Domain 116% of the exam
Detection
- Monitoring and alerting across an organization: GuardDuty, Security Hub, Detective
- Logging: CloudTrail organization trails, VPC Flow Logs, centralized log accounts
- Troubleshooting missing logs and alerts
← All study guides
SCS-C03 · Free study guide
AWS Certified Security · Specialty
Deep security on AWS: detection, incident response, network and compute protection, identity, data protection and governance across an organization.
- Questions
- 65 (50 scored)
- Time
- 170 minutes
- Passing score
- 750 / 1000
- Level
- Specialty
What the exam covers
Domains and key topics
Domain 214% of the exam
Incident Response
- Designing and testing an incident response plan
- Containment: isolating instances, revoking credentials, preserving evidence
- Automating response with EventBridge and Lambda
Domain 318% of the exam
Infrastructure Security
- Edge protection: CloudFront, AWS WAF, Shield Advanced
- Securing compute: Inspector, Systems Manager, hardened images
- Network controls: security groups, network ACLs, Network Firewall, VPC endpoints
Domain 420% of the exam
Identity and Access Management
- Authentication: IAM Identity Center, federation, Cognito, MFA
- Authorization: policy evaluation, permission boundaries, SCPs, resource policies
- Troubleshooting access denied errors
Domain 518% of the exam
Data Protection
- Data in transit: TLS, ACM, private connectivity
- Data at rest: KMS key policies, grants, multi-Region keys, CloudHSM
- Secrets and key material: Secrets Manager rotation, Macie for sensitive data
Domain 614% of the exam
Security Foundations and Governance
- Central account management with Organizations and Control Tower
- Secure, consistent deployments with infrastructure as code
- Evaluating compliance with AWS Config, Audit Manager and Artifact
Know these well
Key AWS services
AWS IAM & IAM Identity Center
Identities, policies and federation.
AWS KMS & CloudHSM
Keys, key policies and hardware security modules.
Amazon GuardDuty
Threat detection.
AWS Security Hub
Findings and standards in one place.
Amazon Detective
Investigate the root cause of findings.
AWS CloudTrail
Who did what, and when.
AWS WAF, Shield & Network Firewall
Protection at the edge and in the VPC.
Amazon Macie
Find sensitive data in S3.
AWS Secrets Manager
Store and rotate secrets.
AWS Config & Audit Manager
Compliance rules and audit evidence.
How to prepare
A simple study plan
- 1Read the official exam guide, including the SCS-C02 to SCS-C03 comparison.
- 2Learn IAM policy evaluation until you can predict any allow or deny.
- 3Spend the most time on domain 4 (20%): identity and access management.
- 4Walk through an incident from detection to containment with the right service at each step.
- 5Take a timed practice exam and review every explanation, right and wrong.
Always check the official SCS-C03 exam guide ↗ for the current version of the exam.
Preparing for more than one exam?
Every AWS certification has a free study guide here, from Foundational to Specialty.