How to Study for the AWS Certified Security – Specialty Exam

The AWS Certified Security – Specialty exam, SCS-C03, does not reward memorizing service names. It assumes you already run production AWS workloads and asks you to reason through security trade-offs the way an on-call engineer would: which control actually stops this attack, which one just looks like it does, and what the least-disruptive fix is. That makes it a different kind of study problem than an entry-level cert, and most generic cert-prep advice does not transfer cleanly.

AWS recommends candidates have three to five years of hands-on AWS security experience before sitting this exam, and it shows in the question style. If you are newer to AWS, build real time in the console and the CLI before you touch practice questions; no amount of flashcard review substitutes for having actually configured an IAM policy that did not do what you expected.

Exam format, at a glance

• 65 questions, a mix of multiple choice and multiple response, with 50 scored and the rest unscored items AWS uses to evaluate future exams.
• 170 minutes on the clock, about 2 minutes and 37 seconds per question if you spend it evenly. In practice the scenario-heavy questions take longer and the straightforward ones take seconds, so build pacing around that rather than a flat per-question budget.
• Pass mark of 750 on a scaled range of 100 to 1,000. AWS sets 750 as the bar for every Specialty and Professional exam, higher than the 700 to 720 bar for Associate and Foundational level.
• US$300 to sit, valid for 3 years once you pass.

Source: AWS Certified Security – Specialty and AWS Certification: after testing. If you fail, you can retake after 14 calendar days with no cap on attempts, though you pay the full fee every time.

The six domains, and where the exam puts its weight

AWS groups the exam into six domains with published weightings. They are not evenly split, and the two heaviest, Identity and Access Management and the tied pair of Infrastructure Security and Data Protection, account for over half the exam between them.

• Identity and Access Management, 20%. The single heaviest domain.
• Infrastructure Security, 18%.
• Data Protection, 18%.
• Detection, 16%.
• Incident Response, 14%.
• Security Foundations and Governance, 14%.

Source: AWS Certified Security – Specialty (SCS-C03) exam guide. Spend your study time proportional to these weights, not to which domain feels most comfortable. Governance questions are often the quickest to answer correctly once you know the material, which makes it tempting to over-study the domain that is actually worth the least.

How to study each domain

Identity and Access Management (20%)

This domain tests whether you can read a policy document and know what it actually grants, including the parts that are easy to get backward: an explicit deny always wins over an allow, a resource-based policy and an identity-based policy are evaluated together rather than one overriding the other, and a permissions boundary caps what an identity-based policy can grant without itself granting anything. AWS's own IAM best practices guide is the primary reference and worth reading twice: once for the concepts, once specifically for the policy-evaluation logic.

Infrastructure Security and Data Protection (18% each)

These two domains overlap in practice: a VPC security boundary and an encryption boundary are both answers to "what stops this data from leaving" questions, just at different layers. AWS's Well-Architected Framework Security Pillar is written around exactly this layered model and is the closest thing to an official syllabus for both domains at once. Know the difference between a security group and a network ACL (stateful versus stateless, and where each sits in the traffic path), and know when a workload should use KMS-managed keys versus customer-managed keys versus client-side encryption before the data ever reaches AWS.

Detection (16%)

Detection questions are rarely "what does this service do." They are "given this finding, log entry, or alert, what actually happened, and what do you check next." Study the native AWS detection services (GuardDuty, Security Hub, CloudTrail, VPC Flow Logs, Config) by what signal each one surfaces, not by their marketing descriptions. The MITRE ATT&CK Cloud matrix is a useful cross-reference for the attacker behavior behind a given finding, even though the exam itself stays vendor-specific.

Incident Response (14%)

This domain tests sequence as much as tooling: isolate, preserve evidence, and investigate before you remediate and recover, because remediating first can destroy the evidence you need to know what else an attacker touched. NIST's SP 800-61 Revision 3, Incident Response Recommendations and Considerations for Cybersecurity Risk Management lays out that lifecycle in vendor-neutral terms; AWS's exam questions are that lifecycle applied to specific AWS primitives, like isolating a compromised instance by swapping its security group rather than terminating it outright.

Security Foundations and Governance (14%)

The smallest domain by weight but not by surface area: the shared responsibility model, AWS Organizations and service control policies, compliance reporting through AWS Artifact, and account-level guardrails. Most candidates either already know this from working in a multi-account AWS environment or need to build it from scratch; there is not much middle ground.

Study in a sandbox, not just a browser tab

More than most certs, Security Specialty questions describe a configuration and ask what is wrong with it or what happens next. That is much easier to reason about after you have actually built the thing. A free-tier AWS account is enough to create an IAM policy with a condition key, trigger a GuardDuty finding against a test resource, and watch what shows up in CloudTrail. Reading about what a trust policy does and watching one fail in your own account teach different things, and the exam tests the second one.

How long to budget

For someone with real production AWS experience who is newer to the security side specifically, 8 to 12 weeks of steady study is realistic: enough time to work through every domain once, build a few hands-on scenarios, and sit two or three full-length practice exams under the real 170-minute clock. Compress it if you already operate AWS security day to day; extend it if you are learning core AWS services and security concepts at the same time, since stacking both is slower than it looks on paper.

The bottom line

This exam does not test whether you have read the documentation. It tests whether you can look at a described AWS environment and know what is actually protecting it, what is not, and what you would check first. Study the domains in proportion to their weight, build the muscle in a real account, and treat incident response as a sequence to memorize, not a service to describe.