A free, open study guide for the AWS Certified Security – Specialty (SCS-C03) exam: revision notes for every domain, side-by-side comparisons of commonly confused services, a glossary, 20 worked sample questions, and the official syllabus as a checklist with a full free lesson for every topic.
Maintained by SaveMyCert, where you can read every lesson free, practice with explained questions and take timed mock exams.
- Exam at a glance
- Exam domains
- What is in this repo
- Syllabus checklist
- How to study for SCS-C03
- Sample questions
- Free resources
| Exam code | SCS-C03 |
| Level | Specialty |
| Questions | 65 |
| Time limit | 170 min |
| Passing score | 750 / 1000 |
| Format | Multiple choice & response |
| Exam fee | $300 |
| Valid for | 3 years |
Exam details change. Always confirm them in the official AWS Certified Security – Specialty (SCS-C03) exam guide from Amazon Web Services.
| # | Domain | Weight | Topics |
|---|---|---|---|
| 1 | Detection | 16% | 3 |
| 2 | Incident Response | 14% | 2 |
| 3 | Infrastructure Security | 18% | 3 |
| 4 | Identity and Access Management | 20% | 2 |
| 5 | Data Protection | 18% | 3 |
| 6 | Security Foundations and Governance | 14% | 3 |
That is 6 domains and 16 topics. Spend your time in proportion to the weights: the heaviest domain decides more of your score than the lightest.
| File | What it gives you |
|---|---|
| Domain 1 notes | Detection: condensed revision notes per topic |
| Domain 2 notes | Incident Response: condensed revision notes per topic |
| Domain 3 notes | Infrastructure Security: condensed revision notes per topic |
| Domain 4 notes | Identity and Access Management: condensed revision notes per topic |
| Domain 5 notes | Data Protection: condensed revision notes per topic |
| Domain 6 notes | Security Foundations and Governance: condensed revision notes per topic |
| Commonly confused services | Side-by-side tables of the services questions set against each other |
| Glossary | Every in-scope term and service in one sentence |
| Sample questions | 20 worked questions with answers and reasoning |
| Exam-day guide | Booking, testing options, scoring, results and retakes |
Tick each topic off once you can explain it without notes. The "Must know" facts are the ones questions turn on. Each lesson link goes to the complete, free lesson.
Weight: 16%. Designing monitoring, alerting, and logging solutions across accounts and organizations, and troubleshooting them when they break.
📝 Revision notes: Domain 1: Detection
- 1 Design and implement monitoring and alerting solutions for an AWS account or organization
1 (SCS-C03). Analyzing workloads to determine monitoring requirements; designing and implementing workload monitoring strategies (e.g. resource health checks); aggregating security and monitoring events; creating metrics, alerts, and dashboards to detect anomalous data and events (Amazon GuardDuty, Amazon Security Lake, AWS Security Hub, Amazon Macie); creating and managing automations for regular assessments and investigations (AWS Config conformance packs, Security Hub, Systems Manager State Manager).- 📖 Lesson: Designing Security Monitoring and Alerting Across an AWS Organization
- Must know: Security Hub with a delegated administrator and cross-Region aggregation is the single pane of glass for findings across accounts and Regions, all normalized into ASFF.
- Must know: GuardDuty consumes CloudTrail, VPC Flow Log, and DNS telemetry directly from AWS infrastructure — you don't enable those logs for it, and disabling them doesn't blind it.
- 1 Design and implement logging solutions
2 (SCS-C03). Identifying sources for log ingestion and storage; configuring logging for AWS services and applications (an organization CloudTrail trail, a dedicated CloudWatch logging account, the CloudWatch Logs agent); implementing log storage and log data lakes (Security Lake) and integrating with third-party security tools; analyzing logs with AWS services (CloudWatch Logs Insights, Amazon Athena, Security Hub findings); normalizing, parsing, and correlating logs (Amazon OpenSearch Service, AWS Lambda, Amazon Managed Grafana); configuring appropriate log sources based on network design, threats, and attacks (VPC Flow Logs, transit gateway flow logs, Route 53 Resolver logs).- 📖 Lesson: Designing Security Logging Solutions: CloudTrail, Flow Logs, Central Archives
- Must know: An organization trail from the management account logs every member automatically, and member accounts cannot modify, stop, or delete it — the answer to tamper-resistant org-wide logging.
- Must know: Management events record the control plane and are on by default; data events (S3 objects, Lambda invokes) are high-volume, off by default, and should be scoped with event selectors.
- 1 Troubleshoot security monitoring, logging, and alerting solutions
3 (SCS-C03). Analyzing the functionality, permissions, and configuration of resources (Lambda function logging, API Gateway logging, health checks, CloudFront logging); remediating misconfiguration of resources (troubleshooting CloudWatch Agent configurations, troubleshooting missing logs).- 📖 Lesson: Troubleshooting Security Monitoring, Logging, and Alerting on AWS
- Must know: Triage every broken pipeline in order — source, delivery, destination permissions, consumer — because downstream stages fail silently with no error anywhere.
- Must know: A trail that reports it is logging can still deliver nothing: check LatestDeliveryError, then the S3 bucket policy and KMS key policy for cloudtrail.amazonaws.com — an aws:SourceArn condition with a wrong value severs delivery invisibly.
Weight: 14%. Designing and testing incident response plans, and responding to security events with containment, forensics, and root cause analysis.
📝 Revision notes: Domain 2: Incident Response
- 2 Design and test an incident response plan
1 (SCS-C03). Designing and implementing response plans and runbooks (Systems Manager OpsCenter, Amazon SageMaker AI notebooks); configuring services to be prepared for incidents (provisioning access, deploying security tools, minimizing the blast radius, AWS Shield Advanced protections); testing and validating incident response plan effectiveness (AWS Fault Injection Service, AWS Resilience Hub); automatic incident remediation (Systems Manager, Automated Forensics Orchestrator for Amazon EC2, AWS Step Functions, Amazon Application Recovery Controller, Lambda functions).- 📖 Lesson: Design and Test an AWS Incident Response Plan (SCS-C03)
- Must know: Preparation is the heavily tested phase: pre-provisioned IR roles, break-glass procedures, cross-account access, and a dedicated forensics account must exist before any incident.
- Must know: Deactivate an exposed access key first — it is immediate, reversible, and preserves the investigation trail; deletion is a later eradication step.
- 2 Respond to security events
2 (SCS-C03). Capturing and storing system and application logs as forensic artifacts; searching and correlating logs for security events across applications and AWS services; validating findings from AWS security services to assess the scope and impact of an event; containing and eradicating threats and recovering resources (network containment controls, restoring backups); root cause analysis methods (Amazon Detective).- 📖 Lesson: Responding to AWS Security Events: Compromised EC2, Credentials, and S3
- Must know: Order of operations is everything: validate the finding, isolate, preserve evidence (snapshots, memory), and only then eradicate and rebuild from a clean AMI.
- Must know: Security-group changes do not cut established tracked connections — use network ACL denies to sever an attacker's live session; the empty isolation security group remains the per-instance containment standard.
Weight: 18%. Security controls for network edge services, compute workloads, and network traffic — from WAF rules to hardened AMIs to segmentation.
📝 Revision notes: Domain 3: Infrastructure Security
- 3 Design, implement, and troubleshoot security controls for network edge services
1 (SCS-C03). Defining and selecting edge security strategies based on anticipated threats and attacks; implementing network edge protection (CloudFront headers, AWS WAF, AWS IoT policies, OWASP Top 10 protections, Amazon S3 CORS, Shield Advanced); designing edge controls and rules from requirements (geography, geolocation, rate limiting, client fingerprinting); configuring integrations with edge and third-party services (ingesting data in Open Cybersecurity Schema Framework [OCSF] format, third-party WAF rules).- 📖 Lesson: Edge Security on AWS: WAF, Shield, and CloudFront as Controls
- Must know: Web ACLs attach to CloudFront (global scope, created in us-east-1), ALBs, API Gateway REST stages, and AppSync — never to EC2 or NLBs; wrong scope or no association is why "WAF isn't working."
- Must know: Rules run in priority order and the first terminating Allow or Block ends evaluation; Count is non-terminating and is the safe deployment mode for new rules and managed groups.
- 3 Design, implement, and troubleshoot security controls for compute workloads
2 (SCS-C03). Hardened Amazon EC2 AMIs and container images (Systems Manager, EC2 Image Builder); instance profiles, service roles, and execution roles to authorize compute workloads; scanning compute resources for vulnerabilities (Amazon Inspector for container images and Lambda functions, GuardDuty runtime monitoring); automated patching and continuous validation (Systems Manager Patch Manager, Amazon Inspector); secure administrative access (Systems Manager Session Manager, EC2 Instance Connect); discovering and remediating vulnerabilities within a pipeline (Amazon Q Developer, Amazon CodeGuru Security); protections and guardrails for generative AI applications (GenAI OWASP Top 10 for LLM Applications).- 📖 Lesson: Securing Compute Workloads: EC2, Containers, and Lambda
- Must know: IMDSv2 defeats SSRF credential theft by requiring a token from a custom-header PUT; enforce it with HttpTokens=required, AMI ImdsSupport v2.0, account-level metadata defaults, and the ec2:MetadataHttpTokens IAM condition — and raise the hop limit to 2 only for containers on EC2.
- Must know: Golden AMIs come from EC2 Image Builder pipelines with hardening (STIG) and test components; running fleets stay compliant via Patch Manager baselines, patch groups, and maintenance windows, with EBS encryption on by default.
- 3 Design and troubleshoot network security controls
3 (SCS-C03). Network controls to permit or prevent traffic (security groups, network ACLs, AWS Network Firewall); secure connectivity between hybrid and multi-cloud networks (AWS Site-to-Site VPN, AWS Direct Connect, MAC Security [MACsec]); security requirements for communication between hybrid environments and AWS (AWS Verified Access); network segmentation from security requirements (north/south and east/west traffic protections, isolated subnets); identifying unnecessary network access (AWS Verified Access, Network Access Analyzer, Amazon Inspector network reachability findings).- 📖 Lesson: Network Security Controls: SGs, NACLs, Network Firewall, and Egress
- Must know: Security groups are stateful and allow-only; referencing SGs as rule sources gives micro-segmentation that survives IP churn. NACLs are stateless, ordered, subnet-wide, and the only layer with an explicit deny — remember ephemeral return ports.
- Must know: Removing an SG rule does not cut existing tracked connections; a NACL deny does — NACLs are the subnet-level kill switch during containment.
Weight: 20%. Authentication and authorization strategies for human, application, and system access — the heaviest-weighted domain on the exam.
📝 Revision notes: Domain 4: Identity and Access Management
- 4 Design, implement, and troubleshoot authentication strategies
1 (SCS-C03). Identity solutions for human, application, and system authentication (AWS IAM Identity Center, Amazon Cognito, multi-factor authentication [MFA], identity provider [IdP] integration); mechanisms to issue temporary credentials (AWS STS, Amazon S3 presigned URLs); troubleshooting authentication issues (CloudTrail, Amazon Cognito, IAM Identity Center permission sets, AWS Directory Service).- 📖 Lesson: AWS Authentication Strategies: MFA, STS, and Federation
- Must know: Enforce MFA with an explicit deny on aws:MultiFactorAuthPresent using BoolIfExists — plain Bool exempts long-term access-key requests because the key is absent from their context.
- Must know: Prefer phishing-resistant FIDO2 keys for privileged users; protect root with MFA and no access keys, and use centralized root access management to remove member-account root credentials entirely.
- 4 Design, implement, and troubleshoot authorization strategies
2 (SCS-C03). Authorization controls for human, application, and system access (Amazon Verified Permissions, IAM paths, IAM Roles Anywhere, resource policies for cross-account access, IAM role trust policies); attribute-based access control (ABAC) and role-based access control (RBAC) strategies (resource access based on tags or attributes); IAM policies following least privilege (permission boundaries, session policies); analyzing authorization failures (IAM Policy Simulator, IAM Access Analyzer); investigating and correcting unintended permissions, authorizations, or privileges (IAM Access Analyzer).- 📖 Lesson: IAM Policy Evaluation and Authorization Strategies on AWS
- Must know: Evaluation order: explicit deny first, then SCPs, RCPs, resource-based policies, identity-based policies, permissions boundaries, session policies — with implicit deny for anything never allowed.
- Must know: Only identity-based and resource-based policies grant access; SCPs, RCPs, boundaries, and session policies are ceilings that can only take away.
Weight: 18%. Encryption in transit and at rest, plus protecting confidential data, credentials, secrets, and cryptographic key materials.
📝 Revision notes: Domain 5: Data Protection
- 5 Design and implement controls for data in transit
1 (SCS-C03). Requiring encryption when connecting to resources (Elastic Load Balancing [ELB] security policies, enforcing TLS configurations); secure and private access to resources (AWS PrivateLink, VPC endpoints, AWS Client VPN, AWS Verified Access); inter-resource encryption in transit (inter-node encryption for Amazon EMR, Amazon EKS, SageMaker AI, Nitro encryption).- 📖 Lesson: Data in Transit on AWS: TLS, ACM, and End-to-End Encryption Design
- Must know: Public ACM certificates auto-renew only while the DNS validation CNAME stays published and the certificate is in use; imported certificates never auto-renew.
- Must know: ACM certificates attach to integrated services — ELB, CloudFront (us-east-1), API Gateway — never directly to EC2; use exportable or Private CA certificates when a host needs key material.
- 5 Design and implement controls for data at rest
2 (SCS-C03). Data encryption at rest — selecting the appropriate encryption key service (AWS CloudHSM, AWS KMS) and encryption type (client-side vs server-side); protecting data integrity (S3 Object Lock, S3 Glacier Vault Lock, versioning, digital code signing, file validation); automatic lifecycle management and retention (S3 Lifecycle policies, S3 Object Lock, Amazon EFS Lifecycle policies, Amazon FSx for Lustre backup policies); secure data replication and backup (Amazon Data Lifecycle Manager, AWS Backup, ransomware protection, AWS DataSync).- 📖 Lesson: Encryption at Rest on AWS: KMS Keys, Key Policies, and Service Integration
- Must know: Customer managed keys are the only key type with editable key policies, controllable rotation, grants, deletion, and cross-account use — AWS managed (aws/service) keys can do none of that across accounts.
- Must know: The key policy is the root of trust: the default kms:* account-root statement is what enables IAM policies to work on the key, and removing it can make the key unmanageable.
- 5 Design and implement controls to protect confidential data, credentials, secrets, and cryptographic key materials
3 (SCS-C03). Management and rotation of credentials and secrets (AWS Secrets Manager); managing and using imported key material (rotating imported key material, external key stores); differences between imported key material and AWS generated key material; masking sensitive data (CloudWatch Logs data protection policies, Amazon SNS message data protection); creating and managing encryption keys and certificates across a single AWS Region or multiple Regions (AWS KMS customer managed keys, AWS Private Certificate Authority).- 📖 Lesson: Protecting Secrets, Confidential Data, and Cryptographic Key Material
- Must know: Secrets Manager earns its cost with rotation, resource-policy cross-account sharing, and multi-Region replication; Parameter Store SecureString is the free answer for encrypted configuration that never rotates.
- Must know: Rotation is a four-step Lambda contract — createSecret, setSecret, testSecret, finishSecret — with AWSCURRENT/AWSPENDING/AWSPREVIOUS staging labels; managed rotators cover RDS, Redshift, and DocumentDB, custom Lambdas cover everything else.
Weight: 14%. Multi-account strategy, secure and consistent deployment of cloud resources, and evaluating compliance across AWS environments.
📝 Revision notes: Domain 6: Security Foundations and Governance
- 6 Develop a strategy to centrally deploy and manage AWS accounts
1 (SCS-C03). Deploying and configuring organizations with AWS Organizations; implementing and managing AWS Control Tower in new and existing environments with optional and custom controls; organization policies to manage permissions (SCPs, RCPs, AI service opt-out policies, declarative policies); centrally managing security services (delegated administrator accounts); managing AWS account root user credentials (centralizing root access for member accounts, managing MFA, break-glass procedures).- 📖 Lesson: AWS Organizations, SCPs, and Control Tower: Multi-Account Security Strategy
- Must know: The AWS account is the strongest isolation boundary — cross-account access is denied by default, so account separation is the blast-radius control that survives misconfiguration inside an account.
- Must know: The reference layout: a Security OU holding the log-archive account (immutable org-wide logs) and the audit account (delegated admin for security services), plus Workloads, Sandbox, and Suspended OUs.
- 6 Implement a secure and consistent deployment strategy for cloud resources
2 (SCS-C03). Infrastructure as code (IaC) to deploy cloud resources consistently and securely across accounts (CloudFormation stack sets, third-party IaC tools, CloudFormation Guard, cfn-lint); using tags to organize AWS resources into groups (by department, cost center, environment); deploying and enforcing policies and configurations from a central source (AWS Firewall Manager); securely sharing resources across AWS accounts (AWS Service Catalog, AWS Resource Access Manager [AWS RAM]).- 📖 Lesson: Secure IaC Deployment: CloudFormation, StackSets, and Service Catalog
- Must know: IaC makes security consistent: templates are versioned, peer-reviewed security artifacts, and drift detection flags out-of-band changes — with CloudTrail supplying who made them.
- Must know: Protect deployed security resources in layers: stack policies block risky updates, DeletionPolicy: Retain preserves log buckets and keys through stack deletion, and service roles scope who can deploy what.
- 6 Evaluate the compliance of AWS resources
3 (SCS-C03). Rules to detect and remediate noncompliant AWS resources and send notifications (AWS Config alert aggregation and remediation, Security Hub); AWS audit services to collect and organize evidence (AWS Audit Manager, AWS Artifact); evaluating architecture for compliance with AWS security best practices (AWS Well-Architected Framework tool).- 📖 Lesson: Evaluating AWS Resource Compliance: Config, Security Hub, Audit Manager
- Must know: AWS Config is the continuous technical-compliance engine: recorder produces configuration items, rules evaluate them (change-triggered or periodic), remediation configurations fix them.
- Must know: A stopped recorder kills change-triggered rules and leaves unfillable gaps in the resource timeline; periodic rules keep running, so the breakage is easy to miss.
- Read the lesson for each topic in the checklist above, starting with the heaviest domain. Every lesson is free on the SCS-C03 revision notes.
- Practice straight after reading. Answer SCS-C03 practice questions on the topic you just read. Each option comes with an explanation of why it is right or wrong.
- Review what you got wrong, re-read that lesson section, and tick the topic off only when you get its questions right.
- Take a full-length SCS-C03 mock exam under the real time limit. Aim to pass mocks comfortably before you book.
- On the last day, skim the SCS-C03 cheat sheet instead of starting anything new.
sample-questions.md has 20 worked SCS-C03 questions with the answer, why each option is right or wrong, and the reasoning steps.
- AWS Certified Security – Specialty (SCS-C03) exam guide: the official source (Amazon Web Services)
- SCS-C03 certification overview
- SCS-C03 revision notes: every lesson, free to read
- SCS-C03 practice questions: with an explanation on every option
- SCS-C03 mock exams: full-length and timed
- SCS-C03 cheat sheet: the key facts on one page
- All certification study guides
Spotted an error or an out-of-date fact? Open an issue with the topic and a link to the official source. See CONTRIBUTING.md.
This guide is licensed under CC BY 4.0. You can reuse and adapt it, including commercially, as long as you credit SaveMyCert with a link to https://www.savemycert.com/.
This is an independent study resource. It is not affiliated with or endorsed by Amazon Web Services. AWS Certified Security – Specialty and SCS-C03 are trademarks of their respective owner. Exam domains and weights are taken from the official exam guide linked above.