/aws-certification/latest/security-specialty-03/scs03-revisions.html
- docs.aws.amazon.com/aws-certification/latest/security-specialty-03/security-specialty-03-domain1.html
- docs.aws.amazon.com/aws-certification/latest/security-specialty-03/security-specialty-03-domain2.html
- docs.aws.amazon.com/aws-certification/latest/security-specialty-03/security-specialty-03-domain3.html
- docs.aws.amazon.com/aws-certification/latest/security-specialty-03/security-specialty-03-domain4.html
- docs.aws.amazon.com/aws-certification/latest/security-specialty-03/security-specialty-03-domain5.html
- docs.aws.amazon.com/aws-certification/latest/security-specialty-03/security-specialty-03-domain6.html
- aws.amazon.com/certification/policies/during-testing/
- aws.amazon.com/certification/policies/before-testing/
- aws.amazon.com/certification/policies/after-testing/
- aws.amazon.com/certification/recertification/