What Is the AWS Security Specialty Certification?
The AWS Certified Security - Specialty is a professional-level credential aimed at individuals whose job is to secure AWS workloads. Rather than testing isolated facts, it validates the ability to design, implement, and troubleshoot security controls across a real AWS environment — from identity and access management to encryption and incident response.
AWS describes the target candidate as an experienced security practitioner with five years of IT security experience in designing and implementing security solutions, and two or more years of hands-on experience securing AWS workloads. The key word is hands-on: this exam rewards people who have actually built and defended systems, not those who have only memorized service definitions.
Key insight: Security is not a silo. Even engineers who don't hold a "security" title play a role in an organization's cloud security posture, and the credential's value extends well beyond dedicated security roles.
Why Security Expertise Matters Now
The business case for this certification has grown more urgent over the past several years. A widely cited University of Maryland study found that a cyber attack occurs roughly every 39 seconds — averaging more than 2,200 attacks per day. Global cybercrime costs were estimated at $9.5 trillion in 2024, a figure that continues to climb.
The breach headlines from a single recent year make the risk concrete:
| Incident | Impact |
|---|---|
| Dell Technologies data breach | A reported breach affecting approximately 49 million customer records |
| Microsoft email breach | State-linked attackers infiltrated Microsoft systems |
| UK Ministry of Defence breach | Hackers compromised the Ministry's payroll system |
The takeaway is not that every company gets breached, but that security is now a shared responsibility. An engineer who deploys a bastion host and leaves port 22 open, or who forgets to rotate a default credential, has created an entry point regardless of how good the organization's dedicated security team is. The Security Specialty credential is the structured way to close that gap.
Key insight: The certification is valuable even for cloud engineers and DevOps practitioners who don't work in a dedicated security role — the knowledge directly improves the security of the systems they build every day.
Exam Format
The structural mechanics of the exam are fixed and worth knowing before committing to a study plan.
| Detail | Value |
|---|---|
| Level | Specialty |
| Exam code | SCS-C03 (current) |
| Total questions | 65 (50 scored, 15 unscored) |
| Question types | Multiple choice and multiple response |
| Time limit | 170 minutes |
| Passing score | 750 / 1000 |
| Delivery | In-person at a testing center, or online via remote proctoring |
The 15 unscored questions are unlabeled and mixed in with the scored ones. They exist so AWS can evaluate potential future exam content without affecting candidate results — but there is no way to identify them during the test, so every question should be treated as if it counts.
Exam tip: A note on versions — AWS released SCS-C03 on December 2, 2025, replacing SCS-C02, which was last available on December 1, 2025. Candidates booking an exam in 2026 will sit SCS-C03. Much of the underlying security knowledge carries over between the two versions, but the domain structure was reorganized, so study materials should be checked against the current outline.
The Six Exam Domains
The current SCS-C03 exam is organized into six content domains. Understanding their weighting is the first step to allocating study time effectively.
| Domain | Weight | Core services and concepts |
|---|---|---|
| Detection | 16% | GuardDuty, Security Hub, Detective, CloudWatch, CloudTrail, VPC Flow Logs |
| Incident Response | 14% | Security Hub, GuardDuty, Detective, CloudTrail, incident response planning |
| Infrastructure Security | 18% | Security groups, network ACLs, AWS WAF, network edge services |
| Identity and Access Management | 20% | IAM, AWS Organizations, IAM Identity Center (SSO) |
| Data Protection | 18% | KMS, ACM, Secrets Manager, encryption at rest and in transit |
| Security Foundations and Governance | 14% | AWS Control Tower, AWS Config, AWS Artifact |
The restructured SCS-C03 outline split the previous "Threat Detection and Incident Response" domain into separate Detection and Incident Response domains, and renamed "Management and Security Governance" to Security Foundations and Governance. IAM and Infrastructure Security gained weighting in the new outline, reflecting how central identity and network controls are to modern cloud security.
Key insight: Identity and Access Management is now the single largest domain at 20%. A candidate who can reason precisely about IAM policies, roles, and multi-account access patterns enters the exam with a meaningful structural advantage.
Who Should Take This Exam?
This is a specialty-level credential, not a beginner path. AWS's own guidance describes a target candidate with substantial prior security and AWS experience, and attempting it as a first or second certification is generally a mistake.
Strong candidates typically have:
- A foundation credential such as Solutions Architect Associate or Developer Associate, which establishes the core AWS service knowledge the specialty exam assumes
- Hands-on experience securing workloads — configuring IAM, setting up VPC security controls, encrypting data, and working with monitoring and logging
- Real familiarity with the AWS security toolset, not just theoretical knowledge of service names
That said, the credential is not reserved for dedicated security engineers. Cloud engineers, DevOps engineers, and architects who touch IAM, networking, and data protection on a daily basis are well positioned — and the study process itself is valuable regardless of the exam outcome.
How to Prepare
AWS provides official resources — an exam guide, extensive security whitepapers, a free foundational course, and an enhanced course behind the AWS Skill Builder subscription (roughly $29/month). The free course is a useful orientation but at only a few hours of content it is unlikely to carry a candidate to a passing score on its own. Whitepaper reading alone is a similarly slow path for most people.
A more reliable preparation path follows a two-stage structure.
Stage 1: A Structured Online Course
The foundation is a single, well-chosen video course from a platform such as Coursera, Udemy, or Pluralsight. Selection criteria matter more than the platform:
- Strong reviews and a large number of students
- Substantial length rather than a short overview
- Quizzes and hands-on labs included
- An instructor whose pacing and delivery are easy to follow
Work through the course methodically — no skipped lessons, every lab completed, every quiz attempted. The hands-on exercises are where services like GuardDuty, KMS, and IAM become intuitive rather than memorized.
Stage 2: Multiple Practice Exams
Completing a course is necessary but not sufficient. No single course covers every angle of the exam, and none teaches the discipline of sitting a timed test.
- Take several full practice exams, not just one
- Review every question afterward, especially the ones answered incorrectly
- Understand why each wrong answer was wrong, so the same mistake doesn't recur on the real exam
Practice exams serve a second, equally important purpose: they teach time management. The real exam is stressful — many questions, limited time — and candidates who have never rehearsed under time pressure often fail not from lack of knowledge but from mismanaging the clock.
Key insight: The course builds understanding; the practice exams expose the gaps. Skipping the practice-exam phase is the single most common preparation mistake.
Exam-Day Time Management Tips
Specialty exam questions are frequently long and dense, so a systematic approach to each question saves minutes that add up across 65 items.
Read for keywords, not every word
Identify the key elements of the question first. If a question asks how to mitigate DDoS attacks, that phrase narrows the field immediately — services like Trusted Advisor and Amazon Inspector can be eliminated right away because they don't mitigate DDoS, leaving the answer that actually does (AWS Shield Advanced, in that scenario).
Eliminate obvious wrong answers first
Work through the options and discard the clearly incorrect ones as quickly as possible. This shrinks the decision from four options to two and speeds up the reasoning process significantly.
Use keywords to decode the scenario
A question about patching EC2 instances in a private subnet carries two signals: patching (Systems Manager Patch Manager) and private subnet (a NAT gateway, not an internet gateway, for outbound access). Recognizing both keywords leads to the correct combination without guessing.
Mark for review — sparingly
The exam allows flagging questions for later review. Use it for long questions that feel unclear, but don't overuse it: flagging too many questions creates a backlog that can't be cleared in the remaining time. Flag deliberately, and trust the elimination process for everything else.
Exam tip: Treat every question as scored. The 15 unscored questions are invisible, and time spent second-guessing whether a question "counts" is time lost.
Related Reading
- The Complete AWS Certification Roadmap for 2026
- Which AWS Certifications Will Get You Hired in 2026?
- AWS CloudOps Engineer Associate (SOA-C03): The SysOps Replacement Explained
Put the Concepts Into Practice
Reading about the Security Specialty domains builds familiarity, but retention comes from answering scenario-based questions under exam-like conditions — and correcting the gaps that surface along the way.
Start a free mock exam on Hiiragi — the adaptive engine tracks performance across security and AWS domains, surfaces weak areas automatically, and routes practice time toward what's actually missing before exam day.