← All Certifications
AWS

AWS Security Specialty Certification

SCS-C03 · 6 domains

Last updated: March 31, 2026

Exam Syllabus & Domains

The AWS Security Specialty certification exam covers the following domains. Focus your training time proportionally to each domain's weight.

Domain 1 16%

Threat Detection and Incident Response

  • 1.1 Design threat detection solutions
  • 1.2 Detect security threats and anomalies
  • 1.3 Evaluate detection mechanisms
GuardDuty Finding TypesCloudWatch Anomaly DetectionVPC Flow Logs AnalysisAWS Config Rule EvaluationsSecurity Hub Automated ChecksCustom Lambda Detection FunctionsAmazon Detective InvestigationInspector Vulnerability ScanningEventBridge Security Event PatternsTrusted Advisor Security Checks
Domain 2 14%

Security Logging and Monitoring

  • 2.1 Design incident response plans
  • 2.2 Respond to compromised resources
  • 2.3 Design forensic capabilities
CloudTrail Log File IntegrityCentralized Logging ArchitectureS3 Access LoggingVPC Flow Logs for ForensicsCompromised EC2 Instance IsolationCompromised IAM Credential RotationCloudWatch Logs Insights QueriesAthena for Log AnalysisCross-Account Log AggregationForensic Snapshot and Memory Capture
Domain 3 18%

Infrastructure Security

  • 3.1 Design security controls for edge services
  • 3.2 Design and implement network security controls
  • 3.3 Design and implement compute security controls
WAF Rules and Web ACLsShield Standard vs AdvancedCloudFront Signed URLs and CookiesDDoS Mitigation StrategiesVPC Security Design (Public/Private Subnets)Network FirewallSecurity Groups vs NACLs Deep DiveSystems Manager Patch ManagerEC2 Instance Metadata Service (IMDSv2)PrivateLink and VPC Endpoints
Domain 4 20%

Identity and Access Management

  • 4.1 Design authentication solutions for AWS resources
  • 4.2 Design authorization solutions for AWS resources
  • 4.3 Troubleshoot authentication and authorization
Permission BoundariesService Control Policies (SCPs)Attribute-Based Access Control (ABAC)SAML 2.0 FederationOIDC Identity ProvidersCognito User Pools and Identity PoolsIAM Access AnalyzerCross-Account Role AssumptionResource-Based Policies vs Identity-BasedIAM Policy Evaluation Logic
Domain 5 18%

Data Protection

  • 5.1 Design controls for data in transit
  • 5.2 Design controls for data at rest
  • 5.3 Manage data lifecycle and retention
KMS Customer Managed Keys (CMKs)KMS Key Policies and GrantsEnvelope EncryptionS3 Encryption (SSE-S3/SSE-KMS/SSE-C/CSE)Macie for PII DetectionSecrets Manager Automatic RotationACM Certificate ManagementCloudHSM for Regulatory ComplianceRDS/EBS/EFS EncryptionS3 Object Lock and Glacier Vault Lock
Domain 6 14%

Management and Security Governance

  • 6.1 Centrally deploy and manage AWS accounts
  • 6.2 Implement secure deployment strategies
  • 6.3 Evaluate compliance and identify security gaps
AWS Organizations and OUsControl Tower GuardrailsConfig Conformance PacksAudit Manager FrameworksService Catalog ConstraintsCloudFormation StackSetsDelegated Administrator AccountsTag Policies and EnforcementSecurity Hub Cross-AccountCompliance as Code Patterns

Where to Focus Your Study Time

Domains with higher weight have more exam questions — allocate your study hours accordingly.

D1 Threat Detection and Incident Response
16%
D2 Security Logging and Monitoring
14%
D3 Infrastructure Security
18%
D4 Identity and Access Management
20%
D5 Data Protection
18%
D6 Management and Security Governance
14%

Study Tips

Free Study Resources

๐Ÿ“‹

Study Roadmap

Week-by-week study plan with free resources

โœ…

Study Tracker

Track objective completion with progress dashboard

๐Ÿ’ฐ

Cost Calculator

Total cost breakdown and ROI analysis

๐Ÿงช

Practice Quiz

Test your knowledge with free practice questions

Practice Quiz

Test your knowledge before the exam with our free practice quiz.

Take the AWS Security Specialty Practice Quiz

Related Comparisons

Not sure if AWS Security Specialty is the right choice? Compare it with similar certifications:

AWS SAA vs AWS Security Specialty

Get the AWS Security Specialty Study Planner

Fillable PDF with 12-week schedule, domain trackers, flashcard templates, progress tracking, and quick reference sheets. Available in Standard, ADHD-Friendly, Dark Mode, and 4-Format Bundle.

Get the Study Planner — $5.99

Also available as a 4-Format Bundle for $15.99

CyberFolio

Earned your certs? Show employers.

Build a shareable cybersecurity portfolio that highlights your certifications, projects, and skills — free.

Build Your Portfolio →

Free Training Resources

Use these free tools to support your AWS Security Specialty certification training:

Frequently Asked Questions

What is the AWS Security Specialty certification?

The AWS Security Specialty (SCS-C03) is a professional IT certification that validates your knowledge and skills in the exam domains covered. It is recognized globally by employers and is a valuable credential for career advancement in cybersecurity and IT.

What does the AWS Security Specialty certification syllabus cover?

The AWS Security Specialty exam syllabus covers 6 domains. Each domain is weighted differently, so focus your training on higher-weighted domains first. Review the complete domain breakdown above for objectives and key concepts.

How should I study for AWS Security Specialty?

Create a structured study plan covering all exam domains, use practice tests to identify weak areas, and review key concepts regularly. A fillable study planner can help you organize your training with weekly schedules and progress tracking.

How long does it take to prepare for AWS Security Specialty?

Preparation time varies by experience level. Most candidates spend 8-12 weeks of dedicated training. Using a structured study planner with domain-by-domain breakdown helps ensure you cover all certification objectives efficiently.