SCS-C03 — AWS Certified Security – Specialty

Secure the whole AWS estate — detect and respond to threats, harden the network and compute edges, master IAM policy evaluation, protect data with KMS, and govern a multi-account organization.

65 questions · 170 min · scaled 100–1,000 · pass 750

Stage 13: Learn the ground you defend

What SCS-C03 is, its four question formats (including the new ordering and matching items), shared responsibility, and the security service map every scenario assumes.

  • The SCS-C03 Exam — What SCS-C03 actually is: six domains and their weights, 50 scored questions inside a 65-question form, the four response formats — including the new ordering and matching items — and how a security scenario question is engineered to make several wrong answers look right.
  • Shared Responsibility and the Security Map — Where the AWS line sits and what stands behind it: shared responsibility service by service (EC2, Lambda, Fargate, RDS, S3), every in-scope security service placed on one board by the job it does, and the layered, blast-radius thinking the exam rewards.

Stage 14: See everything

Domain 1 at 16% — monitoring and alerting, the logging architecture, log analysis at scale, and why logs go missing.

  • Monitoring and Alerting — Turning a workload into monitoring requirements: the four shapes a security signal takes, EventBridge as the spine, GuardDuty end to end, Security Hub as the aggregator, and Macie, Config and State Manager running continuous assessment.
  • The Logging Architecture — The evidence layer: CloudTrail management, data and Insights events with organization trails and CloudTrail Lake, CloudWatch Logs from agent to subscription filter, choosing network and service logs by threat, and making the record tamper-resistant.
  • Log Analysis at Scale — Reading terabytes without drowning: Security Lake and the OCSF normalization that makes a common query possible, picking between Logs Insights, Athena, OpenSearch and Managed Grafana on cost and latency, and correlating sources into one incident timeline.
  • Troubleshooting Detection — The lesson every exam asks and no course teaches: an ordered checklist for missing logs, the per-service logging gaps in Lambda, API Gateway, CloudFront and Route 53, and the remediation patterns that keep a fix from drifting back.

Stage 15: Respond without making it worse

Domain 2 at 14% — response plans and prepared access, automated remediation and forensics, then the containment ladder and root-cause analysis.

  • Designing the Response — The plan you write before the pager goes off: the incident response lifecycle, runbooks versus playbooks, severity and escalation, OpsCenter and Incident Manager, pre-provisioned responder roles and a forensics account, and Shield Advanced protections configured ahead of the DDoS you expect.
  • Automated Response and Forensics — Machinery that responds faster than a human can log in: finding to EventBridge to target, choosing between Lambda, Systems Manager Automation and Step Functions, Application Recovery Controller for recovery orchestration, the Automated Forensics Orchestrator for Amazon EC2, and Fault Injection Service game days that prove the whole thing works.
  • Responding to Security Events — The live response, in the order that preserves your options: validate the finding and scope it, capture evidence before you change anything, climb the containment ladder (including revoking sessions that a detached policy would not touch), eradicate persistence, recover without reinfection, and prove root cause with Amazon Detective.

Stage 16: Harden the perimeter and the host

Domain 3 at 18% — edge protection with CloudFront, WAF and Shield; compute hardening and vulnerability management; network controls and hybrid connectivity.

  • Protecting the Edge — The first hit lands here: choosing edge controls from the threat you actually expect, CloudFront as a security boundary with Origin Access Control and signed URLs, WAF web ACLs engineered rule by rule with priority and labels, and Shield Standard versus Shield Advanced for DDoS resilience.
  • Securing Compute Workloads — Everything that runs your code: golden AMIs and hardened container images built by pipeline, the three role shapes that authorize a workload, IMDSv2, Inspector versus GuardDuty Runtime Monitoring, Patch Manager against immutable rebuilds, Session Manager instead of SSH keys, and guardrails for pipelines and generative-AI applications.
  • Network Security Controls — The most-tested network facts on the exam: stateful security groups against stateless NACLs and their ephemeral ports, AWS Network Firewall with stateless, stateful and Suricata rules, segmentation for north/south and east/west traffic, and the tools that prove nobody needs the access you granted.
  • Hybrid and Private Connectivity — Stitching AWS to everything else without losing the encryption argument: Site-to-Site VPN tunnels, Direct Connect virtual interfaces and MACsec, Client VPN against Verified Access for user access, and Route 53 Resolver DNS Firewall for the attack surface everyone forgets.

Stage 17: Decide who may do what

Domain 4 at 20%, the heaviest on the exam — authentication, temporary credentials, the full policy-evaluation chain, and reviewing access you already granted.

  • Authentication Strategies — Establishing who the caller is: IAM Identity Center and permission sets as the answer for human access at scale, SAML 2.0 and OIDC federation mechanics, Cognito user pools versus identity pools, the Directory Service options, MFA enforcement that actually fails closed, root user credential management — and a diagnostic method for when sign-in breaks.
  • Temporary Credentials — Short-lived credentials end to end: the five AWS STS operations and when each applies, the two-policy role model, session duration and the one-hour role-chaining cap, cross-account trust and the confused-deputy defences, IAM Roles Anywhere for workloads off AWS, S3 presigned URLs, and the narrowing-only power of session policies and session tags.
  • Policy Evaluation — The chain that decides every single request: an explicit deny anywhere wins, and then every applicable layer — organization policies, resource policy, permissions boundary, session policy, identity policy — must allow it. Reading policy documents precisely, the condition keys the exam leans on, cross-account authorization service by service, and the four capping policy types compared.
  • Designing and Reviewing Access — Designing access you can defend, then proving it is not too wide: ABAC with principal and resource tags against RBAC with permission sets, evidence-driven least privilege from last-accessed data and generated policies, application authorization with Amazon Verified Permissions and Cedar, and finding and fixing over-permission with IAM Access Analyzer.

Stage 18: Protect the data itself

Domain 5 at 18% — KMS and envelope encryption, enforcing encryption in transit, immutability and encryption at rest, secrets and ransomware resilience.

  • KMS, Keys, and Certificates — The cryptographic foundation: envelope encryption and encryption context, the three key types and the key policy that is the root of a key’s authority, grants and kms:ViaService, multi-Region keys, CloudHSM and external key stores, imported key material, and certificates from ACM and Private CA.
  • Protecting Data in Transit — Making encryption on the wire non-optional: ELB security policies and TLS termination choices, explicit denies on aws:SecureTransport, PrivateLink and VPC endpoints as private paths you can require, and inter-node encryption for EMR, EKS, SageMaker AI, and the Nitro System.
  • Protecting Data at Rest — Every S3 encryption option and the requirement each one satisfies, the four-layer S3 access decision and how to troubleshoot it, Object Lock and Vault Lock for WORM and integrity, and encryption for EBS volumes, file systems, and databases — including the snapshot-sharing rules.
  • Secrets, Masking, and Resilience — Credentials that rotate themselves, sensitive data masked in logs and messages before an operator can read it, backups that survive a compromised administrator, and lifecycle rules that retain data exactly as long as the obligation lasts — no longer.

Stage 19: Govern the whole organization

Domain 6 at 14% — Organizations and Control Tower, SCPs and the newer RCPs, consistent deployment, and proving compliance to an auditor.

  • The Multi-Account Foundation — The organization as the security boundary: Organizations structure, trusted access and delegated administrators, Control Tower landing zones and the three kinds of control, SCPs and the newer RCPs, and root credentials at organization scale.
  • Consistent, Secure Deployment — Making every account and every new resource inherit the control: StackSets across accounts and Regions, CloudFormation Guard and cfn-lint shifting policy left, Firewall Manager and Config organization rules enforcing from a central source, tags as the organizing device, and safe sharing with RAM and Service Catalog.
  • Compliance and Audit Evidence — Proving it: Config rules with automatic remediation and aggregated compliance, Audit Manager assessments and automated evidence collection, Artifact for AWS’s own reports, and the Well-Architected Tool, Trusted Advisor and Security Hub as three different instruments for measuring an architecture.

Stage 20: Walk in ready

Question anatomy, the keyword reflexes, the traps that sink strong engineers, and a final-week plan — then the full mock in the Exam Hall.

  • Exam Readiness — The capstone: dissecting a security stem down to the clause that decides it, a dense phrase-to-service reflex table across all six domains, the traps that sink engineers who actually know AWS, and a day-by-day final week that ends in the Exam Hall.