SCS-C03 study guide · 2026

The 6 SCS-C03 domains, explained

6 domains and 16 official task statements. Identity and Access Management carries the most weight at 20%. Each guide explains what the domain covers, how its questions are framed and where candidates lose marks.

Start with Domain 4 See all domains
Questions
65 (50 scored, 15 unscored)
Time
170 minutes
Passing score
750 / 1000
Outline
SCS-C03 exam guide v1.0, March 26, 2026 (current; SCS-C03 live since December 2, 2025)

Exam blueprint

Bar widths follow the official weights. Weight ranges are drawn at their midpoint.

  1. 1 16%
  2. 2 14%
  3. 3 18%
  4. 4 20%
  5. 5 18%
  6. 6 14%
  1. 1 Detection
  2. 2 Incident Response
  3. 3 Infrastructure Security
  4. 4 Identity and Access Management
  5. 5 Data Protection
  6. 6 Security Foundations and Governance

All 6 domains

16 official task statements 80–106 hrs suggested study

  1. Domain 01 16%

    Detection

    Domain 1 tests how you see threats in AWS: designing monitoring and alerting for an account or organization, building logging pipelines and data lakes, and fixing detection setups that fail silently.

    Inside this domain

    • Design and implement monitoring and alerting solutions for an AWS account or organization
    • Design and implement logging solutions
    • Troubleshoot security monitoring, logging, and alerting solutions

    Watch for Flow Logs for DNS

    Task statements
    3
    Questions est.
    ~8
    Study time est.
    12–16 hrs
  2. Domain 02 14%

    Incident Response

    Domain 2 covers what happens after a finding: preparing and testing a response plan, automating remediation, preserving forensic evidence, containing and recovering affected resources and finding the root cause.

    Inside this domain

    • Design and test an incident response plan
    • Respond to security events

    Watch for Terminate first

    Task statements
    2
    Questions est.
    ~7
    Study time est.
    10–14 hrs
  3. Domain 03 18%

    Infrastructure Security

    Domain 3 covers protecting the infrastructure itself: edge services against web and DDoS attacks, compute workloads from build to runtime, generative AI applications, and the network paths between VPCs, on-premises sites and other clouds.

    Inside this domain

    • Design, implement, and troubleshoot security controls for network edge services
    • Design, implement, and troubleshoot security controls for compute workloads
    • Design and troubleshoot network security controls

    Watch for NACL for application attacks

    Task statements
    3
    Questions est.
    ~9
    Study time est.
    16–20 hrs
  4. Domain 04 20%

    Identity and Access Management

    Domain 4 is the largest on SCS-C03. It tests how people, applications and systems prove who they are on AWS and how you grant, limit, troubleshoot and clean up what they can do.

    Inside this domain

    • Design, implement, and troubleshoot authentication strategies
    • Design, implement, and troubleshoot authorization strategies

    Watch for Allow fixes deny

    Task statements
    2
    Questions est.
    ~10
    Study time est.
    16–22 hrs
  5. Domain 05 18%

    Data Protection

    Domain 5 covers protecting data in every state: enforcing encryption and private paths in transit, choosing encryption, integrity and retention controls at rest, and managing secrets, keys, certificates and sensitive values.

    Inside this domain

    • Design and implement controls for data in transit
    • Design and implement controls for data at rest
    • Design and implement controls to protect confidential data, credentials, secrets, and cryptographic key materials

    Watch for Governance for strict retention

    Task statements
    3
    Questions est.
    ~9
    Study time est.
    16–20 hrs
  6. Domain 06 14%

    Security Foundations and Governance

    Domain 6 covers the account and policy foundation that every other control rests on: structuring AWS accounts centrally, deploying resources consistently and securely, and proving that resources stay compliant.

    Inside this domain

    • Develop a strategy to centrally deploy and manage AWS accounts
    • Implement a secure and consistent deployment strategy for cloud resources
    • Evaluate the compliance of AWS resources

    Watch for Config rule for prevention

    Task statements
    3
    Questions est.
    ~7
    Study time est.
    10–14 hrs

Study the heaviest domains first

Marks follow weight. This order puts the most marks behind you first, across about 80–106 hrs of study.

  1. 4 Identity and Access Management 20% · 16–22 hrs
  2. 3 Infrastructure Security 18% · 16–20 hrs
  3. 5 Data Protection 18% · 16–20 hrs
  4. 1 Detection 16% · 12–16 hrs
  5. 2 Incident Response 14% · 10–14 hrs
  6. 6 Security Foundations and Governance 14% · 10–14 hrs

Try one

Practice questionDomain 4: Identity and Access Management

A company's security team lets developers create IAM roles for Lambda functions but must stop developers from giving any role more permissions than the developers have. Developers must not be able to remove the restriction. Which approach meets this requirement?

One trap from every domain

The answer that looks right, and the clue that gives it away.

  • Domain 1

    Flow Logs for DNS

    Clue The question mentions domains, DNS or command-and-control lookups.

  • Domain 2

    Terminate first

    Clue The scenario mentions investigation, forensics or legal requirements.

  • Domain 3

    NACL for application attacks

    Clue Payload or request content is the problem.

  • Domain 4

    Allow fixes deny

    Clue The error persists for a user who already has an allow.

  • Domain 5

    Governance for strict retention

    Clue No one, including administrators, may delete.

  • Domain 6

    Config rule for prevention

    Clue The scenario says must not be able to.

Other Cybersecurity certifications

Study guides for exams that overlap with SCS-C03.

Practise what you read

SCS-C03 domains: common questions

How many domains are in the SCS-C03 exam?

SCS-C03 has 6 domains with 16 official task statements between them: Detection, Incident Response, Infrastructure Security, Identity and Access Management, Data Protection and Security Foundations and Governance.

Which SCS-C03 domain carries the most weight?

Identity and Access Management is the heaviest at 20%, followed by Infrastructure Security (18%). The lightest is Security Foundations and Governance (14%). Weights come from Amazon Web Services's official outline.

What is the SCS-C03 exam format?

Questions: 65 (50 scored, 15 unscored). Time allowed: 170 minutes. Passing score: 750 / 1000.

How long should I study for SCS-C03?

Our planning estimate is 80–106 hrs across all domains, split by weight. It is an editorial estimate, not an official figure, so adjust it to your experience and to how you score on practice questions.

Where should I start?

Start with Identity and Access Management, because it carries the most marks, then work down by weight. Use the checklist on each domain page to confirm you can do what the domain asks before moving on.

Which outline is this guide based on?

This guide follows SCS-C03 exam guide v1.0, March 26, 2026 (current; SCS-C03 live since December 2, 2025), published by Amazon Web Services. It was last reviewed in October 2026.

Domain names, weights and task statements come from Amazon Web Services's official outline (SCS-C03 exam guide v1.0, March 26, 2026 (current; SCS-C03 live since December 2, 2025)). Question counts and study hours are editorial planning estimates, not official figures. Last reviewed October 2026.