The AWS Certified Security - Specialty is the credential most often asked for in AWS security roles, and its exam changed in December 2025, so many study plans and practice tests still describe a retired version. This guide sets out what AWS publishes about the current exam, SCS-C03: who it is for, the format and scoring, the six content domains and their weights, what was added and removed from SCS-C02, prices, retake rules and recertification. It adds a preparation plan built around hands-on labs, readiness measures and the mistakes candidates commonly make. It is written for cloud security engineers, security architects moving onto AWS, and managers deciding whether to fund the exam. Facts are as published on aws.amazon.com and in the AWS exam guide, checked October 2026; AWS can change exam details, so confirm in your AWS Certification Account before you book.
Key takeaways
- The current exam is SCS-C03. AWS used SCS-C02 until 1 December 2025 and SCS-C03 from 2 December 2025, with a reorganised outline and new content on generative AI guardrails, OCSF and key material.
- Identity is the biggest domain. Identity and Access Management carries 20% of scored content, followed by Infrastructure Security and Data Protection at 18% each.
- It is 65 questions in 170 minutes. Only 50 questions are scored; 15 unscored questions are mixed in and not identified, and the pass mark is a scaled 750 out of 1,000.
- Experience is recommended, not required. AWS recommends five or more years of IT security experience including two or more years securing AWS workloads; there is no formal prerequisite.
- It costs 300 USD and lasts three years. You recertify by passing the latest version of the exam (a 50% voucher applies) or by completing maintenance in AWS Skill Builder near expiry.
Who the certification is for
AWS describes the target candidate as someone with a responsibility to secure cloud solutions and the equivalent of 3 to 5 years of experience doing so. The certification page adds that it suits experienced IT security professionals who design and implement security solutions. The exam guide says it validates the ability to apply data classifications and AWS data protection mechanisms, implement encryption, use AWS security services to secure production environments, and make trade-offs between cost, security and deployment complexity.
Expected knowledge includes the shared responsibility model, identity at scale, multi-account governance, supply chain risk, vulnerability management, layer 3 to 7 firewall rules at scale, root cause analysis, audit response, logging, encryption and backup-based disaster recovery. Out of scope: designing cryptographic algorithms, packet-level analysis, architecting whole cloud deployments, end-user compute and training machine learning models.
- Strong fit: cloud security engineers, AWS platform engineers who own guardrails, detection engineers working from CloudTrail and GuardDuty, and security architects who review AWS designs. See the Cloud Security Engineer Career Guide.
- Reasonable fit: incident responders and auditors who work inside AWS accounts.
- Weaker fit: people new to AWS, who will struggle with service-specific scenarios, and people who need a cloud-neutral credential, for whom the CCSP Certification Guide or CCSK Certification Guide is the closer match.
Exam format and domains
Format
| Item | SCS-C03 (as published by AWS, checked October 2026) |
|---|---|
| Category | Specialty |
| Questions | 65 in total: 50 scored and 15 unscored, which are not identified |
| Question types | Multiple choice (one correct of four), multiple response (two or more correct of five or more), ordering (3 to 5 responses placed in order) and matching (3 to 7 prompts); ordering and matching need every item right for credit |
| Time | 170 minutes; non-native English speakers can request the ESL +30 accommodation once in their AWS Certification Account |
| Scoring | Scaled score 100 to 1,000, minimum pass 750; compensatory model, so you need to pass the exam overall, not each section; unanswered questions count as wrong and there is no penalty for guessing |
| Delivery | Pearson VUE test centre or online proctored; no scheduled breaks, and online candidates cannot leave the camera view |
| Languages | English, Japanese, Korean, Portuguese (Brazil), Simplified Chinese, Spanish (Latin America); AWS states the Simplified Chinese, Spanish and Portuguese versions are retired after 31 December 2026 |
| Results | Within 5 business days in the AWS Certification Account, with section-level classifications that AWS says to interpret with caution |
AWS also states the English exam is moving to short names for some services, listed under the Help button during the exam.
The six domains
| Domain | Weight | Task statements | Examples AWS gives in the skills |
|---|---|---|---|
| 1. Detection | 16% | Monitoring and alerting for an account or organization; logging; troubleshooting monitoring, logging and alerting | GuardDuty, Security Lake, Security Hub, Macie, Config conformance packs, organization CloudTrail trail, CloudWatch Logs Insights, Athena, VPC Flow Logs, transit gateway flow logs, Route 53 Resolver logs |
| 2. Incident Response | 14% | Design and test an incident response plan; respond to security events | Systems Manager OpsCenter, Shield Advanced, Fault Injection Service, Resilience Hub, Step Functions, Automated Forensics Orchestrator for Amazon EC2, Amazon Detective |
| 3. Infrastructure Security | 18% | Network edge controls; compute workload controls; network security controls | AWS WAF, CloudFront headers, S3 CORS, EC2 Image Builder, Amazon Inspector, Session Manager, EC2 Instance Connect, security groups, network ACLs, Network Firewall, Verified Access, Network Access Analyzer, MACsec |
| 4. Identity and Access Management | 20% | Authentication strategies; authorization strategies | IAM Identity Center, Cognito, STS, S3 presigned URLs, Verified Permissions, IAM Roles Anywhere, role trust policies, ABAC and RBAC, permission boundaries, session policies, IAM Policy Simulator, IAM Access Analyzer |
| 5. Data Protection | 18% | Data in transit; data at rest; confidential data, credentials, secrets and key material | ELB security policies, PrivateLink, VPC endpoints, CloudHSM, KMS, S3 Object Lock, Glacier Vault Lock, AWS Backup, Secrets Manager, imported key material and external key stores, CloudWatch Logs data protection policies, AWS Private CA |
| 6. Security Foundations and Governance | 14% | Centrally deploy and manage accounts; secure and consistent deployment; evaluate compliance | Organizations, Control Tower, SCPs, RCPs, AI service opt-out and declarative policies, delegated administrators, centralised root access, CloudFormation StackSets and Guard, Firewall Manager, AWS RAM, Audit Manager, AWS Artifact, Well-Architected Tool |
What changed from SCS-C02
The AWS comparison appendix shows the old Threat Detection and Incident Response (14%) and Security Logging and Monitoring (18%) domains split into Detection and Incident Response. Identity and Access Management rose from 16% to 20% and Infrastructure Security fell from 20% to 18%. Management and Security Governance was renamed Security Foundations and Governance.
- Added: validating findings to scope an incident, OCSF ingestion and third-party WAF rules, guardrails for generative AI applications using the OWASP Top 10 for LLM Applications, inter-node encryption for EMR, EKS and SageMaker AI, imported compared with AWS generated key material, data masking, and multi-Region keys and certificates.
- Removed: AWS Security Finding Format (ASFF), host-based firewalls and hardening, basic TCP/IP and OSI concepts, reachability analysis with VPC Reachability Analyzer, the components of a policy (Principal, Action, Resource, Condition), TLS concepts and S3 static website hosting.
Removed basics are still assumed knowledge: you cannot read a policy question without knowing what a Condition block does. Check any SCS-C02 practice material against the C03 outline.
Prerequisites and experience
There is no formal prerequisite certification. The recommendation (five years of IT security, two of them on AWS, or 3 to 5 years securing cloud solutions in the exam guide) is guidance about readiness. In practice the scenarios assume you have operated a multi-account organization. If you have not, build one in a sandbox before you study the theory.
| Background | Typical gap | What to do first |
|---|---|---|
| Security generalist, little AWS | Service behaviour, IAM evaluation logic, KMS key policies | Build an AWS Organizations sandbox; work through the AWS IAM Policies and Roles Guide material hands-on |
| AWS engineer or architect, little security | Incident response, forensics, detection tuning, audit evidence | Focus on Domains 1, 2 and 6; run a tabletop on a leaked access key |
Preparation plan
For a candidate with some AWS experience, 8 to 12 weeks part-time is realistic (our guidance, not an AWS figure).
- Weeks 1 to 2, baseline: read the SCS-C03 exam guide end to end, including the in-scope and out-of-scope service lists. Mark every skill you have not done by hand.
- Weeks 2 to 4, identity first: it is 20% of the exam and runs through every other domain. Practise policy evaluation across identity policies, resource policies, permission boundaries, session policies, SCPs and RCPs; set up IAM Identity Center with an external IdP; use IAM Access Analyzer for external access and unused access findings. See the AWS Organizations and SCPs Guide.
- Weeks 4 to 6, data protection: create customer managed KMS keys with key policies and grants, import key material, compare it with AWS generated material, and test S3 Object Lock retention modes. Rotate a secret in Secrets Manager. See the Cloud Secrets Managers Guide.
- Weeks 6 to 8, detection and response: deploy an organization CloudTrail trail to a log archive account, enable GuardDuty and Security Hub with a delegated administrator, query logs in Athena and CloudWatch Logs Insights, and write a runbook that isolates an EC2 instance and preserves EBS snapshots. See the Cloud Logging and Audit Trail Guide and Cloud Incident Response Guide.
- Weeks 8 to 10, infrastructure and governance: AWS WAF rate-based rules, Network Firewall, VPC endpoint policies, Control Tower controls, Config rules with remediation, Firewall Manager and Audit Manager.
- Weeks 10 to 12, exam practice: timed sets of 65 questions in 170 minutes. Practise ordering and matching formats, which have no partial credit. Review every wrong answer against AWS documentation, not against a forum.
Measuring readiness
- Coverage: percentage of exam guide skills you have performed hands-on at least once; aim for most of them, all of Domain 4.
- Timed practice score: consistent scores well clear of a pass across at least three full-length sets from different sources.
- Pace: under about 2.5 minutes per question, leaving review time.
- Weakest domain: no domain far below the rest; the compensatory model forgives one weak area, not two.
Cost, renewal and continuing education
| Item | What AWS states (checked October 2026) |
|---|---|
| Exam fee | 300 USD, plus possible foreign exchange charges |
| Retakes | Wait 14 calendar days after a failed attempt; no limit on attempts; full fee each attempt |
| After passing | You cannot retake the same exam for two years unless a new exam guide and series code has been released |
| Rescheduling | Up to 24 hours before the appointment, at most twice per appointment; late cancellation or no-show forfeits the fee |
| Validity | 3 years |
| Renew | Pass the latest version of the exam while the certification is active; adds 3 years from the renewal date; a 50% discount voucher is available in the AWS Certification Account |
| Maintain | Complete maintenance options in AWS Skill Builder while active and within 90 days of expiry, with a paid Skill Builder subscription; adds 1 year |
There is no continuing education credit scheme for this certification. Renewal by exam tests you against the outline current at the time, and both routes require the certification to still be active.
Where it fits on the career path
The Specialty sits after general AWS experience and alongside, not instead of, a cloud-neutral credential such as CCSP or CCSK, which governance and audit roles more often ask for.
| Credential | Scope | Best for |
|---|---|---|
| AWS Certified Security - Specialty | AWS services, hands-on design and troubleshooting | Engineers who build and operate AWS security controls |
| Google Professional Cloud Security Engineer | Google Cloud services | Engineers on Google Cloud; see the Google Professional Cloud Security Engineer Guide |
| Microsoft security certifications | Azure and Microsoft security stack | Azure and Microsoft 365 shops; see the Microsoft Security Certifications Guide |
| CCSK | Vendor-neutral cloud security knowledge | A broad foundation across providers |
| CCSP | Vendor-neutral, experience-gated | Architects and leads in multi-cloud or governance roles |
| Certified Kubernetes Security Specialist | Kubernetes, performance-based | Platform teams running EKS or other clusters; see the Certified Kubernetes Security Specialist (CKS) Guide |
Small and large organisations: in a small team one engineer often owns every domain on the exam, so the certification is a good structured curriculum. In large enterprises the domains are split across teams, and the value is in shared vocabulary between the identity, detection and platform groups.
Where the exam maps to frameworks
Our mapping of the domains to NIST CSF 2.0 categories, useful when justifying training against a control framework:
| SCS-C03 domain | NIST CSF 2.0 categories |
|---|---|
| Detection | DE.CM Continuous Monitoring, DE.AE Adverse Event Analysis |
| Incident Response | RS.MA Incident Management, RS.AN Incident Analysis, RC.RP Incident Recovery Plan Execution |
| Infrastructure Security | PR.PS Platform Security, PR.IR Technology Infrastructure Resilience |
| Identity and Access Management | PR.AA Identity Management, Authentication, and Access Control |
| Data Protection | PR.DS Data Security |
| Security Foundations and Governance | GV.PO Policy, GV.OV Oversight, ID.AM Asset Management |
Where identity fits
Much of the identity domain concerns workload identity rather than people: instance profiles, execution roles, role trust policies, IAM Roles Anywhere, STS temporary credentials and the rotation of secrets. These are non-human identities, and they feature heavily in real AWS incidents. In the Capital One breach, credentials for an over-permissioned role attached to a firewall were obtained and used to read S3 data, the scenario the exam's least privilege and Access Analyzer skills address. In the Codefinger S3 ransomware campaign, stolen long-lived keys were used to encrypt buckets, which is why the exam stresses temporary credentials, Object Lock and backup design. See the Cloud Workload Identity Guide.
Common failure patterns
- Studying the old exam: using SCS-C02 courses and question banks without checking them against the C03 outline, then meeting GenAI guardrails, OCSF or RCP questions cold.
- Reading, not building: the scenarios turn on service behaviour, such as which policy wins or where a log lands, that is hard to learn without doing it.
- Weak policy evaluation: confusing how SCPs, RCPs, permission boundaries and session policies limit, but never grant, permissions.
- Ignoring the format: treating ordering and matching items like multiple choice, when a single misplaced item loses the whole question.
- Running out of time: long scenario stems eat the 170 minutes, and blanks score as wrong.
Practitioner checklist
- Download the current exam guide and confirm the exam code shown when you book is SCS-C03 or a later version.
- Create an AWS Certification Account and, if eligible, request ESL +30 before your first booking.
- Build a multi-account sandbox with Organizations, a log archive account and a delegated security administrator.
- Do every Domain 4 skill by hand, including trust policies, permission boundaries, session policies and Access Analyzer findings.
- Practise KMS key policies, grants, imported key material and multi-Region keys.
- Write and test one incident runbook for a compromised access key and one for a compromised EC2 instance.
- Take at least three timed, full-length practice sets and track your weakest domain.
- Book with time to spare for a retake 14 days later, and note the reschedule limit of two changes.
Standards and references
- AWS: AWS Certified Security - Specialty
- AWS: AWS Certified Security - Specialty (SCS-C03) Exam Guide
- AWS: Comparison of SCS-C02 and SCS-C03
- AWS: Recertification
- AWS: Certification Policies, Before Testing
- AWS: Certification Policies, After Testing
- NIST: Cybersecurity Framework 2.0
Related NHI Mgmt Group resources: Cybersecurity Certifications Guide · AWS Security Guide · Cloud Security Guide · Top 10 AWS IAM Mistakes · CCSP Certification Guide