AWS Certified Security – Specialty

What to Expect on the SCS-C03 Exam

SCS-C02 is 65 questions in 170 minutes — 50 scored, 15 unscored for AWS’s own data collection, though you won’t know which is which while you’re taking it. It’s multiple-choice and multiple-response, scored on a 100–1000 scale with 750 needed to pass. That math matters: you can miss a meaningful chunk of scored questions and still clear the bar, which changes how you should budget your time if you hit two or three questions in a row you’re unsure about.

The format candidates underestimate going in is how little straight recall AWS asks for. Most questions are scenario-based — a described architecture, an incident, or a compliance requirement, followed by “which combination of actions” or “which approach” satisfies it. You’re rarely asked to define a service; you’re asked to choose the right service, in the right configuration, for a specific constraint (lowest cost, least operational overhead, cross-account, hybrid environment). Several answer choices are often technically valid but wrong for the scenario’s actual constraint, which is where most wrong answers come from.

Domain Breakdown

Infrastructure Security carries the single largest weight, with Logging and Monitoring and Data Protection close behind — together those three domains are more than half the exam. Management and Security Governance is the newest domain (added when the exam moved from SCS-C01 to SCS-C02 in 2023) and covers AWS Organizations, Control Tower, and multi-account strategy — content a lot of candidates coming from single-account environments haven’t touched hands-on.

The Topics Candidates Consistently Underestimate

KMS key policies versus IAM policies. Candidates who are comfortable with IAM often assume the same mental model applies to KMS and get tripped up by key policies, grants, and how they interact with IAM permissions — especially in cross-account key sharing scenarios, which show up often.

Multi-account log aggregation. Understanding CloudTrail organization trails, centralized logging architectures, and how Security Hub aggregates findings across an AWS Organization is tested more deeply than most study guides suggest, and it’s genuinely confusing the first time you set it up yourself.

VPC-level network forensics. Reconstructing what happened during an incident from VPC Flow Logs, rather than just knowing Flow Logs exist, comes up repeatedly in Domain 1 and Domain 3 scenario questions.

SCPs versus IAM permission boundaries versus resource policies. These three mechanisms restrict access in different ways and at different layers, and the exam leans on scenarios where only one of them actually solves the stated problem.

How to Use Practice Tests Effectively for SCS-C03 Exam

Because SCS-C02 is scenario-heavy, drilling flashcard-style recall questions won’t get you far. When you miss a practice question here, the useful habit is to identify which other answer choices were plausible and work out specifically why they were wrong for that scenario — that’s closer to the actual decision-making the  exam demands than memorizing the correct answer alone.

Run practice sets by domain first, especially Infrastructure Security and Data Protection given their weight, before moving to full mixed-domain sets that simulate exam pacing. Since the  exam doesn’t tell you which 15 questions are unscored, build the habit of not letting one hard question rattle your pace — at roughly 2.5 minutes per question, getting stuck early is how people run out of time on the last ten.

Common Mistakes That Cause Retakes

Treating Governance (14%) as a low-priority domain because it’s one of the smaller weights, then losing easy points on Organizations and Control Tower questions that have a clear right answer if you’ve actually configured them.

Studying services in isolation instead of how they interact — GuardDuty findings feeding into Security Hub, which triggers EventBridge rules, which invoke Lambda for remediation. The exam tests these pipelines together, not each service as a standalone fact.

Underestimating encryption depth. “AWS supports encryption at rest” is not enough — candidates get caught out by questions on envelope encryption, customer-managed versus AWS-managed KMS keys, and cross-region/cross-account key usage.

SCS-C03 Study Timeline by Starting Experience Level

New to AWS security specifically (but has general AWS experience): 8–10 weeks, with the first few weeks spent getting hands-on with IAM, KMS, and GuardDuty in a sandbox account rather than just reading about them.

Has production security experience on AWS already: 4–6 weeks, focused mainly on the domains least likely to come up in day-to-day work — Governance and cross-account logging architectures tend to be the gaps even for experienced engineers.

Retaking after a failed attempt: 2–4 weeks, built around reviewing which domains the score report flagged as weak (AWS gives a pass/fail breakdown by domain) rather than restudying everything from scratch.