SCS-C03 Exam Guide: Format, Cost, Domains, and How to Prepare

The AWS Certified Security – Specialty (SCS-C03) is the current version of the security specialty — it replaced SCS-C02 on December 2, 2025. It validates deep security expertise across detection, incident response, infrastructure protection, IAM, data protection, and governance.

Compared to SCS-C02, the new version reorganized domains: detection and incident response are now separate domains, IAM grew to 20%, and the governance domain was reframed as Security Foundations and Governance.

Exam format at a glance

• 65 questions — long scenario-based multiple choice and multiple response
• 170 minutes — about 2.6 minutes per question
• $300 USD
• Passing score: 750 on a scaled range of 100–1000
• Pearson VUE testing center or online proctored exam

The six domains

• Domain 1: Detection — 16% (GuardDuty, Security Hub, detection-focused logging)
• Domain 2: Incident Response — 14% (IR plans, isolation, forensics, credential compromise)
• Domain 3: Infrastructure Security — 18% (VPC security, WAF/Shield, edge protection)
• Domain 4: Identity and Access Management — 20% (the largest — policy evaluation, federation, boundaries)
• Domain 5: Data Protection — 18% (KMS, envelope encryption, secrets, certificate management)
• Domain 6: Security Foundations and Governance — 14% (SCPs, multi-account security baselines)

What the exam actually tests

SCS-C03 rewards precise security reasoning: which finding source detects a given anomaly (GuardDuty vs Inspector vs Macie vs Config), how to respond to a compromised credential, how envelope encryption actually works, which IAM policy construct (SCP vs permission boundary vs resource policy vs session policy) enforces a given constraint.

The split between Detection (domain 1) and Incident Response (domain 2) matters: know the difference between generating a finding and executing a response runbook — GuardDuty/Security Hub vs SSM Incident Manager/IR workflows.

A realistic prep plan

Budget 8–10 weeks — this is a specialty exam and assumes real security experience. IAM is the heaviest domain and the most frequently failed: practice reading policy documents until evaluation logic is reflexive.

• Weeks 1–2: Domain 4 (IAM) — policies, boundaries, SCPs, federation, cross-account access
• Week 3: Domain 5 (Data Protection) — KMS internals, envelope encryption, CloudHSM, secrets rotation
• Week 4: Domains 1–2 — GuardDuty/Security Hub/Detective, IR playbooks, forensics
• Week 5: Domain 3 — WAF/Shield/Network Firewall, VPC security layers, edge protection
• Week 6: Domain 6 — Organizations governance, security baselines, compliance tooling
• Final weeks: long timed sets — this exam's scenarios are dense