AWS certification · Security specialty
AWS Certified Security – Specialty (SCS-C03) Practice Exam
Practice with domain-based tests, read the explanation instantly and review your mistakes until you master them. Free, no sign-up, and also available as an Android app.
Start a practice test Read the exam guide
150+ practice questions · practice mode and exam mode · spaced repetition
The SCS-C03 exam in four numbers
Data from the official certification page and the exam guide from AWS.
What is the AWS Certified Security – Specialty certification?
AWS Certified Security – Specialty is the AWS certification for people responsible for securing cloud solutions. The exam validates your ability to demonstrate knowledge about securing AWS products and services. The current version is SCS-C03.
AWS describes the target candidate as having the equivalent of 3–5 years of experience securing cloud solutions. Read the complete SCS-C03 exam guide for the recommended knowledge, the question types and how the exam is scored.
The 6 exam domains and their weight
The exam is split into six domains. Studying according to the weight of each one is the most efficient way to prepare:
| Domain | Content | Weight |
|---|---|---|
| 1 | Detection | 16% |
| 2 | Incident Response | 14% |
| 3 | Infrastructure Security | 18% |
| 4 | Identity and Access Management | 20% |
| 5 | Data Protection | 18% |
| 6 | Security Foundations and Governance | 14% |
Study topics with official sources
Each topic collects the facts from the official AWS documentation that exam questions tend to hinge on, with a link to the page every fact comes from.
IAM policy evaluation, SCPs and boundaries
How AWS evaluates IAM policies: explicit deny, permissions boundaries, SCPs and RCPs, with the exact rules to know for the SCS-C03 exam.
Confused deputy, External ID and presigned URLs
Give third parties and AWS services access safely: External ID, aws:SourceArn and aws:SourceAccount, RCPs and S3 presigned URL expiration.
IAM Access Analyzer
What IAM Access Analyzer finds: external, internal and unused access, plus policy validation, custom policy checks and policy generation.
AWS KMS keys, rotation and deletion
AWS KMS exam notes: key policies vs IAM, key administrators vs users, automatic and on-demand rotation, key deletion and imported key material.
S3 Object Lock, Macie and Secrets Manager
Governance vs compliance mode, legal holds, Macie findings and discovery jobs, and Secrets Manager rotation for the AWS Security Specialty exam.
GuardDuty, CloudTrail and AWS Config
GuardDuty data sources, CloudTrail log file integrity validation and AWS Config rules, conformance packs and aggregators for the SCS-C03 exam.
Security groups, NACLs, VPC endpoints and WAF
Security groups vs NACLs, S3 gateway vs interface endpoints, Session Manager logging limits and AWS WAF rate-based rules for the SCS-C03 exam.
Incident response: compromised EC2 and credentials
Contain a compromised EC2 instance and leaked IAM credentials: memory capture, security groups vs NACLs, access keys and temporary credentials.
How the practice exam works
⚡ Practice mode with instant feedback
Answer, check right away and read the key rule that explains why the correct option wins. You learn at the exact moment of the mistake.
⏱ Exam mode
Answer with no hints and get graded at the end, as in the real exam, then review every question with its explanation.
😎 Confidence level
Before checking you say whether you guessed, doubted or were sure. A lucky guess does not count as learned, and being sure but wrong is the mistake that is best corrected.
📌 Incorrect questions bank
Whatever you miss goes into a separate bank and only leaves it when you get it right. Keep taking tests without losing a single hard question.
🧠 Spaced repetition
A Leitner box system shows you questions again exactly when they are due: today, tomorrow, in three days, in a week.
🔔 A tip every 3 hours on Android
The Android app sends you security tips based on official AWS documentation, each with a link to its source.
AWS Security Specialty exam FAQ
How many questions does the AWS Security Specialty SCS-C03 exam have?
The exam has 65 questions. Of those, 50 affect your score and 15 are unscored questions that AWS uses to evaluate future content; they are not identified during the exam.
How long is the SCS-C03 exam?
It lasts 170 minutes, which is about 2 minutes and 37 seconds per question if you split the time evenly.
What is the passing score for AWS Certified Security – Specialty?
The minimum passing score is 750 on a scaled score of 100 to 1,000. The result is pass or fail, and the scoring model is compensatory: you do not need to pass each section, only the exam as a whole.
How much does the AWS Security Specialty exam cost?
The official price listed by AWS is 300 USD. It can vary with exchange rates, so check the local price on the official AWS page.
What are the SCS-C03 exam domains?
There are six: Detection (16%), Incident Response (14%), Infrastructure Security (18%), Identity and Access Management (20%), Data Protection (18%) and Security Foundations and Governance (14%).
Is this practice test official AWS content?
No. This is an independent practice site with no affiliation with Amazon Web Services. Exam facts come from the official guide that AWS publishes, and you should always check that guide for current information.