thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

AWS · Cybersecurity · Professional

AWS Certified Security - Specialty exam guide

Exam SCS-C03

The AWS Certified Security - Specialty (SCS-C03) validates deep skills securing AWS workloads: detection, incident response, infrastructure security, identity and access management, data protection and governance. It is the premier AWS credential for cloud security engineers and adds ordering and matching question types.

Questions65 (50 scored, 15 unscored)
Time limit170 minutes
Passing score750 (100-1000 scale)
Exam fee$300 USD
Valid for3 years
DeliveryPearson VUE test center or online proctored

Format: Multiple choice, multiple response, ordering and matching. Fee note: Plus applicable taxes/FX; 50% off with a voucher from a previously passed AWS exam.

Who it's for

Security professionals with about 5 years of IT security experience and 2+ years securing AWS workloads.

What the exam covers

Detection16%
Incident Response14%
Infrastructure Security18%
Identity and Access Management20%
Data Protection18%
Security Foundations and Governance14%

Eligibility & prerequisites

Required: None

Recommended: Five years of IT security experience designing and implementing security solutions and two or more years securing AWS workloads (exam guide cites 3-5 years securing cloud solutions).

Keeping it active

Valid 3 years. Recertify by passing the latest version of this exam before your certification expires. After passing any AWS exam you receive a 50% discount voucher for your next exam.

Skills & careers

Skills it validates

  • Threat detection with GuardDuty, Security Hub, Detective and CloudTrail Lake
  • Incident response automation and forensics preparation
  • Layer 3-7 firewalling at scale with Network Firewall, WAF and Firewall Manager
  • IAM at scale: permission boundaries, SCPs, IAM Identity Center, policy evaluation
  • Encryption with KMS, CloudHSM and ACM; key policies and grants
  • Multi-account governance, audit response and software supply chain risk

Job roles

Cloud Security EngineerAWS Security ArchitectSecurity Operations EngineerDevSecOps EngineerCloud Security AnalystIncident Response Engineer

Where it fits in your path

Planning a degree too? See how this cert earns college credit in the College Credit Navigator.

Build my study plan

  1. Week 1: Read the SCS-C03 exam guide and the SCS-C02 vs C03 comparison appendix
  2. Week 2: Identity (20%) - IAM policy evaluation logic, SCPs, RCPs, permission boundaries, IAM Identity Center, cross-account roles
  3. Week 3: Detection and incident response - GuardDuty, Security Hub, Detective, CloudTrail, Config, EventBridge-driven isolation playbooks
  4. Week 4: Infrastructure security - VPC design, Network Firewall, WAF, Shield, Firewall Manager, Inspector
  5. Week 5: Data protection - KMS key policies, grants, multi-Region keys, S3 encryption and Object Lock, Macie, Secrets Manager
  6. Week 6-7: Governance (Organizations, Control Tower, Audit Manager) and timed practice exams

Make it yours: pick your exam date and weekly hours. We'll split your time by domain weight and give you a printable plan.

Exam-day tips

  • Practice ordering and matching formats - SCS-C03 requires all items correct for credit
  • Master the IAM policy evaluation order (explicit deny, SCP, resource policy, boundary, session policy)
  • Know KMS key policy vs IAM policy interplay; a key policy must allow the account or principal
  • Incident response answers typically isolate first (security group swap, revoke sessions), preserve evidence second
  • Packet-level traffic analysis and designing cryptographic algorithms are out of scope

Key terms for this exam

All 77 terms Study with thinQcards™

Commonly confused on this exam

Frequently asked questions

How much is AWS Security Specialty?

$300 USD plus applicable taxes.

What is new in SCS-C03?

Six domains with Identity and Access Management at 20%, new ordering and matching question types, and 50 scored plus 15 unscored questions.

Is AWS Security Specialty hard?

Yes. It assumes real security experience and deep knowledge of IAM and KMS. Plan 6-10 weeks after an associate cert.

AWS Security Specialty vs CCSP?

SCS proves AWS-specific hands-on security; CCSP is vendor-neutral and policy/architecture focused. Many cloud security engineers hold both.

How long is it valid?

Three years; renew by passing the current version of the exam.

Official page: aws.amazon.com. Reviewed November 2026. Vendors change fees and objectives, so confirm with the vendor before you book. Spot something out of date? Tell us.