What SCS-C03 actually is
Lesson 1 of 3 in The SCS-C03 Exam.
SCS-C03 is the live AWS Certified Security – Specialty exam. Its predecessor, SCS-C02, was in use until 1 December 2025; C03 has been in use since 2 December 2025. That single date is the most expensive fact on this page, and we will come back to why.
The shape, straight from the guide. You get 65 questions, of which 50 affect your score and 15 do not — unscored pilot items AWS uses to calibrate future exams, and they are not identified on the exam. You have 170 minutes. Results come back as a scaled score of 100–1,000 with a minimum passing score of 750, and the model is compensatory: you need to pass the exam as a whole, not each section. The fee is USD 300 as of October 2026. The target candidate has the equivalent of 3–5 years of experience securing cloud solutions — this is a specialty exam written for someone who has already been on call for a breach.
Two consequences follow immediately. Because 15 items are invisible pilots, every question deserves full effort; a question that feels unfairly obscure may simply be one that never counted. And because scoring is compensatory, a weak domain is survivable — so study time goes where weight × weakness is largest, not where your pride hurts most.
A horizontal bar chart of the six SCS-C03 content domains by percentage of scored content. Domain 1 Detection 16 percent, about 8 of the 50 scored questions. Domain 2 Incident Response 14 percent, about 7 questions. Domain 3 Infrastructure Security 18 percent, about 9 questions. Domain 4 Identity and Access Management 20 percent, about 10 questions — the largest single domain. Domain 5 Data Protection 18 percent, about 9 questions. Domain 6 Security Foundations and Governance 14 percent, about 7 questions. The six weights total 100 percent and the derived counts total 50.
Read those weights as a budget rather than a table. Identity and Access Management is the heaviest domain at 20% — roughly ten scored questions ride on policy evaluation, temporary credentials, and authentication design, which is why the IAM domain gets four modules on this path. Infrastructure Security and Data Protection sit at 18% each: together, 36% of your score is "wall it off" and "encrypt it". Detection (16%) and Incident Response (14%) add another 30% — and they are taught in that order here, because you cannot respond to what you cannot see. Security Foundations and Governance (14%) is the smallest domain and the one candidates most often under-prepare; it is also where Organizations, Control Tower, SCPs, RCPs, and audit evidence live, which makes it the domain whose answers show up inside other domains' questions.
One arithmetic note that matters for self-assessment: the weights apply to the 50 scored questions, not the 65 you see. A domain drill that gives you nine Data Protection questions is a realistic sample of that domain's whole contribution to your score.
| SCS-C02 domain (until 1 Dec 2025) | SCS-C03 domain (from 2 Dec 2025) | What actually moved |
|---|---|---|
D1 Threat Detection and Incident Response — 14% | D1 Detection — 16% | C02 domains 1 and 2 were split and rebuilt, not renamed. Monitoring, alerting, and logging design all collect into the new Detection domain, which gains 2 points. |
D2 Security Logging and Monitoring — 18% | D2 Incident Response — 14% | Do not read this row as "logging became incident response". The rows are aligned by position only. Incident response was pulled out of old D1 and given its own domain, with response plans, automation, and root cause analysis. |
D3 Infrastructure Security — 20% | D3 Infrastructure Security — 18% | Same name, 2 points lighter. Host-based security and TCP/IP fundamentals came off the listed content; edge integrations using OCSF and generative-AI guardrails went on. |
D4 Identity and Access Management — 16% | D4 Identity and Access Management — 20% | The biggest single move: +4 points, now the heaviest domain. The listed content dropped the "components of a policy" primer and leaned harder on IAM Roles Anywhere, IAM paths, Verified Permissions, boundaries, and session policies. |
D5 Data Protection — 18% | D5 Data Protection — 18% | Unchanged in weight, most changed in content: inter-node encryption in transit, imported key material versus AWS-generated key material, external key stores, sensitive-data masking, and key and certificate management across multiple Regions. |
D6 Management and Security Governance — 14% | D6 Security Foundations and Governance — 14% | Renamed, same weight. Cost-driven gap analysis came off; centralised root access for member accounts, break-glass design, and declarative and AI service opt-out policies are the newer surface. |
Interactive sorting exercise: C02 or C03? Sort each marker. This is the only time on this course you will be asked to recognise the retired version — and it is the drill that stops you studying the wrong exam.
What C03 added is worth naming, because it is the part no older material covers:
- OCSF edge integrations — ingesting third-party data in Open Cybersecurity Schema Framework format, and using third-party WAF rule sets, as part of edge protection.
- Generative-AI guardrails — protections for GenAI applications, with the guide naming the OWASP Top 10 for LLM Applications as the threat frame. Securing a Bedrock application is now in scope for a security exam.
- Inter-node encryption in transit — not just client-to-service TLS but encryption between the nodes of EMR, EKS, and SageMaker AI workloads, plus Nitro-level encryption.
- Imported key material — managing and rotating key material you generated yourself, configuring external key stores, and being able to explain how imported material differs from AWS-generated material.
- Data masking — CloudWatch Logs data protection policies and Amazon SNS message data protection, as a control distinct from blocking or encrypting.
- Multi-Region key and certificate management — KMS customer managed keys and AWS Private Certificate Authority across Regions rather than in one.
- Validating findings from AWS security services to establish the real scope and impact of an event, rather than treating a finding as the conclusion.
And what came off the listed content: the AWS Security Finding Format by name, the AWS Security Incident Response Guide, CloudTrail log-format internals, host-based firewalls and host hardening, TCP/IP and OSI fundamentals, reachability analysis as its own skill, the "Principal, Action, Resource, Condition" policy primer, TLS concepts, public and private virtual interfaces for cross-Region networking, and S3 static website hosting. Read those as de-emphasised, not forbidden — the exam still expects you to read a policy document fluently. It just no longer teaches you how.
Format and timing
- 65 questions, 170 minutes — about 2 minutes 37 seconds each, and the new multi-part formats read slower than that average.
- 50 scored, 15 unscored. The unscored items are not marked. Treat all 65 as live.
- Four response types — multiple choice, multiple response, ordering, matching. The next lesson is entirely about them.
- Questions can be flagged and revisited. Plan a two-pass run rather than one perfect pass.
Scoring
- Scaled 100–1,000, pass at 750. The specialty line is higher than the associate line — do not carry a 720 target over from MLA-C02.
- Compensatory: the guide is explicit that you "do not need to achieve a passing score in each section".
- Your score report may include a table classifying performance per section. The guide urges caution interpreting it: with roughly seven to ten scored questions in a domain, one unlucky run is not a verdict on your knowledge.
- No penalty for guessing, and unanswered questions are scored as incorrect. There is never a reason to leave a blank.
Before the day
- Fee USD 300 as of October 2026; delivered at a test centre or by online proctoring.
- Book early enough that you can pick the time of day you actually think well — 170 minutes of careful reading is the real test.
- Check the current identification, retake, and recertification rules on the AWS certification policy pages rather than trusting a forum post; these change independently of the exam guide.
- The guide itself is short and free. Read it end to end at least twice: once now, once in your final week.
Key terms: SCS-C03, SCS-C02 (retired), Compensatory scoring, Scaled score, Unscored questions, Target candidate