AWS Certified Security - Specialty
AWS Certified Security - Specialty (SCS-C03, which replaced the retired SCS-C02) is AWS's senior-tier security credential. Covers identity and access, infrastructure security, data protection, incident response, threat detection and logging, and management and security governance. 170 minutes, 65 questions, scaled passing score approximately 750/1000. AWS has not published official per-domain percentage weights for SCS-C03 as of this writing.
Exam fee at last check: $300, per the vendor. The official objectives are at aws.amazon.com/certification/certified-security-specialty/. Verified 2026-09-26.
Practice is free. The full analysis adds the right answer, the explanation and the source for every question, readiness by domain and a study plan, for one payment.
What's on the exam
Threat Detection and Incident Response
Detecting, investigating, and responding to security events in AWS.
- Amazon GuardDuty (threat detection across VPC Flow Logs, DNS, CloudTrail)
- AWS Security Hub (centralized findings + compliance posture)
- Amazon Detective (investigation graphs)
- AWS Config rules for compliance + remediation actions
- Incident response: SSM, EC2 Instance Connect, snapshot-based forensics, EventBridge automation
Primary sources: AWS Security Specialty SCS-C02 exam guide, AWS GuardDuty user guide
Security Logging and Monitoring
Logging architecture for security telemetry: CloudTrail, VPC Flow Logs, CloudWatch.
- CloudTrail event categories: management, data, insight, network activity
- CloudTrail Lake for SQL-queryable trails
- VPC Flow Logs at the VPC, subnet, and ENI level
- CloudWatch Logs, metric filters, Logs Insights
- Encryption of logs (KMS), log integrity validation (CloudTrail digest files)
Primary sources: AWS CloudTrail user guide
Infrastructure Security
Network controls and edge protection in AWS.
- VPC design: subnets, route tables, NACLs, security groups, NAT, VPC endpoints
- AWS Network Firewall, WAF, Shield (Standard and Advanced)
- VPC Lattice and PrivateLink for private service-to-service
- Edge protection: CloudFront, Route 53, Global Accelerator with security policies
- Hybrid: Direct Connect, Site-to-Site VPN, Transit Gateway
Primary sources: AWS Network Firewall docs
Identity and Access Management
IAM in depth, plus AWS SSO, Cognito, federation.
- IAM principals, policies, permission boundaries, SCPs (Service Control Policies in Organizations)
- AWS IAM Identity Center (formerly SSO), permission sets
- Federation: SAML, OIDC, AWS STS, role chaining
- Cognito user pools and identity pools
- Least-privilege design with Access Analyzer and IAM Access Advisor
Primary sources: AWS IAM user guide
Data Protection
Encrypting, classifying, and protecting data in AWS.
- AWS KMS: customer managed keys, AWS managed keys, key policies, grants, multi-region keys
- Encryption: at rest (S3 SSE-S3, SSE-KMS, SSE-C), in transit (TLS), client-side
- Macie for sensitive-data discovery
- Secrets Manager and Systems Manager Parameter Store
- Data classification, S3 bucket policies, S3 Block Public Access, S3 Object Lock
Primary sources: AWS KMS developer guide, Amazon Macie user guide
Management and Security Governance
Multi-account governance, organization-wide security, audit.
- AWS Organizations: SCPs, delegated administration
- AWS Control Tower and account factory
- Conformance packs in AWS Config
- Tag policies and resource sharing (RAM)
- Audit: AWS Audit Manager, prebuilt frameworks
Primary sources: AWS Organizations user guide, AWS Audit Manager user guide
Exam-day strategy
Identify which exam domain the question targets (Identity, Infrastructure, Data, Logging, Threat Detection, Governance). The right answer often resolves by domain.
Watch for distractors that propose custom code where an AWS managed service exists for the use case.
On IAM questions, look for the specific policy construct (identity policy, resource policy, trust policy, permission boundary, SCP). The exam tests the distinction.
On KMS questions, identify whether the scenario calls for AWS managed keys, customer managed keys, or grants. Cross-account scenarios usually require customer managed keys.
Pace at roughly 2 minutes 30 seconds per question. 170 minutes for 65 questions is moderate.
Additional resources
Explore Related Cybersecurity Resources
DecipherU is independent of Amazon. Security Specialty is a trademark of Amazon. DecipherU is not endorsed by, sponsored by, or affiliated with any certifying body.