Baitaphish
Security intelligence
SearchLatest briefing
Unofficial study guide · Amazon Web Services

AWS Certified Security - Specialty

An unofficial, domain-weighted plan for experienced cloud security practitioners preparing for SCS-C03.

Exam code SCS-C03 · Scope SCS-C03 · Reviewed

How to use this guide

This guide assumes the official target profile: roughly three to five years securing cloud solutions. It is a review map, not a substitute for operational experience or the current AWS exam guide.

Study across failure modes and control interactions. A question framed as identity may turn on logging, key policy, organization boundaries, or incident containment.

Official domain map

D1 · 16%

Threat Detection

  • Design monitoring and alerting
  • Implement logging
  • Troubleshoot monitoring and logging
D2 · 14%

Incident Response

  • Design and test incident response plans
  • Respond to security events
D3 · 18%

Infrastructure Security

  • Design edge controls
  • Design compute controls
  • Design network controls
D4 · 20%

Identity and Access Management

  • Design and implement authentication
  • Design and implement authorization
D5 · 18%

Data Protection

  • Protect data in transit
  • Protect data at rest
  • Protect secrets and key material
D6 · 14%

Management and Security Governance

  • Manage accounts centrally
  • Deploy resources securely and consistently
  • Evaluate compliance

The official guide combines threat detection and incident response in its first domain; use the official task statements as the authority if labels in third-party material differ.

Prioritize IAM by weight, but practice it together with Organizations, resource policies, encryption keys, logging, and cross-account response.

Device-local diagnostic

Mark domains that need review

These selections stay in this browser. They are not an exam score and are never sent to Baitaphish.

No domains currently marked.

Diagnostic

For each domain, explain one architecture, one failure mode, one investigation path, and one least-privilege correction without opening documentation.

  • Service selection
  • Policy evaluation
  • Telemetry path
  • Containment decision
  • Cross-account design
  • Cost and operational tradeoff

Shared foundations

These subjects are maintained once across the certification library; this guide applies them through its own domain lens.

Identity and access

Explain authentication, authorization, federation, lifecycle controls, and least privilege across organizational and cloud boundaries.

Secure architecture

Reason about trust boundaries, resilience, data flows, network controls, and security tradeoffs before selecting products.

Operations and incident response

Connect telemetry, triage, containment, recovery, change, and continuous improvement to measurable outcomes.

Data protection and cryptography

Choose controls for classification, lifecycle, encryption, keys, secrets, privacy, retention, and defensible deletion.

Risk and governance

Translate business context, policy, legal duties, control ownership, and evidence into defensible risk decisions.

Study sequence and reusable assets

  1. Identity evaluation

    Trace effective permissions across identity, resource, boundary, session, organization, and key policies.

    • Policy evaluation case set: Determine effective access and the smallest safe correction.

  2. Telemetry to response

    Connect event sources, aggregation, detection, triage, containment, and evidence retention.

    • Detection-to-response tabletop: Trace evidence and decisions from signal to recovery.

  3. Infrastructure and data

    Choose layered edge, network, compute, encryption, secret, and key controls.

    • Infrastructure and data design drills: Select controls under security, availability, and operating constraints.

  4. Governance synthesis

    Apply multi-account guardrails, consistent deployment, and compliance evidence to prior designs.

    • Multi-account governance review: Recall organization-wide guardrail and evidence patterns.

Common misconceptions

“An explicit allow always grants access.”

Effective authorization also considers explicit denies, boundaries, session policies, organization controls, resource policy context, and service-specific behavior.

“Encryption at rest means the key design is complete.”

Key policy, grants, rotation, separation of duties, cross-account use, recovery, and auditability remain design decisions.

“A detection service replaces logging design.”

Findings depend on data availability and still need routing, ownership, investigation context, retention, and tested response.

Seven-day experienced review sprint

Experienced AWS security practitioner with recent hands-on work and seven focused review days.

  1. Day 1 — Take the diagnostic; build an error log by reasoning failure, not only service name.
  2. Day 2 — IAM policy evaluation, federation, Organizations, and cross-account access cases.
  3. Day 3 — Logging pipelines, detection coverage, investigation evidence, and incident tabletop.
  4. Day 4 — Edge, network, workload, and multi-account infrastructure decisions.
  5. Day 5 — Encryption, KMS policy, secrets, certificates, backup, and data lifecycle.
  6. Day 6 — Governance, compliance evidence, deployment guardrails, and mixed-domain scenarios.
  7. Day 7 — Timed review set; revisit only error-log themes and stop adding new services.

Longer study path

Practitioner who needs to rebuild one or more operational foundations over six to ten weeks.

  1. Baseline: map the official tasks and run the diagnostic without notes.
  2. Foundation: complete small labs for IAM evaluation, centralized logging, KMS, network paths, and Organizations.
  3. Integration: run weekly multi-account design reviews and an incident tabletop.
  4. Retrieval: practice explaining why each wrong option fails under the stated constraint.
  5. Readiness: complete timed mixed-domain sets and close repeated error-log categories.

Exam logistics

  • Confirm current registration, delivery, identification, timing, language, and scoring details on the official AWS Certification site before scheduling.
  • AWS may include unscored content; do not attempt to identify it during the exam.
  • This unofficial guide does not reproduce exam questions and is not affiliated with or endorsed by AWS.

Official sources