AWS Security Specialty Certification Guide

Full guide to the AWS Certified Security – Specialty exam: current SCS-C03 version, format, cost, what changed from SCS-C02, and how to prepare.

Daniel Carter20 August 2026 · 9 min read

Ask AIChatGPT Claude Gemini Copilot Perplexity Grok

Layered cloud security elements forming an AWS Security Specialty certification badge

The AWS Certified Security – Specialty is Amazon Web Services' dedicated security certification, aimed at engineers who secure workloads, data and identities on AWS. If you searched for the SCS-C02 exam, note the version change first: SCS-C02 was available until 1 December 2025, and the current exam as of 2026 is SCS-C03. Everything in this guide reflects the SCS-C03 version — 65 questions, 170 minutes, $300 USD, and a scaled passing score of 750.

This article is the exam reference itself: version status, format, cost, registration, renewal and a preparation plan. If your real question is whether to take this certification or CompTIA Security+, that cross-provider decision has its own dedicated article on AWS Security Specialty vs Security+.

SCS-C03 exam at a glance

Detail	AWS Certified Security – Specialty (SCS-C03)
Provider	Amazon Web Services (AWS)
Level	Specialty
Questions	65 (multiple choice and multiple response)
Time allowed	170 minutes
Cost	$300 USD as of 2026 (varies by country/region — confirm on AWS's exam pricing page)
Passing score	750 on a scaled range of 100–1000
Prerequisites	None — experience recommendations only
Languages	Offered in 6 languages
Delivery	Pearson VUE test centre or online proctoring
Validity	3 years

Two details in that table deserve emphasis because candidates routinely get them wrong. First, there are no formal prerequisites: AWS does not require any Associate certification before a Specialty exam, so a security engineer can sit SCS-C03 directly. Second, the 750 passing score is a scaled figure, not a percentage. AWS converts your raw performance onto a 100–1000 scale, which means you cannot translate 750 into "75% of questions correct" — the conversion accounts for varying question difficulty across exam forms.

SCS-C02 or SCS-C03 — which version will you sit?

Short answer: SCS-C03. The SCS-C02 exam could be booked until 1 December 2025; since then, all new bookings are for SCS-C03. As of August 2026, SCS-C03 is the only live version, so any "SCS-C02 study guide" you rely on needs checking against the current exam guide before you trust its domain breakdown.

According to AWS's announcement of the update, SCS-C03 made two notable changes to the exam's scope:

Generative AI and machine learning security coverage was added. Securing AI workloads is now part of the exam's remit, reflecting how quickly those services have entered production environments.
The domains were restructured, with dedicated sections for threat detection and incident response rather than folding those topics into broader domains.

If you hold a certification earned under SCS-C02, it remains valid for its full three years. Version updates never invalidate existing certifications — but when your renewal window arrives, you will recertify against whatever version is current.

What the AWS Security Specialty exam tests

AWS publishes the authoritative domain list and weightings in the official SCS-C03 exam guide, and that document — not any third-party summary — should anchor your study plan. Download it from the AWS Certified Security – Specialty page before you build a schedule, because domain weightings tell you where your marks actually come from.

In practical terms, the certification validates the work of a cloud security engineer: designing and operating security controls across AWS environments. Based on the exam's published scope, expect your preparation to revolve around themes such as:

Identity and access management — the policies, roles, permission boundaries and federation patterns that govern who can do what. AWS Identity and Access Management (IAM) is the connective tissue of nearly every security question, because almost every scenario turns on whether access was correctly scoped.
Data protection — encryption at rest and in transit, and key management. AWS Key Management Service (KMS) design decisions — key policies, grants, rotation, cross-account access — are classic Specialty-level territory.
Threat detection and incident response — now carrying dedicated domain sections in SCS-C03. This covers recognising compromise indicators, investigating using logs and telemetry, and containing and remediating incidents in a cloud environment.
Logging, monitoring and infrastructure security — building the audit trail, alerting on it, and hardening the network and compute layers that workloads run on.
Security of AI/ML workloads — the SCS-C03 addition. If your day job has not touched generative AI services yet, budget study time here; it is new material for most candidates.

A useful mental model: Associate-level AWS exams ask "which service does X?", while the Security Specialty asks "this environment was configured in this specific way — what is the vulnerability, and what is the least-privilege fix?" The questions are scenario-driven, and the wrong answers are usually plausible configurations that are merely weaker, more permissive or more operationally expensive than the best one.

How hard is the question format itself?

Mechanically, SCS-C03 uses only multiple choice and multiple response — no labs, and none of the newer ordering, matching or case-study question types that AWS introduced on its AI-focused exams. The difficulty comes from scenario length and answer similarity, not exotic formats. With 65 questions in 170 minutes, you have roughly two and a half minutes per question, which is more generous than the Associate exams — a signal that AWS expects you to read long scenarios carefully rather than race.

Requirements and recommended experience

The formal requirement list is empty: no prerequisite certifications, no mandated training, no minimum experience. That said, "no prerequisites" does not mean "no preparation baseline". This is a Specialty exam, and AWS pitches it at people with genuine security depth. You will struggle if you cannot already:

Read and debug an IAM policy document, including condition keys and explicit denies.
Explain how encryption is applied and managed across the storage and data services you use.
Trace an event through logging services to answer "who did this, from where, and when?".
Reason about network segmentation, ingress and egress controls in a VPC-based architecture.

If most of that list feels unfamiliar, an Associate-level certification is a gentler on-ramp even though it is not required — the amazon exams hub lists the full AWS line-up if you want to survey the options below Specialty level.

Registration, cost and logistics

Booking follows the standard AWS process:

Sign in to your AWS Certification account via the AWS Training and Certification portal.
Choose AWS Certified Security – Specialty (SCS-C03) and pick a delivery method: a Pearson VUE test centre, or online proctoring from home or an office.
Pay the exam fee — $300 USD as of 2026. Prices in local currency, plus any applicable taxes, vary by country and region, so confirm the exact figure at checkout or on AWS's pre-testing policies page.
If testing online, run the system check on the machine you will use, and prepare a quiet, private room; online proctoring has strict environment rules.

Two cost notes worth knowing. If you already hold any active AWS certification, you receive a 50% discount voucher for your next exam — which halves this exam's effective cost for anyone upgrading from an Associate. And if you fail, you pay the full fee again to retake, which is a strong argument for benchmarking your readiness before you book rather than treating the first attempt as reconnaissance.

How to prepare for SCS-C03

There is no single mandated path, but a sequence that works for most working security engineers looks like this:

Start from the official exam guide. Read every task statement, and mark each one as "do daily", "have done occasionally" or "never touched". This triage is your syllabus.
Close the gaps hands-on. Security is a poor subject for purely theoretical study. Build the things the guide describes: write and break IAM policies, configure key rotation and cross-account key access, wire logs into a detection workflow, then respond to a simulated finding end to end.
Study the SCS-C03 additions deliberately. Threat detection, incident response and AI/ML workload security carry more structural weight in this version than in SCS-C02-era study materials. If your course or notes predate the update, supplement them from AWS's current documentation.
Practise scenario questions under exam conditions. Specialty-level questions reward a specific reading skill — spotting which detail in a long scenario makes one otherwise-correct answer wrong. That skill only develops through repetition. Working through AWS Certified Security – Specialty practice questions lets you test yourself domain by domain; ExamPractice offers free samples, with fuller question sets and a timed simulation mode for subscribers.
Analyse your practice results, not just your score. A 75% practice score with misses spread evenly means "revise everything lightly"; the same score with misses clustered in one domain means "stop and rebuild that domain". Weak-area targeting is the entire point of practice testing — memorising answers teaches you nothing the live exam will reuse.
Do one full timed run before booking. 170 minutes of dense scenario reading is a stamina event. A full-length practice test simulation under real timing tells you whether your pacing holds through question 65.

Readiness checklist

Book the exam when you can honestly tick all of these:

I can explain the difference between an identity-based policy, a resource-based policy, a permission boundary and a service control policy, and predict the net effect when they interact.
I can design a KMS key strategy for a multi-account organisation, including who administers keys versus who uses them.
Given a set of log excerpts, I can reconstruct an incident timeline and name the containment step I would take first.
I can describe how to secure the data, endpoints and access paths of an AI/ML workload, not just a traditional web application.
My timed practice scores sit comfortably above the pass threshold across every domain, not just on average.

Renewal: the Specialty-specific catch

All AWS certifications are valid for three years, but Specialty certifications have a stricter renewal rule than the rest of the portfolio. Associate certifications can be renewed by passing a higher-level exam; the Security Specialty renews only by retaking the current Specialty exam. Whatever version is live when your three years end — SCS-C03 or a successor — that is the exam you will sit, at full Specialty length. Factor that recurring commitment into the decision, and use your 50% discount voucher if you hold another active AWS certification at renewal time.

Frequently asked questions

Do I need an Associate certification before the Security Specialty?

No. AWS imposes no prerequisites on any exam, including Specialties. The recommendation of prior AWS experience is guidance, not a gate. Plenty of experienced security engineers make SCS-C03 their first AWS certification.

Can I still take SCS-C02?

No. SCS-C02 was available until 1 December 2025. All bookings now are for SCS-C03. A certification earned under SCS-C02 remains valid for its normal three-year term.

Can I take the exam from home?

Yes. Like all AWS exams, SCS-C03 is available through online proctoring as well as at Pearson VUE test centres. Online sittings require a system check, an uninterrupted private room and compliance with the proctoring rules.

How does the Security Specialty compare with other AWS specialties?

As of August 2026 the Specialty tier has thinned considerably: the Database, Data Analytics and SAP on AWS specialties retired in 2024, the Machine Learning Specialty retired in March 2026, and the AWS Advanced Networking Specialty is scheduled to retire on 31 December 2026. That leaves Security as the flagship of the tier — one reason it features so prominently in cloud security job specifications.

Where the Security Specialty fits your plan

Treat SCS-C03 as a depth credential, not a breadth one: it certifies that you can secure AWS environments at the level expected of a dedicated cloud security engineer, and the exam's scenario style genuinely reflects that job. The practical path is short to describe — read the official exam guide, close your hands-on gaps with particular attention to the new detection, response and AI-security material, and validate with timed practice before spending the $300 fee. Version-sensitive details such as pricing, languages and domain weightings should always be confirmed on the official AWS Certified Security – Specialty page, since this exam has already changed once in the past year.

Exam facts in this guide were checked against official certification-provider pages on 30 August 2026. Fees, exam codes and policies change — confirm on the provider’s own site before you book.