This page explains what AWS Certified Security - Specialty (SCS-C03) actually tests, domain by domain, in plain English. It is a planning aid, not a copy of the official document - always confirm details against the official SCS-C03 exam guide before you book. Weights below are the official share of scored content.
Domain 1 - Detection (16%)
Seeing what is happening across your AWS environment.
- Detection tooling: what Amazon GuardDuty, AWS Security Hub, Amazon Inspector and Amazon Detective each do, and when to reach for which.
- Logging strategy: AWS CloudTrail (management vs data events), VPC Flow Logs, DNS and service logs - what each source can and cannot tell you.
- Monitoring and alerting: turning logs into signals with Amazon CloudWatch, metric filters and alarms; routing findings with Amazon EventBridge.
- Configuration awareness: AWS Config rules and conformance checks as a drift-detection layer.
- Normalising findings: aggregating security data across accounts and tools, including OCSF-format integrations (new in C03).
Domain 2 - Incident Response (14%)
What you do when detection fires.
- Preparation: incident response plans, playbooks and runbooks for AWS; pre-provisioned forensics accounts and access paths.
- Containment concepts: isolating compromised compute (security-group changes, removing instances from service) while preserving evidence.
- Evidence handling: EBS snapshots, memory-capture considerations, log preservation and chain-of-custody thinking in a cloud context.
- Credential compromise response: revoking and rotating exposed keys and roles, and auditing what they touched.
- Automation: using EventBridge rules and automated workflows to respond to findings at machine speed.
Domain 3 - Infrastructure Security (18%)
Protecting networks and compute at layers 3 through 7.
- Network boundaries: security groups vs network ACLs, subnet design, and where each control sits.
- Edge protection: AWS WAF for application-layer filtering, AWS Shield for DDoS resilience, CloudFront as a protective edge.
- Deeper network controls: AWS Network Firewall, VPC endpoints for private service access, and traffic inspection patterns.
- Compute security: hardening EC2 access with AWS Systems Manager Session Manager instead of open SSH, instance metadata protections, and workload isolation.
- Vulnerability management: identifying and prioritising software vulnerabilities in EC2, containers and Lambda.
Domain 4 - Identity and Access Management (20%)
The largest domain - who can do what, and how AWS decides.
- Policy evaluation: how AWS combines identity-based policies, resource-based policies, service control policies (SCPs), permissions boundaries and session policies - and why an explicit deny always wins.
- Policy craft: reading and writing JSON policies, condition keys, and least-privilege refinement.
- Temporary credentials: IAM roles, AWS STS, role assumption across accounts, and protections such as external IDs.
- Workforce and federation: AWS IAM Identity Center, identity federation, and multi-account human access.
- Troubleshooting access: diagnosing why a request was allowed or denied - a signature SCS-C03 scenario style.
Domain 5 - Data Protection (18%)
Keeping data safe at rest and in transit.
- AWS KMS in depth: key types (AWS managed vs customer managed), key policies vs IAM policies, grants, envelope encryption, multi-Region keys, and imported key material.
- Encryption in transit: TLS with AWS Certificate Manager (ACM), AWS Private CA for internal certificates, and node-to-node encryption for services such as EMR and EKS (expanded in C03).
- Storage encryption: S3 encryption options and their audit differences, EBS and RDS encryption behaviour.
- Secrets: AWS Secrets Manager vs Systems Manager Parameter Store, and automatic rotation.
- Sensitive-data discovery and masking: Amazon Macie for finding sensitive data, plus data protection policies for masking in CloudWatch Logs and SNS (new in C03).
Domain 6 - Security Foundations and Governance (14%)
The frame everything else hangs on.
- Shared responsibility model: what AWS secures vs what you secure, and how the split shifts between EC2, containers and managed services.
- Multi-account governance: AWS Organizations, SCP guardrails, AWS Control Tower and landing-zone thinking.
- Compliance evidence: AWS Artifact for auditor reports, and how AWS services support compliance programmes.
- Governance tooling: AWS Trusted Advisor checks, tagging strategy, and centralising security operations across accounts.
- Emerging scope: securing generative-AI applications, including awareness of the OWASP Top 10 for LLM applications (new in C03).
What is explicitly out of scope
The official guide lists tasks the target candidate is not expected to do: designing cryptographic algorithms, packet-level network analysis, whole-cloud architecture design, end-user computing management, and training machine-learning models. Do not sink study time there.