AWS SCS-C03 exam guide covering IAM, logging, encryption, threat detection, and incident response decisions.
This AWS Certified Security - Specialty guide helps SCS-C03 candidates focus on what the exam tests, where close answers usually split, and which review page to use next.
Use the study plan to organize AWS service areas by scenario, the cheat sheet for fast recall, the sample questions for explanation-heavy practice, the FAQ for scope checks, the resources page for AWS service references, and the glossary when service names blur together.
| Item | Guide value |
|---|---|
| Vendor | AWS |
| Exam or credential | AWS Certified Security - Specialty |
| Code or shorthand | SCS-C03 |
| Study level | Specialty security |
| IT Mastery page | SCS-C03 exam page |
| Guide shape | Start-here page, study plan, cheat sheet, sample questions, FAQ, resources, and glossary. |
| Lane | What to master | Common weak answer |
|---|---|---|
| Identity and access | Resolve IAM policy, resource policy, SCP, permission boundary, session policy, and federation behavior. | Stopping at an Allow statement while an explicit deny, SCP, boundary, or key policy still blocks access. |
| Logging and detection | Use CloudTrail, CloudWatch, GuardDuty, Security Hub, Config, VPC Flow Logs, and alert routing. | Turning on logs without retention, analysis, notification, or response. |
| Data protection | Apply KMS, encryption, secrets, S3 controls, backup, retention, and classification requirements. | Forgetting KMS key policy or cross-account decrypt permissions. |
| Network and infrastructure security | Secure VPC paths, endpoints, security groups, NACLs, WAF, Shield, and private connectivity. | Using public paths when private endpoint or scoped network access is required. |
| Incident response and governance | Contain compromised credentials, isolate resources, preserve evidence, and automate remediation. | Destroying evidence or rotating the wrong credential first. |
Security Specialty answers usually combine identity evaluation, data protection, telemetry, containment, and proof.
Use the current AWS exam page for live exam details, including name, status, pricing, duration, delivery method, languages, retirement or beta changes, and domain weights where applicable.