How hard is the AWS Security Specialty exam? +
It is one of the harder AWS exams because it tests evaluation logic, not service names. Identity and Access Management is the heaviest domain, and questions hinge on how SCPs, permission boundaries, resource policies, and session policies combine - one overlooked explicit deny flips the answer. Scenarios are long and usually offer several workable controls, so you must pick the one that meets every stated constraint with the least overhead.
What is the SCS-C03 exam format? +
SCS-C03 has 65 questions in 170 minutes, delivered at a Pearson VUE test center or online with remote proctoring. Some items are unscored and used for research, and you cannot tell which. Alongside multiple choice and multiple response, C03 adds ordering and matching items. Those only score when every element is correct, so knowing most of an incident response sequence still earns nothing on that item.
What is the passing score for AWS Security Specialty? +
AWS reports results on a scaled score of 100 to 1,000, and you need 750 to pass. Scoring is compensatory, so you do not have to pass each domain individually - a strong IAM and data protection performance can offset weaker areas. Your score report shows performance by domain, which is the most useful input if you need to plan a retake.
What changed from SCS-C02 to SCS-C03? +
SCS-C03 replaced SCS-C02 in December 2025. The old logging-and-monitoring area was reorganized, with detection and incident response now separate domains, and the exam adds coverage of generative AI and machine learning security, including guardrails. It also introduced ordering and matching question types. Notes built around the C02 blueprint will leave gaps, so map your study to the current exam guide.
How much does the AWS Security Specialty cost and is there a prerequisite? +
The exam costs 300 USD, plus local taxes where applicable. There is no formal prerequisite, but AWS recommends around five years of IT security experience and at least two years securing AWS workloads. The certification is valid for three years. If you fail, AWS requires a 14-day wait before you can retake, and each attempt is charged in full.
How long should I prepare for SCS-C03? +
Engineers who already work with IAM, KMS, and VPC security daily usually need 6 to 10 weeks. Budget extra time for detection and incident response tooling such as GuardDuty, Security Hub, and Detective, and for the new AI security content. If policy evaluation logic is not second nature yet, spend your first weeks there - it underpins a large share of the exam.