Expect multi-account scenarios throughout.
Passers describe a management account with many member accounts in most questions, with heavy use of Organizations, SCPs, delegated administrators and centralized CloudTrail.
AWS Certified Security – Specialty (SCS-C03) Exam Guide
Validates knowledge of securing AWS workloads, including threat detection, incident response, infrastructure security, identity, data protection and governance.
The exam gives you security scenarios, often across many accounts, and asks for the control or response that meets the requirement with the right balance of cost, security and complexity. Build on real AWS experience, learn what each security service is for, practise in your own account and work through many scenarios.
Understand the exam
Syllabus
Domain 1Detection16%
- 1.1Design and implement monitoring and alerting solutions for an AWS account or organization
- 1.2Design and implement logging solutions
- 1.3Troubleshoot security monitoring, logging, and alerting solutions
Example scenario: The security team wants every new account's GuardDuty findings to appear in one place automatically. How would you set this up?
Domain 2Incident response14%
- 2.1Design and test an incident response plan
- 2.2Respond to security events
Example scenario: An access key appears in a public code repository. What would you do first, and how would you find what it was used for?
Domain 3Infrastructure security18%
- 3.1Design, implement, and troubleshoot security controls for network edge services
- 3.2Design, implement, and troubleshoot security controls for compute workloads
- 3.3Design and troubleshoot network security controls
Example scenario: An application must reach S3 without any traffic leaving the VPC to the internet. Which network option would you use?
Domain 4Identity and access management20%
- 4.1Design, implement, and troubleshoot authentication strategies
- 4.2Design, implement, and troubleshoot authorization strategies
Example scenario: A developer has an IAM policy allowing s3:PutObject but still gets access denied. Which other policy types would you check?
Domain 5Data protection18%
- 5.1Design and implement controls for data in transit
- 5.2Design and implement controls for data at rest
- 5.3Design and implement controls to protect confidential data, credentials, secrets, and cryptographic key materials
Example scenario: Two accounts must decrypt the same encrypted S3 objects, but only one team should manage the key. How would you set the key policy?
Domain 6Security foundations and governance14%
- 6.1Develop a strategy to centrally deploy and manage AWS accounts
- 6.2Implement a secure and consistent deployment strategy for cloud resources
- 6.3Evaluate the compliance of AWS resources
Example scenario: An auditor asks for proof that every S3 bucket in all accounts blocks public access. Which services would you use to check and prove it?
Official SCS-C03 exam guide · SCS-C03, since December 2025
Format
- Questions
- 65
- Duration
- 2h 50m
- Passing score
- 750 / 1000
- Delivery
- Test centre or online
- Languages
- English, Chinese (Simplified), Japanese, Korean, Portuguese, Spanish
Question types
Choose the single best answer from four options; one is correct and three are distractors.
CertUp example
A security team wants GuardDuty findings from every new account in the organization to appear in one place automatically. What should they do?
Show answer
Designate a delegated administrator account and enable GuardDuty for the organization. New accounts are enrolled automatically and findings roll up centrally.
Choose two or more correct answers from five or more options; you must select every correct option to get credit.
CertUp example
An access key was found in a public repository. Which TWO actions should the team take immediately?
Show answer
Deactivate the exposed access key, and review CloudTrail for activity made with it. Stop further use first, then find out what the key was used for.
Place three to five steps in the correct order; the question scores only if the selection and the order are both right.
CertUp example
Put the steps for responding to a compromised EC2 instance in a sensible order.
Show answer
Isolate the instance, snapshot the volumes, investigate the snapshot, restore service from a clean image. Contain first, preserve evidence, then recover.
Match each item in one list to the correct prompt in another; every pair must be right to get credit.
CertUp example
Match each need to the AWS service that meets it (options are the services to match to prompts 1 to 3).
Show answer
1 is Amazon GuardDuty, 2 is AWS Secrets Manager, 3 is AWS Config. Each service has a distinct security job.
Eligibility and booking
Create an AWS Certification account with a personal email and schedule with Pearson VUE at a test centre or online. Non-native English speakers can request 30 extra minutes before booking.
Make a study plan
Check the six domains against your experience. Then take one course, practise the security services in a test account and finish with scenario practice.
Most candidates spend 60–120 hours. Plan for the low end if you run AWS security day to day; add time if IAM policy logic, multi-account setups or incident response are new to you.
- 1Understand the examRead the syllabus and format, check you’re eligible and pick a target date.5 h
- 3Learn the core conceptsWork through one main course or book, topic by topic.60 h
- 4Practice with mock examsTake timed practice tests and review every mistake.30 h
- 5Prepare for exam dayBook the exam and check the ID and delivery rules.5 h
Learn the core concepts
Choose one course for SCS-C03 and practise the services in a test account. Multi-account setups and IAM policy logic deserve extra time.
Best focused courseUltimate AWS Certified Security Specialty [NEW 2026] SCS-C03Best course with labsAWS Certified Security Specialty Course SCS-C03Best for depth[NEW] AWS Certified Security Specialty 2026Map each need to a service. Prevention across accounts usually means SCPs, threat detection GuardDuty, configuration checks AWS Config, combined findings Security Hub and an API audit trail CloudTrail.
Practice with mock exams
Start with AWS's free question set. Then use a scenario bank that includes ordering and matching questions, and review every explanation, including the ones you got right.
Official Practice Question Set (SCS-C03)
Free AWS Certified Security Specialty Practice Exams SamplerAWS Certified Security Specialty Practice Exams SCS-C03Are you ready?
- You can work out whether a request is allowed when identity, resource, boundary and SCP policies all apply.
- You can design centralized logging and findings for an organization with many accounts.
- You finish fresh timed practice exams and can explain why the second-best answer is wrong.
Prepare for exam day
Choose the checklist for your test-centre or online appointment.
Before going to the test centre
Before testing from home
- Bring two IDs, or one primary and one secondary ID, matching the name in your AWS Certification account.
- Arrive 15 to 30 minutes before your appointment.
- Store your belongings as instructed. Breaks are allowed, but the exam clock keeps running.
- Run the OnVUE system test on the computer and network you will use.
- Prepare a private room and a clear desk, and have one government-issued photo ID ready.
- Start check-in early. Arriving more than 15 minutes late forfeits the exam fee.
- You cannot leave the camera view or take a break during the 170 minutes.
You can reschedule or cancel up to 24 hours before the appointment, and reschedule twice at most. Results are posted to your AWS Certification account within five business days.
Advice from exam takers
Long questions with two plausible answers.
Candidates say questions get longer as the exam goes on and often leave two good options. One flagged nearly half the exam for review on the first pass.
Hands-on time helps as much as a course.
Passers with security work experience said it helped more than any single course. Others recommend setting up the services in a free account rather than only watching videos.