AWS SCS-C03 Security Specialty guide for detection, incident response, infrastructure security, IAM, data protection, governance, audit evidence, and security trade-off decisions.
This AWS Certified Security - Specialty guide is for candidates who secure AWS workloads and need to reason across detection, response, identity, infrastructure, data protection, and governance. SCS-C03 is not just an IAM exam and not just a list of security services. It tests whether you can choose controls that meet the stated threat, evidence, cost, and operational constraints.
The current exam version also expects more than single-answer recognition. AWS lists multiple choice, multiple response, ordering, and matching question types for SCS-C03, so the guide emphasizes sequencing, control mapping, and close-answer elimination.
| Item | Guide value |
|---|---|
| Vendor | AWS |
| Exam or credential | AWS Certified Security - Specialty |
| Code or shorthand | SCS-C03 |
| Study level | Specialty security |
| Official role target | People responsible for securing cloud solutions on AWS. |
| Official experience cue | AWS describes the target candidate as having the equivalent of 3-5 years of experience securing cloud solutions. |
| Guide shape | Start-here page, study plan, cheat sheet, sample questions, FAQ, resources, and glossary. |
As of May 17, 2026, the current AWS SCS-C03 exam guide lists six scored domains:
| Official domain | Weight | What this guide emphasizes |
|---|---|---|
| 1. Detection | 16% | Monitoring, alerting, logging, findings, centralized telemetry, and troubleshooting missing signals. |
| 2. Incident Response | 14% | Prepared runbooks, evidence preservation, containment, recovery, automation, and root-cause analysis. |
| 3. Infrastructure Security | 18% | Edge controls, compute workload protection, network segmentation, inspection, and secure administration. |
| 4. Identity and Access Management | 20% | Authentication, authorization, federation, IAM policy evaluation, SCPs, permission boundaries, and cross-account access. |
| 5. Data Protection | 18% | Data-in-transit controls, data-at-rest controls, KMS, CloudHSM, secrets, retention, and key material. |
| 6. Security Foundations and Governance | 14% | Organizations, Control Tower, deployment consistency, Config, Security Hub, Audit Manager, and compliance evidence. |
AWS describes the exam as validating specialized data classification, encryption, secure internet protocols, production security services, trade-off decisions across cost/security/complexity, and security operations risk. Treat that as the boundary: this guide should help you choose and sequence controls, not memorize every AWS security product name.
| Lane | What to master | Common weak answer |
|---|---|---|
| Detection and evidence | Build signal paths with CloudTrail, GuardDuty, Security Hub, Security Lake, CloudWatch, VPC Flow Logs, Config, Macie, and alert routing. | Enabling a service without centralization, retention, correlation, or response ownership. |
| Response sequencing | Prepare runbooks, validate findings, collect evidence, contain scope, eradicate the cause, recover safely, and document follow-up. | Deleting or rebuilding resources before evidence capture and scope validation. |
| Infrastructure controls | Match WAF, Shield, Network Firewall, security groups, NACLs, Verified Access, Inspector, Session Manager, and endpoint controls to the actual path. | Applying a familiar control at the wrong layer or on traffic it cannot see. |
| IAM evaluation | Separate authentication from authorization, then account for trust policies, identity policies, resource policies, SCPs, permission boundaries, session policies, and KMS key policies. | Reading one Allow statement and ignoring an explicit deny or policy intersection. |
| Data protection | Choose the right layer for TLS, KMS, CloudHSM, Secrets Manager, Object Lock, backup, classification, rotation, and key-material control. | Saying “encrypt it” without naming the storage, transport, key, retention, or access boundary. |
| Governance | Use Organizations, Control Tower, delegated administration, Config, Security Hub, Firewall Manager, Audit Manager, and IaC to keep controls consistent. | Fixing one account manually when the requirement is organization-wide prevention or proof. |
Most SCS-C03 scenarios sit somewhere in this loop.
flowchart LR
T["Threat, requirement, or finding"] --> C["Choose preventive control"]
C --> E["Collect evidence"]
E --> A["Analyze, alert, and prioritize"]
A --> R["Respond and contain"]
R --> P["Protect data and identities"]
P --> G["Govern, audit, and improve"]
G --> T
If an answer skips evidence, the design may not be auditable. If it skips governance, the fix may not scale across accounts. If it skips identity or data protection, detection alone will not reduce risk.
| Scenario pressure | Strong SCS-C03 reasoning |
|---|---|
| A finding appears in one account | Validate the source, centralize findings, inspect related logs, scope the blast radius, and route a response workflow. |
| Access is unexpectedly denied or allowed | Trace authentication, trust, explicit denies, policy intersections, SCPs, boundaries, resource policies, and KMS key policy. |
| Public application is attacked | Separate HTTP-layer controls, DDoS protection, origin protection, logging, and incident response. |
| Sensitive data must be protected | Identify classification, storage location, transport path, key ownership, retention, backup, and audit evidence. |
| Multi-account security drifts | Move the control to Organizations, Control Tower, Firewall Manager, Config, Security Hub, StackSets, or delegated administration. |
| Incident response must be automated | Use a tested runbook, scoped permissions, EventBridge or Security Hub integration, evidence preservation, and human checkpoints when blast radius is high. |
Use this sequence if you are building the guide from scratch:
Security Specialty answers usually combine identity evaluation, data protection, telemetry, containment, and proof. Before choosing a service, name the security job: prevent, detect, preserve evidence, contain, encrypt, authorize, govern, or prove compliance. The wrong answer often does the right job at the wrong layer.
| Trap | Better exam posture |
|---|---|
| Treating Security Hub as raw log storage | Use Security Hub for findings aggregation and posture; use log services, Security Lake, S3, Athena, or SIEM paths for raw log analysis. |
| Fixing IAM by adding another Allow | Check explicit deny, SCPs, permission boundaries, session policies, resource policies, trust policy, and KMS key policy first. |
| Deleting compromised resources immediately | Preserve evidence, snapshot where appropriate, isolate scope, then eradicate and recover. |
| Using WAF for every network threat | Match WAF to HTTP-layer controls; use Shield, Network Firewall, security groups, NACLs, endpoint controls, or architecture changes where they fit better. |
| Saying “KMS solves data protection” | Confirm key policy, grants, cross-account access, rotation, storage-layer integration, backups, retention, and data-in-transit controls. |
| Manual security fixes in each account | Use Organizations, delegated administration, Control Tower, Firewall Manager, Config, StackSets, or IaC when the requirement is scale. |
Use the current AWS exam page for live exam details, including name, status, pricing, duration, delivery method, languages, retirement or beta changes, question types, and domain weights where applicable. This guide follows the official SCS-C03 domain model and uses the local chapter pages as the teaching sequence.