AWS Security Specialty SCS-C03 Exam: Retired SCS-C02 Guide

AWS Security Specialty study guide, retired SCS-C02 — hero

SCS-C02 is retired: its last day was December 1, 2025. The AWS Security Specialty exam is now SCS-C03, with 65 questions in 170 minutes, a passing score of 750 out of 1,000 and a price of USD 300 (JPY 40,000 in Japan). If you search for SCS-C02 study material today, study for SCS-C03 instead.

The AWS certification hub lists every AWS exam guide and practice app.

Most C02 topics carry over, but the domains are reorganized and C03 adds GenAI guardrails and ordering and matching items. This page keeps the SCS-C02 guide for reference and lists what changed below. Exam facts are from the AWS pages under Sources, checked October 15, 2026.

The StudyKits Security Specialty app’s question bank follows SCS-C02 and has not been updated for SCS-C03.

SCS-C02 was retired: what should you study now?

Study from the SCS-C03 exam guide. Its six domains and weights:

SCS-C03 domain	Weight	Closest SCS-C02 domain (weight)
Detection	16%	Threat Detection and Incident Response (14%) and Security Logging and Monitoring (18%)
Incident Response	14%	Threat Detection and Incident Response (14%)
Infrastructure Security	18%	Infrastructure Security (20%)
Identity and Access Management	20%	Identity and Access Management (16%)
Data Protection	18%	Data Protection (18%)
Security Foundations and Governance	14%	Management and Security Governance (14%)

What C03 adds: GenAI guardrails (OWASP Top 10 for LLM applications), OCSF and third-party WAF integrations, in-transit encryption between nodes (EMR, EKS, SageMaker AI, Nitro), data masking in CloudWatch Logs and SNS, and multi-Region keys and Private CA.

What C03 removes includes: ASFF, host-based firewalls, TCP/IP fundamentals, Reachability Analyzer, TLS concepts, S3 static website hosting, the AWS Security Incident Response Guide, log formats, policy components and cross-Region VIFs (see Appendix B of the SCS-C03 exam guide).

New item types: ordering and matching, alongside multiple choice and multiple response. For more detail, read our SCS-C03 exam update.

What was the SCS-C02 exam format?

The SCS-C02 replaced the SCS-C01 and was the AWS Security Specialty exam until December 1, 2025 (SCS-C03 since December 2, 2025). It tests your ability to design, implement, and troubleshoot security solutions in AWS environments. You need a scaled score of 750 out of 1000 to pass. The exam has 65 questions (50 scored + 15 unscored) and you get 170 minutes to complete it.

Plan for solid IT security experience and hands-on time securing AWS workloads. Candidates with strong associate-level knowledge and dedicated preparation can manage with less.

The exam cost USD 300, the same as SCS-C03 today.

Who should take the Security Specialty exam?

The Security Specialty is ideal for security engineers, security architects, cloud security analysts, and anyone whose role involves securing AWS environments. It sits at the specialty level in the AWS certification path, which means it is not tied to a specific associate or professional prerequisite, but an associate-level certification first is a sensible step.

It is especially relevant in regulated industries such as finance, healthcare and government.

What were the six SCS-C02 domains?

AWS organized the SCS-C02 exam into six domains. Each domain has a specific weight, and understanding these weights is critical for allocating your study time.

Domain 1: Threat Detection and Incident Response (14%)

This domain tests your ability to detect threats and respond to security incidents in AWS. While it carries one of the lowest weights, the questions tend to be scenario-heavy and require deep understanding of how detection services work together.

Key services and concepts to master:

Amazon GuardDuty — understand finding types, severity levels, suppression rules, and how GuardDuty integrates with EventBridge for automated response. Know the difference between GuardDuty findings for EC2, S3, IAM, and Kubernetes workloads.
AWS Security Hub — know how Security Hub aggregates findings from GuardDuty, Inspector, Macie, and third-party tools. Understand compliance standards like CIS AWS Foundations Benchmark and AWS Foundational Security Best Practices.
Amazon Detective — understand when to use Detective for root cause analysis versus GuardDuty for detection.
AWS CloudTrail — management events vs data events, CloudTrail Lake for querying, organization trails, log file integrity validation.
Amazon CloudWatch — metric filters, alarms, anomaly detection, and how to create custom metrics for security monitoring.
Incident response automation — using EventBridge rules to trigger Lambda functions or Step Functions for automated remediation. Know how to isolate a compromised EC2 instance by modifying security groups programmatically.

Study tip: build a mental flowchart for incident response. When a GuardDuty finding fires, what happens next? How does it flow through Security Hub, trigger EventBridge, invoke Lambda, and create a notification in SNS?

Domain 2: Security Logging and Monitoring (18%)

This domain focuses on designing and implementing logging solutions that give you visibility into your AWS environment.

Key areas to study:

Centralized logging architecture — sending CloudTrail, VPC Flow Logs, DNS logs, and application logs to a central S3 bucket or CloudWatch Logs group in a security account.
VPC Flow Logs — understand the log format, the difference between accepted and rejected traffic, and how to analyze flow logs with Athena.
AWS Config — managed rules vs custom rules, conformance packs, remediation actions, multi-account aggregation with AWS Organizations.
Amazon Macie — discovering and protecting sensitive data in S3, custom data identifiers, automated classification.
S3 access logging and server access logs — know when to use S3 server access logging vs CloudTrail data events for S3.
Cross-account log delivery — resource policies for CloudWatch Logs destinations, S3 bucket policies for cross-account delivery, and KMS key policies for encrypted logs.

The exam frequently asks about scenarios where you need to prevent log tampering. Understand S3 Object Lock, CloudTrail log file integrity validation, and how to use separate accounts for log storage.

Domain 3: Infrastructure Security (20%)

This domain tests your ability to secure the network and compute layers of your AWS architecture.

Critical services and concepts:

VPC security — security groups vs NACLs, the stateful vs stateless distinction, VPC endpoints (interface vs gateway), PrivateLink, and VPC peering security considerations.
AWS WAF — web ACLs, managed rule groups, rate-based rules, custom rules with regex patterns, and WAF logging to S3 or CloudWatch. Know how to block SQL injection and XSS attacks.
AWS Shield — Standard vs Advanced, DDoS response team, cost protection, and how Shield integrates with CloudFront, ALB, and Route 53.
AWS Firewall Manager — centralized management of WAF rules, security groups, and Shield Advanced across an organization.
AWS Network Firewall — stateful and stateless rule groups, domain filtering, intrusion prevention, and deployment models (centralized vs distributed).
Amazon CloudFront security — origin access control (OAC), field-level encryption, signed URLs and cookies, geo-restriction, and TLS/SSL configuration.
Systems Manager — Session Manager for bastion-less access, Patch Manager for compliance, and Parameter Store vs Secrets Manager.

Expect questions that combine multiple services. For example, a scenario might describe a web application that needs protection against DDoS attacks, SQL injection, and unauthorized API access, and you need to choose the right combination of Shield, WAF, and API Gateway configurations.

Domain 4: Identity and Access Management (16%)

IAM is the foundation of AWS security, and the questions on this domain go deep.

What you must know:

IAM policy evaluation logic — the complete flow from explicit deny to organizational SCPs to resource-based policies to identity-based policies to permissions boundaries. Understand how these layers interact and when each one applies.
IAM roles — cross-account access with sts:AssumeRole, service-linked roles, instance profiles, and the confused deputy problem.
AWS Organizations and SCPs — how SCPs restrict permissions across member accounts, the difference between deny lists and allow lists, and how SCPs interact with IAM policies.
AWS IAM Identity Center (SSO) — SAML 2.0 federation, SCIM provisioning, permission sets, and multi-account access.
Amazon Cognito — user pools vs identity pools, authentication flows, custom authentication challenges, and securing API Gateway with Cognito authorizers.
Permissions boundaries — how they limit the maximum permissions an IAM entity can have, and the common use case of delegated administration.
Resource-based policies — S3 bucket policies, KMS key policies, Lambda resource policies, and how they differ from identity-based policies (especially for cross-account access).

Study tip: the exam loves policy evaluation questions. Practice reading JSON policies and determining what is allowed or denied. Pay special attention to condition keys like aws:SourceIp, aws:PrincipalOrgID, and aws:RequestedRegion.

Domain 5: Data Protection (18%)

Data protection covers encryption, key management, and data classification.

Key services and concepts:

AWS KMS — this is the single most important service for this domain. Understand symmetric vs asymmetric keys, key policies, grants, key rotation (automatic and manual), imported key material, multi-Region keys, and the difference between AWS managed keys and customer managed keys. Know when to use KMS vs CloudHSM.
AWS CloudHSM — dedicated hardware security modules, FIPS 140-2 Level 3 compliance, CloudHSM clusters, and integration with KMS custom key stores.
Encryption at rest — S3 encryption options (SSE-S3, SSE-KMS, SSE-C, client-side encryption), EBS encryption, RDS encryption, DynamoDB encryption, and the default encryption behavior for each service.
Encryption in transit — TLS/SSL, ACM certificate management, enforcing HTTPS with S3 bucket policies and CloudFront, and database connection encryption.
AWS Secrets Manager — automatic secret rotation with Lambda, cross-account secret sharing, and the difference between Secrets Manager and Parameter Store.
AWS Certificate Manager (ACM) — public vs private certificates, automatic renewal, and integration with ALB, CloudFront, and API Gateway.
S3 security — bucket policies, access points, S3 Block Public Access, presigned URLs, and cross-Region replication with encryption.

The exam will test edge cases around KMS. For example, what happens when you try to use a KMS key from a different Region? How do you grant cross-account access to an encrypted S3 bucket? What is the difference between the key policy and IAM policy when controlling access to a KMS key?

Domain 6: Management and Security Governance (14%)

This domain covers multi-account governance and compliance: AWS Organizations and service control policies, AWS Control Tower, AWS Config rules and conformance packs, AWS Audit Manager, AWS Artifact, and evaluating architectures against security and compliance requirements.

Which five services matter most?

IAM: The Foundation

IAM appears in almost every question on the exam, whether explicitly or implicitly. You need to understand policy structure at a granular level: Effect, Action, Resource, Condition. Master the policy evaluation flowchart. Know the difference between identity-based policies, resource-based policies, permissions boundaries, SCPs, and session policies. Practice writing policies from scratch and debugging policies that do not work as expected.

KMS: The Encryption Backbone

KMS is the second most tested service. The exam expects you to know key types, key policies (including the default key policy that gives the root account full access), how grants work for temporary access, and the envelope encryption process. Understand how KMS integrates with every other AWS service that supports encryption at rest.

GuardDuty: The Threat Detective

GuardDuty is your primary threat detection service. Know its data sources (CloudTrail management events, CloudTrail S3 data events, VPC Flow Logs, DNS logs, EKS audit logs, and Lambda network activity logs). Understand how to enable it across an organization using delegated administrator, how to manage findings, and how to suppress false positives.

Security Hub: The Aggregator

Security Hub pulls findings from GuardDuty, Inspector, Macie, Firewall Manager, and third-party tools into a single dashboard. Understand how to enable security standards, how findings are normalized using AWS Security Finding Format (ASFF), and how to create custom actions with EventBridge.

WAF: The Application Shield

AWS WAF protects your web applications from common exploits. Know how to create web ACLs, use managed rule groups (like the AWS Managed Rules for common threats), write custom rules, and analyze WAF logs. Understand the integration points: CloudFront, ALB, API Gateway, and AppSync.

How should you plan your study?

Prerequisites

Before starting your SCS-C02 preparation, you should have:

AWS Solutions Architect Associate (SAA-C03) or equivalent knowledge
Hands-on experience with IAM, VPC, S3, and CloudTrail
Basic understanding of encryption concepts and networking

If you do not have these prerequisites, spend 2-3 weeks building your foundation first.

The 8-Week Study Plan

Weeks 1-2: Identity and Access Management Focus entirely on IAM. Read every page of the IAM documentation. Practice writing policies. Set up cross-account access with roles. Configure IAM Identity Center. Work through permissions boundaries and SCPs.

Weeks 3-4: Data Protection and Encryption Deep dive into KMS. Create customer managed keys, set up key rotation, practice cross-account key sharing. Implement encryption for S3, EBS, RDS, and DynamoDB. Set up Secrets Manager with automatic rotation.

Weeks 5-6: Infrastructure Security and Logging Configure VPC security layers. Set up WAF with custom rules. Deploy Network Firewall. Implement centralized logging with CloudTrail, VPC Flow Logs, and Config. Set up cross-account log delivery.

Weeks 7-8: Threat Detection, Review, and Practice Enable GuardDuty and Security Hub. Build automated incident response with EventBridge and Lambda. Take full-length practice exams. Review weak areas.

Daily Study Routine

Dedicate 1.5 to 2 hours per day:

30 minutes reading documentation or watching videos
30 minutes hands-on labs in your AWS account
30 minutes answering practice questions
Review explanations for both correct and incorrect answers

How should you practise?

Practice questions are one of the most useful study tools for this exam. The exam is scenario-based, and you need to develop the ability to quickly identify the key requirements in a scenario and map them to the right AWS services.

Work through questions daily, using material written for SCS-C03. Start with 20 questions per day in weeks 1-4, then increase to 40-50 questions per day in weeks 5-8. Pay close attention to the explanations — they often teach you nuances that documentation alone does not cover.

Our rule of thumb: when you consistently score 80% or more on fresh practice questions, with no domain below 70%, you are ready to schedule your exam.

What should you do on exam day?

Read each question carefully. The exam uses long scenario-based questions, and the correct answer often depends on a single detail in the scenario.
Flag difficult questions and come back to them. You have 170 minutes, which is more generous than the associate exams.
Eliminate obviously wrong answers first. Most questions have two clearly wrong options and two plausible options.
When two answers seem correct, look for the one that is most secure AND most operationally efficient. AWS rarely wants you to choose the most complex solution.
Watch for keywords like “least privilege,” “least operational overhead,” “most cost-effective,” and “automated” — these are hints about what AWS considers the best answer.

What comes after the Security Specialty?

The Security Specialty pairs well with other certifications. If you want to deepen your AWS expertise, consider the Solutions Architect Professional next (SAP-C03 replaces SAP-C02 on November 17, 2026). If you are interested in operations, look into the CloudOps Engineer - Associate (SOA-C03).

For a complete view of how the Security Specialty fits with the other AWS certifications, check out our AWS Certification Path 2026 guide.

How should you prepare for SCS-C03 now?

Use the current SCS-C03 exam guide as your map, build hands-on experience with each service it lists, and practise scenario questions written for C03.

The StudyKits Security Specialty app follows the SCS-C02 guide. It does not cover the C03 additions, such as GenAI guardrails and the ordering and matching items.

Frequently asked questions

Can I still take SCS-C02?

No. Its last day was December 1, 2025. The current exam is SCS-C03.

How much does the SCS-C03 exam cost?

USD 300. In Japan it is JPY 40,000.

What is the SCS-C03 passing score?

750 on a scale of 100-1,000.

Is my SCS-C02 certification still valid?

Yes, for 3 years from the date you earned it. AWS certifications are valid for 3 years.

Which SCS-C03 language versions are ending?

Simplified Chinese, Spanish (Latin America) and Portuguese (Brazil) are retired after December 31, 2026. English, Japanese and Korean continue.

Keep reading

SAA-C03 Study Guide: AWS Solutions Architect – Associate

Sources

Checked October 15, 2026:

AWS Security Specialty Study Guide: Retired SCS-C02 (Exam Now SCS-C03)