AWS Security Specialty: is it worth it, and what's tested

The AWS Certified Security – Specialty is worth it if you secure AWS workloads for a living or want to: it's the AWS exam dedicated to detection, incident response, IAM, network controls and encryption, and AWS pitches it at people with three to five years of experience securing cloud solutions. The current version is SCS-C03, which replaced SCS-C02 on 2 December 2025, so anything you read that lists SCS-C02's domains is out of date. It costs US$300 as of November 2026, runs 170 minutes, and needs 750 out of 1,000 to pass.

This guide covers who should take it and who shouldn't yet, what changed in SCS-C03, the six domains and the new question types, the closed services you shouldn't pick even though the exam guide still names them, how it compares with CISSP, and how to prepare. Facts were checked on AWS's certification pages on 4 November 2026.

AWS Security Specialty at a glance

• Certification: AWS Certified Security – Specialty, exam code SCS-C03, Specialty level.
• Status: live. SCS-C03 has been in use since 2 December 2025. The Simplified Chinese, Spanish (Latin America) and Portuguese (Brazil) versions retire after 31 December 2026; English, Japanese and Korean stay.
• Who it's for: people responsible for securing cloud solutions, with the equivalent of three to five years' experience doing so.
• Prerequisites: none required. AWS notes that candidates commonly earn Solutions Architect – Associate, Professional, or both first.
• Format: 65 questions in 170 minutes: 50 scored and 15 unscored, not marked.
• Question types: multiple choice, multiple response, ordering and matching.
• Passing score: 750 on a 100-1,000 scale, scored across the whole exam.
• Price: US$300, or ₹25,659 with a rupee voucher from Pearson's voucher store, plus tax, as of November 2026.
• Delivery: Pearson VUE test centre or online proctoring.
• Validity: three years.

Is the AWS Security Specialty worth it?

It depends on your role more than on the badge.

• Cloud security engineers on AWS: yes. The exam matches the job closely: GuardDuty and Security Hub findings, incident response, IAM policy design across accounts, network controls, KMS and secrets. Preparing for it fills gaps you didn't know you had.
• Solutions architects and DevOps engineers on AWS: often yes, as a second certification after an associate exam. Security is the largest domain of Solutions Architect – Associate already, and the Specialty takes it much deeper.
• Security people who don't work on AWS: probably not yet. A broad, vendor-neutral certification such as CISSP, or the platform your employer actually uses, will count for more.
• Beginners: not yet. With three to five years of experience as the target, and a 750 pass mark, it isn't a first certification. Start with fundamentals and an associate exam.

What changed from SCS-C02 to SCS-C03

AWS's comparison shows the domains were reorganised rather than replaced:

• Detection: SCS-C02 combined threat detection and incident response (14%) and had a separate logging and monitoring domain (18%). / SCS-C03 splits the work into Detection (16%) and Incident Response (14%).
• Infrastructure Security: SCS-C02: 20%. / SCS-C03: 18%.
• Identity and Access Management: SCS-C02: 16%. / SCS-C03: 20%, now the largest domain.
• Data Protection: 18% in both.
• Governance: SCS-C02's Management and Security Governance (14%) is renamed Security Foundations and Governance (14%).

New content includes implementing protections and guardrails for generative AI applications (AWS gives the OWASP Top 10 for LLM Applications as the example), integrating edge and third-party services (including data in the Open Cybersecurity Schema Framework format), encryption in transit between nodes of services such as EMR and EKS, the difference between imported and AWS-generated key material, masking sensitive data in CloudWatch Logs and SNS messages, and managing keys and certificates across Regions with KMS and AWS Private CA.

AWS also removed content: basic TCP/IP networking concepts, host-based firewalls, S3 static website hosting, the AWS Security Finding Format (ASFF) and the anatomy of an IAM policy. The exam assumes you know those basics rather than testing them.

The six SCS-C03 domains

1. Detection (16%). Monitoring and alerting for an account or a whole organisation, designing logging, and troubleshooting when monitoring fails. A practice question on GuardDuty threat detection and one on an organisation trail with log file validation show the associate-level version of this domain.
2. Incident Response (14%). Designing and testing a response plan, responding to events, and validating findings to judge an event's scope and impact.
3. Infrastructure Security (18%). Controls for edge services, compute workloads (including the new generative AI guardrails) and networks.
4. Identity and Access Management (20%). Authentication and authorisation strategies, designed and troubleshot. A practice question on IAM permissions boundaries is a good warm-up for the delegation questions here.
5. Data Protection (18%). Data in transit and at rest, and protecting secrets and key material. Two practice questions cover the basics: one on cross-account KMS key policies and one on discovering sensitive data with Macie.
6. Security Foundations and Governance (14%). Managing accounts centrally, deploying resources consistently and securely, and evaluating compliance. The service control policies guide covers the multi-account controls this domain leans on.

Question types and scoring

SCS-C03 adds two question types that most AWS exams don't use. An ordering question gives you 3-5 steps to put in the right sequence, such as the steps of an incident response; a matching question asks you to pair 3-7 prompts with their answers. You must get every step or pair right to earn the mark, so there's no partial credit.

There's no penalty for guessing, so answer everything. The pass mark of 750 is higher than the 720 of the associate exams, and the scoring is compensatory: a strong IAM section can carry a weaker governance one.

Closed services in the in-scope list

The SCS-C03 exam guide still lists some services that AWS has since closed to new customers, among them AWS CloudTrail Lake (closed to new customers from 31 May 2026) and Amazon Q Business. For a real design, don't reach for them. AWS's advice for CloudTrail Lake users is an organisation trail delivering to S3, queried with Athena. If an exam question offers one of these, read the requirement carefully; for your own work, use what AWS recommends now.

AWS Security Specialty vs CISSP

People often compare the two, but they measure different things:

• Scope: SCS-C03: securing AWS specifically, hands-on. / CISSP: security management and architecture across eight vendor-neutral domains, from risk management to software security.
• Experience: SCS-C03: three to five years recommended, nothing required. / CISSP: five years' paid experience in two or more domains required to be certified (a degree or approved certification can waive one year).
• Exam: SCS-C03: 65 questions in 170 minutes, online or at a test centre. / CISSP: 100-150 adaptive questions in three hours, at Pearson VUE test centres only.
• Price: SCS-C03: US$300. / CISSP: US$749 in the Americas and Asia-Pacific, as of November 2026.
• Keeping it: SCS-C03: renew every three years. / CISSP: 120 Continuing Professional Education (CPE) credits over three years plus a US$135 annual maintenance fee.

If you're an engineer securing AWS, take the Specialty. If you're moving toward security leadership or roles that need a vendor-neutral credential, CISSP is the better fit, and the two don't overlap much, so holding both is reasonable later on. For the wider choice across AWS, Azure, Google and Kubernetes security exams, see best cloud security certification.

What to take first

A sensible order for most people is Solutions Architect – Associate, then the Security Specialty. SAA-C03 gives you the design vocabulary (VPCs, IAM, KMS, multi-account setups) that the Specialty assumes, and 30% of it is security already; the SAA-C03 exam guide covers it, the SAA-C03 cert page has its tests, and the SAA-C03 practice questions include many of the security scenarios linked above. If security concepts themselves are new to you, start lower: the security fundamentals cert page and security fundamentals practice questions cover ideas such as authentication versus authorisation. The AWS certification roadmap shows where the Specialty sits among the rest.

Cost and renewal

The exam costs US$300 as of November 2026, or ₹25,659 plus tax with a rupee voucher from Pearson's voucher store. If you've passed another AWS exam, its 50% discount voucher brings the Specialty down to US$150, so taking both costs US$300 instead of US$450.

The certification is valid for three years. You renew by passing the current version again, with a 50% discount, or keep it for one more year through a paid AWS Skill Builder subscription.

How to prepare

Allow eight to ten weeks if you already hold an associate certification and work with AWS security daily, and longer if not.

1. Read the SCS-C03 exam guide and its appendix comparing it with SCS-C02, so you don't study removed topics.
2. Work through IAM in depth, since it's now the largest domain: policy evaluation across accounts, permissions boundaries, SCPs, and federation. The IAM roles, users and policies guide is a starting point.
3. Build a detection and response lab: turn on GuardDuty, Security Hub and an organisation CloudTrail trail, generate sample findings, and write down your response steps in order, which also prepares you for the ordering questions.
4. Practise encryption: KMS key policies, cross-account keys, imported key material, and Secrets Manager rotation.
5. Add the new topics: generative AI guardrails, data masking in CloudWatch Logs, and multi-Region keys and certificates.
6. Test yourself with AWS's free 20-question Official Practice Question Set and free exam prep course, then the security questions here.

Frequently asked questions

Is the AWS Security Specialty worth it?

Yes, if you secure AWS workloads or want to; it's the deepest AWS exam on security and matches the job closely. It's less useful if you don't work on AWS, and it isn't a beginner certification.

What is the difference between SCS-C02 and SCS-C03?

SCS-C03 replaced SCS-C02 on 2 December 2025. It splits detection and incident response into separate domains, makes IAM the largest at 20%, adds generative AI guardrails, data masking and multi-Region key management, and removes basics such as TCP/IP concepts and host-based firewalls.

How hard is the AWS Security Specialty exam?

Harder than the associate exams: the pass mark is 750 rather than 720, the questions assume years of hands-on security work, and ordering and matching questions give no partial credit. AWS notes that many candidates hold Solutions Architect – Associate first.

What are the prerequisites for the AWS Security Specialty?

None are required. AWS recommends three to five years of experience securing cloud solutions and notes that many candidates hold Solutions Architect – Associate or Professional first.

How much does the AWS Security Specialty cost?

US$300, or ₹25,659 plus tax with a rupee voucher, as of November 2026. A 50% voucher from a previous AWS pass halves it.

Can a beginner take the AWS Security Specialty?

Anyone can book it, since there are no prerequisites, but it isn't written for beginners. AWS pitches it at three to five years of experience securing cloud solutions. If you're new, start with security fundamentals and Solutions Architect – Associate, then come back to the Specialty once you've worked with AWS security services on real systems.