AWS Certified Security – Specialty (SCS-C03) Exam Guide
A summary of the official AWS exam guide: who the exam is for, what it looks like, how it is scored, which domains it covers and a plan to prepare. Site last reviewed: 2026-10-16.
What the SCS-C03 exam is
The AWS Certified Security – Specialty exam is intended for individuals who have a responsibility to secure cloud solutions. It validates your ability to demonstrate knowledge about securing AWS products and services. AWS describes the target candidate as having the equivalent of 3–5 years of experience securing cloud solutions. It is one of the Specialty-level certifications (see AWS certification levels explained).
Format, duration and price
The exam has 65 questions and lasts 170 minutes. Its official price is 300 USD, although it varies with exchange rates. According to the official guide, it can include these question types:
- Multiple choice: one correct response and three incorrect responses (distractors).
- Multiple response: two or more correct responses out of five or more response options.
- Ordering: a list of 3–5 responses to complete a task; you must select the correct ones and place them in the correct order.
- Matching: a list of responses to match with a list of 3–7 prompts; you must match all the pairs correctly.
Scoring and passing score
- Results are reported as a scaled score of 100–1,000 and the minimum passing score is 750. The exam is pass or fail.
- Of the 65 questions, 50 are scored and 15 are unscored: AWS uses them to evaluate future content and they are not identified during the exam.
- The scoring model is compensatory: you do not need to pass each section, only the exam as a whole. Each section has a specific weighting, so some sections have more questions than others.
- There is no penalty for guessing, but unanswered questions are scored as incorrect. For ordering and matching questions you only receive credit if you get everything right.
Exam domains and their weight
The content is organized into six domains. Open each one to see its tasks, skills and the AWS services you need to master.
| Domain | Content | Weight |
|---|---|---|
| 1 | Detection | 16% |
| 2 | Incident Response | 14% |
| 3 | Infrastructure Security | 18% |
| 4 | Identity and Access Management | 20% |
| 5 | Data Protection | 18% |
| 6 | Security Foundations and Governance | 14% |
- Domain 1: Detection (16%) — design and implement monitoring and alerting solutions for an AWS account or organization; design and implement logging solutions; troubleshoot security monitoring, logging, and alerting solutions.
- Domain 2: Incident Response (14%) — design and test an incident response plan; respond to security events.
- Domain 3: Infrastructure Security (18%) — design, implement, and troubleshoot security controls for network edge services; design, implement, and troubleshoot security controls for compute workloads; design and troubleshoot network security controls.
- Domain 4: Identity and Access Management (20%) — design, implement, and troubleshoot authentication strategies; design, implement, and troubleshoot authorization strategies.
- Domain 5: Data Protection (18%) — design and implement controls for data in transit; design and implement controls for data at rest; design and implement controls to protect confidential data, credentials, secrets, and cryptographic key materials.
- Domain 6: Security Foundations and Governance (14%) — develop a strategy to centrally deploy and manage AWS accounts; implement a secure and consistent deployment strategy for cloud resources; evaluate the compliance of AWS resources.
Recommended knowledge
The official guide lists the AWS knowledge the target candidate should have:
- The AWS shared responsibility model and its application
- Managing identity at scale
- Multi-account governance
- Managing software supply chain risks
- Security incident prevention and response strategies
- Vulnerability management in the cloud
- Developing firewall rules at scale for layers 3–7
- Incident root cause analysis
- Experience responding to an audit
- Logging and monitoring strategies
- Data encryption methodologies, both at-rest and in-transit
- Disaster recovery controls, including backup strategies
Job tasks that are out of scope
AWS states that the target candidate is not expected to be able to perform these tasks (the list is non-exhaustive):
- Design cryptographic algorithms
- Analyze traffic on the packet level
- Architect overall cloud deployments
- Manage end-user compute resources
- Train machine learning models
How to prepare: a six-step study plan
This is the site's own recommendation, not an official AWS guide:
- Read the official guide. Start with the AWS SCS-C03 exam guide: it defines the domains, tasks and services that are tested. Everything on the exam is in there.
- Take a diagnostic test. Answer 20 questions without preparing. The result shows you which domains are weakest.
- Split your study by weight. IAM is 20%, Infrastructure Security and Data Protection are 18% each. Spend more time on what scores most, without neglecting the rest.
- Study with the official documentation. Every security service has its guide on docs.aws.amazon.com. The tips on this site link the exact page they come from.
- Review your mistakes. A mistake reviewed on time sticks. Use the incorrect questions bank and spaced repetition instead of repeating questions you already know.
- Simulate the full exam. Take a 65-question test in exam mode and time yourself. With 170 minutes you have about 2 min 37 s per question.
Deepen the topics that exam questions hinge on:
- IAM policy evaluation, SCPs and boundaries
- Confused deputy, External ID and presigned URLs
- IAM Access Analyzer
- AWS KMS keys, rotation and deletion
- S3 Object Lock, Macie and Secrets Manager
- GuardDuty, CloudTrail and AWS Config
- Security groups, NACLs, VPC endpoints and WAF
- Incident response: compromised EC2 and credentials
Start a practice test Browse study topics
Frequently asked questions
How many questions does the AWS Security Specialty SCS-C03 exam have?
The exam has 65 questions. Of those, 50 affect your score and 15 are unscored questions that AWS uses to evaluate future content; they are not identified during the exam.
How long is the SCS-C03 exam?
It lasts 170 minutes, which is about 2 minutes and 37 seconds per question if you split the time evenly.
What is the passing score for AWS Certified Security – Specialty?
The minimum passing score is 750 on a scaled score of 100 to 1,000. The result is pass or fail, and the scoring model is compensatory: you do not need to pass each section, only the exam as a whole.
How much does the AWS Security Specialty exam cost?
The official price listed by AWS is 300 USD. It can vary with exchange rates, so check the local price on the official AWS page.
What are the SCS-C03 exam domains?
There are six: Detection (16%), Incident Response (14%), Infrastructure Security (18%), Identity and Access Management (20%), Data Protection (18%) and Security Foundations and Governance (14%).
What experience is recommended before taking the exam?
AWS describes the target candidate as having the equivalent of 3–5 years of experience securing cloud solutions.
Is there a penalty for wrong answers?
There is no penalty for guessing, but unanswered questions are scored as incorrect. Answer every question, even if you have to flag it and come back later.
What question types does the exam include?
It can include multiple choice, multiple response, ordering and matching questions. For ordering and matching you only get credit if you get everything right.
Is this practice test official AWS content?
No. This is an independent practice site with no affiliation with Amazon Web Services. Exam facts come from the official guide that AWS publishes, and you should always check that guide for current information.
How does the practice exam work?
You choose how many questions, the mode (practice with instant feedback, or exam with grading at the end) and which sources to use. Every miss goes to your incorrect questions bank and comes back with spaced repetition until you master it.
Sources: official SCS-C03 exam guide and certification page (AWS).