AWS Certified Security Specialty: Study Plan
The AWS Certified Security Specialty (SCS-C03) exam tests securing AWS workloads across six domains: detection, incident response, infrastructure security, identity and access management (the largest at 20%), data protection, and security foundations and governance. AWS lists 65 questions in 170 minutes, US$300, and a minimum passing score of 750 on a 100 to 1,000 scale (AWS, checked 3 November 2026).
Below: the domains in our words, the PlayCISO exercises that match, and a study plan. This is not an AWS course; use AWS's own training for the services.
Updated 3 November 2026
Domains mapped to practice
Weights are AWS's percentages of scored content. The plain-words column is our summary.
| Domain | Weight | In plain words | Practise with |
|---|---|---|---|
| Detection | 16% | Logging, monitoring and finding suspicious activity. | Detection Lab |
| Incident Response | 14% | Containing and investigating a compromised resource or key. | Leaked Cloud Key Lab |
| Infrastructure Security | 18% | Network controls, firewalls, edge protection. | Security Group Auditor, CIS AWS benchmark checklist |
| Identity and Access Management | 20% | Who can do what: policies, roles, federation, least privilege. | IAM Privilege Escalation Lab, IAM Policy Analyzer |
| Data Protection | 18% | Encryption, key management and storage access. | S3 Bucket Policy Auditor |
| Security Foundations and Governance | 14% | Multi-account structure, shared responsibility, audit and compliance. | Cloud Posture Lab |
Study plan
- Read the exam guide. Note the in-scope services list on AWS's site.
- Start with IAM. It is the largest domain; work on reading and writing policies until you can explain every statement.
- Add logging and detection, then network and data protection.
- Practise on a real account. Use AWS training or a sandbox account, and set a budget alert.
- Finish with scenario practice, writing a short response plan for a leaked key and an open bucket.
Pair this with a foundation exam if you are new to security: see the certifications guide.
Frequently asked questions
What is the AWS Certified Security Specialty exam?
It is AWS's specialty certification for people responsible for securing cloud solutions on AWS. The current exam code in AWS's exam guide is SCS-C03. AWS lists 65 questions in 170 minutes and a cost of US$300 (AWS, checked 3 November 2026).
What are the exam domains?
AWS's exam guide lists six, with weights of scored content: Detection (16%), Incident Response (14%), Infrastructure Security (18%), Identity and Access Management (20%), Data Protection (18%), and Security Foundations and Governance (14%).
What is the pass mark?
AWS reports a scaled score of 100 to 1,000 with a minimum passing score of 750. Of the questions, 50 affect your score and 15 are unscored (AWS exam guide, checked 3 November 2026).
What experience does AWS expect?
The AWS certification page says the exam is for people with five years of IT security experience and two or more years of hands-on experience securing AWS workloads. The exam guide describes the target candidate as having the equivalent of 3 to 5 years securing cloud solutions. These are recommendations rather than prerequisites.
How long should I study?
Our planning estimate in the certification roadmap is about 90 hours for someone who already works with AWS. It is an estimate, not an AWS figure.
Is this the right exam for me?
It suits cloud security engineers, security architects and DevSecOps staff who work in AWS daily. If you are new to security, start with a foundation exam; if your cloud is not AWS, a different vendor exam may fit better.
Does PlayCISO teach AWS services?
No. PlayCISO offers practice on cloud security concepts such as permission analysis, storage policy review and leaked key response in browser exercises. You still need an AWS account or AWS training to practise the services themselves.