Amazon Web Services
AWS Security – Specialty
AWS Certified Security – Specialty (SCS-C03)
AWS's specialty certification for securing AWS workloads: detection, incident response, infrastructure security, identity and access management, data protection, and security foundations and governance. SCS-C03 replaced SCS-C02 on December 2, 2025.
Full program: 6 decks, 1,049 cards.
What's on the exam
SCS-C03 Exam Guide (v1.0, published March 26, 2026; exam in use from December 2, 2025)
Detection
16%Monitoring and alerting for an account or organization · GuardDuty, Security Hub, Macie, and Security Lake findings · AWS Config conformance packs and automated assessments · CloudTrail organization trails and CloudWatch Logs · Log analysis with CloudWatch Logs Insights and Athena · VPC Flow Logs and Route 53 Resolver query logs · Troubleshooting missing logs and CloudWatch agent configuration
Incident Response
14%Incident response plans and runbooks · Preparing access and tooling before incidents · Testing response plans with Fault Injection Service and Resilience Hub · Automated remediation with Systems Manager, Step Functions, and Lambda · Forensic artifact capture and storage · Validating findings and root cause analysis with Detective · Containment, eradication, and recovery
Infrastructure Security
18%Edge protection with CloudFront, AWS WAF, and Shield Advanced · WAF rules: geo match, rate-based, bot and fraud control · Hardened AMIs and container images with EC2 Image Builder · Vulnerability scanning with Amazon Inspector and GuardDuty Runtime Monitoring · Patch Manager and Session Manager · Generative AI guardrails and OWASP Top 10 for LLM applications · Security groups, network ACLs, and AWS Network Firewall · Hybrid connectivity: Site-to-Site VPN, Direct Connect, MACsec · Verified Access, Network Access Analyzer, and segmentation
Identity and Access Management
20%IAM Identity Center, permission sets, and IdP federation · Amazon Cognito user pools and identity pools · MFA and temporary credentials with AWS STS · S3 presigned URLs · Role trust policies and cross-account resource policies · IAM Roles Anywhere and Amazon Verified Permissions · ABAC and RBAC with tags · Permission boundaries, session policies, and policy evaluation · IAM Access Analyzer and IAM Policy Simulator
Data Protection
18%Enforcing TLS with ELB security policies and aws:SecureTransport · PrivateLink, VPC endpoints, Client VPN, and Verified Access · Inter-node and Nitro encryption in transit · KMS vs CloudHSM, server-side vs client-side encryption · S3 Object Lock, Glacier Vault Lock, and versioning · Lifecycle and retention policies · AWS Backup, Data Lifecycle Manager, and ransomware protection · Secrets Manager rotation · Imported key material and external key stores · Data masking with CloudWatch Logs and SNS data protection policies · Multi-Region KMS keys and AWS Private CA
Security Foundations and Governance
14%AWS Organizations structure · AWS Control Tower and controls · SCPs, RCPs, declarative policies, and AI opt-out policies · Delegated administrator accounts · Root user management and break-glass access · CloudFormation StackSets, Guard, and cfn-lint · Tagging strategy · Firewall Manager central policies · Sharing with AWS RAM and Service Catalog · AWS Config rules and remediation · Audit Manager and AWS Artifact · Well-Architected Tool security reviews
Frequently asked questions
How much does the AWS Security – Specialty cost?
The AWS Security – Specialty costs $300. Standard exam fee; a 50% discount voucher is issued after passing any AWS exam.
How long is the AWS Security – Specialty and how many questions does it have?
65 items (50 scored, 15 unscored) — 170 minutes.
What do you need to pass the AWS Security – Specialty?
750 on a scale of 100–1000.
Can you retake the AWS Security – Specialty?
14-day wait between attempts.
What is the best way to study for the AWS Security – Specialty?
Start from the official outline and your primary study materials: the exam is weighted by domain (Detection 16%, Incident Response 14%, Infrastructure Security 18%, Identity and Access Management 20%, Data Protection 18%, Security Foundations and Governance 14%). Once you've learned the material, spaced-repetition flashcards organized by those domains are an efficient way to retain it and refresh it before test day.
Ready to prepare?
Our AWS Certified Security – Specialty program is organized by this outline's domains and scheduled by spaced repetition, with a path from first card to test day.
Flashcards are a memory tool. Learn the material first, then use NoReread to retain it and refresh what you already know. It doesn't replace studying the subject.