Why Study with PlanetCert?
The Latest Questions
Practice questions and exam topics aligned with the current exam objectives.
Detailed Explanations
Go beyond the answer. Master the material with comprehensive learning and professional explanations for every concept.
AI-Powered Insights
Personalized preparation guidance that adapts to your performance and identifies weak spots automatically.
Exam Information
Official specifications published by Amazon
Exam Format
170 min
65
750
Specialty
Registration
$300 USD
Pearson VUE or online proctoring
English, Japanese, Korean, Portuguese (Brazil) +2 more
Validity
3 years
Pass the current version of the AWS Certified Security - Specialty exam; Pass a higher-level AWS exam (any Professional or other Specialty); Earn continuing education credits through AWS re:Invent, AWS Summit, or AWS Training
SCS-C03 Exam Topics and Domains
SCS-C03 is organized into 6 weighted domains. Expect to work with Amazon S3, AWS IAM, AWS Security Hub, AWS WAF, and more.
1
Detection
16%
Design and implement monitoring and alerting solutions for an AWS account or organization
Workload Monitoring AnalysisMonitoring Strategy ImplementationSecurity Event AggregationMetrics, Alerts, and DashboardsAutomated Security Assessments
- Analyze workloads to determine monitoring requirements
- Design and implement workload monitoring strategies
- Aggregate security and monitoring events
- Create metrics, alerts, and dashboards to detect anomalous data and events
- Create and manage automations to perform regular assessments and investigations
Design and implement logging solutions
Log Source IdentificationAWS Service Logging ConfigurationLog Storage and Data LakesLog AnalysisLog Normalization and CorrelationNetwork-Based Log Sources
- Identify sources for log ingestion and storage based on requirements
- Configure logging for AWS services and applications
- Implement log storage and log data lakes
- Use AWS services to analyze logs
- Use AWS services to normalize, parse, and correlate logs
- Determine and configure appropriate log sources based on network design, threats, and attacks
Troubleshoot security monitoring, logging, and alerting solutions
Resource Functionality AnalysisMisconfiguration Remediation
- Analyze the functionality, permissions, and configuration of resources
- Remediate misconfiguration of resources
2
Incident Response
14%
Design and test an incident response plan
Response Plans and RunbooksService Preparation for IncidentsIncident Response TestingAutomated Incident Remediation
- Design and implement response plans and runbooks to respond to security incidents
- Use AWS service features and capabilities to configure services to be prepared for incidents
- Recommend procedures to test and validate the effectiveness of an incident response plan
- Use AWS services to automatically remediate incidents
Respond to security events
Forensic Artifact CaptureLog Search and CorrelationFinding Validation and Impact AssessmentThreat Containment and RecoveryRoot Cause Analysis
- Capture and store relevant system and application logs as forensic artifacts
- Search and correlate logs for security events across applications and AWS services
- Validate findings from AWS security services to assess the scope and impact of an event
- Respond to affected resources by containing and eradicating threats, and recover resources
- Describe methods to conduct root cause analysis
3
Infrastructure Security
18%
Design, implement, and troubleshoot security controls for network edge services
Edge Security StrategyNetwork Edge ProtectionAWS Edge ControlsEdge Service Integrations
- Define and select edge security strategies based on anticipated threats and attacks
- Implement appropriate network edge protection
- Design and implement AWS edge controls and rules based on requirements
- Configure integrations with AWS edge services and third-party services
Design, implement, and troubleshoot security controls for compute workloads
Compute HardeningCompute AuthorizationVulnerability ScanningPatch ManagementSecure Administrative AccessPipeline Security ToolsGenerative AI Security
- Design and implement hardened Amazon EC2 AMIs and container images
- Apply instance profiles, service roles, and execution roles appropriately
- Scan compute resources for known vulnerabilities
- Deploy patches across compute resources
- Configure secure administrative access to compute resources
- Configure security tools to discover and remediate vulnerabilities within a pipeline
- Implement protections and guardrails for generative AI applications
Design and troubleshoot network security controls
Network Traffic ControlsHybrid and Multi-Cloud ConnectivityHybrid Communication SecurityNetwork SegmentationNetwork Access Analysis
- Design and troubleshoot appropriate network controls to permit or prevent network traffic
- Design secure connectivity between hybrid and multi-cloud networks
- Determine and configure security workload requirements for communication between hybrid environments and AWS
- Design network segmentation based on security requirements
- Identify unnecessary network access
4
Identity and Access Management
20%
Design, implement, and troubleshoot authentication strategies
Identity Solutions DesignTemporary Credential MechanismsAuthentication Troubleshooting
- Design and establish identity solutions for human, application, and system authentication
- Configure mechanisms to issue temporary credentials
- Troubleshoot authentication issues
Design, implement, and troubleshoot authorization strategies
Authorization Controls DesignABAC and RBAC StrategiesLeast Privilege IAM PoliciesAuthorization Failure AnalysisUnintended Permissions Investigation
- Design and evaluate authorization controls for human, application, and system access
- Design attribute-based access control (ABAC) and role-based access control (RBAC) strategies
- Design, interpret, and implement IAM policies by following the principle of least privilege
- Analyze authorization failures to determine causes or effects
- Investigate and correct unintended permissions, authorizations, or privileges
5
Data Protection
18%
Design and implement controls for data in transit
Encryption RequirementsSecure Private AccessInter-Resource Encryption
- Design and configure mechanisms to require encryption when connecting to resources
- Design and configure mechanisms for secure and private access to resources
- Design and configure inter-resource encryption in transit
Design and implement controls for data at rest
Data Encryption at RestData Integrity ProtectionLifecycle and Retention ManagementSecure Replication and Backup
- Design, implement, and configure data encryption at rest based on specific requirements
- Design and configure mechanisms to protect data integrity
- Design automatic lifecycle management and retention solutions for data
- Design and configure secure data replication and backup solutions
Design and implement controls to protect confidential data, credentials, secrets, and cryptographic key materials
Credentials and Secrets ManagementImported Key Material ManagementKey Material TypesSensitive Data MaskingEncryption Key and Certificate Management
- Design management and rotation of credentials and secrets
- Manage and use imported key material
- Describe the differences between imported key material and AWS generated key material
- Mask sensitive data
- Create and manage encryption keys and certificates across single or multiple AWS Regions
6
Security Foundations and Governance
14%
Develop a strategy to centrally deploy and manage AWS accounts
Organizations DeploymentControl Tower ImplementationOrganization PoliciesCentralized Security ServicesRoot User Management
- Deploy and configure organizations by using AWS Organizations
- Implement and manage AWS Control Tower
- Implement organization policies to manage permissions
- Centrally manage security services
- Manage AWS account root user credentials
Implement a secure and consistent deployment strategy for cloud resources
Infrastructure as Code SecurityResource Tagging StrategyCentralized Policy DeploymentSecure Resource Sharing
- Use infrastructure as code to deploy cloud resources consistently and securely
- Use tags to organize AWS resources
- Deploy and enforce policies and configurations from a central source
- Securely share resources across AWS accounts
Evaluate the compliance of AWS resources
Compliance Detection and RemediationAudit Evidence CollectionArchitecture Compliance Evaluation
- Create or enable rules to detect and remediate noncompliant AWS resources
- Use AWS audit services to collect and organize evidence
- Use AWS services to evaluate architecture for compliance with AWS security best practices
How do I earn this certification?
Passing SCS-C03 earns the AWS Certified Security - Specialty certification. It sits in the Security track.
Current Level Exams
Next Level Options
- SAP-C02 - AWS Certified Solutions Architect - ProfessionalAdvanced architectural design including security best practices
- DOP-C02 - AWS Certified DevOps Engineer - ProfessionalDevSecOps integration and security automation
Alternative Paths
- ANS-C01 - AWS Certified Advanced Networking - SpecialtyDeep dive into network security and hybrid connectivity
- SAP-C02 - AWS Certified Solutions Architect - ProfessionalComprehensive architecture skills with security integration
- DOP-C02 - AWS Certified DevOps Engineer - ProfessionalSecurity automation and CI/CD pipeline security
Practice with Precision
The PlanetCert Simulator mirrors the real exam environment with authentic questions and timed pressure.
How to study for this exam?
Use the official PlanetCert Practice Test alongside the study plan below to prepare efficiently for SCS-C03.
What's changed on this exam?
Current Status
- ACTIVE
- Last content update: 2025-12-02
- Announcement date: 2025-08-15
Updates
- Generative AI Security New in SCS-C03 Major new coverage area including GenAI OWASP Top 10 and Amazon Bedrock guardrails • Release date: 2025-12-02
- AWS Security Lake GA Primary service for log aggregation and OCSF format in Detection domain • Release date: 2025-11-15
- AWS Verified Access Enhanced Key service for Zero Trust architecture in Infrastructure Security domain • Release date: 2025-10-20
- Amazon Verified Permissions GA New authorization service in IAM domain • Release date: 2025-06-01
Who should take this exam?
This exam is typically taken by Security Engineers and Security Architects.
- 3-5 years of experience designing and implementing security solutions
- Minimum 2 years of hands-on experience securing AWS workloads
- Working knowledge of AWS security services and features
- Understanding of AWS shared responsibility model
- Experience with logging and monitoring strategies
- Knowledge of threat detection and incident response
- Familiarity with data encryption methodologies
- Experience with identity and access management at scale
- Understanding of vulnerability management in the cloud
- Experience with multi-account governance