The AWS Certified Security - Specialty (SCS-C02) exam is one of the most valuable AWS certifications you can earn. Security is the number one concern for every organization moving to the cloud, and certified security professionals are in extremely high demand.
But this is not an easy exam. With an estimated pass rate of 45-55%, you need serious preparation.
This guide covers everything: exam domains, key services to master, a study plan, and the strategies that separate people who pass from people who do not.
Exam Overview
| Detail | Information |
|---|---|
| Exam Code | SCS-C02 |
| Level | Specialty |
| Cost | $300 (or $150 with voucher) |
| Duration | 170 minutes |
| Questions | 65 questions |
| Passing Score | 750 / 1000 |
| Format | Multiple choice and multiple response |
| Prerequisite | None (but 5+ years IT security experience recommended) |
Important: While there is no formal prerequisite, AWS recommends at least 5 years of IT security experience and 2 years of hands-on AWS security experience. If you have Solutions Architect Associate or Professional, you will have a solid foundation.
Exam Domains and Weights
| Domain | Weight |
|---|---|
| Threat Detection and Incident Response | 14% |
| Security Logging and Monitoring | 18% |
| Infrastructure Security | 20% |
| Identity and Access Management | 16% |
| Data Protection | 18% |
| Management and Security Governance | 14% |
Unlike the older SCS-C01, the C02 version places more emphasis on practical security operations and less on theoretical concepts. You need to know how to actually respond to security incidents, not just define what they are.
Key AWS Services You MUST Master
Tier 1: Know These Inside and Out
These services appear in almost every question:
IAM (Identity and Access Management)
- IAM policies (identity-based vs. resource-based)
- IAM roles and cross-account access
- Permission boundaries
- Service control policies (SCPs)
- IAM Access Analyzer
- Least privilege principle in practice
AWS KMS (Key Management Service)
- Customer managed keys vs AWS managed keys
- Key policies and grants
- Automatic key rotation
- Cross-region key replication
- Envelope encryption
- Integration with other services (S3, EBS, RDS, etc.)
AWS CloudTrail
- Management events vs data events
- Organization trails
- Log file integrity validation
- CloudTrail Lake for querying
- Integration with CloudWatch and EventBridge
Amazon GuardDuty
- Threat detection types (reconnaissance, instance compromise, account compromise)
- Findings and severity levels
- Suppression rules
- Multi-account management with Organizations
- Malware protection and runtime monitoring
AWS Security Hub
- Security standards (CIS, PCI DSS, AWS Foundational)
- Aggregating findings from multiple services
- Custom insights
- Automated remediation with EventBridge
- Cross-region and cross-account aggregation
Tier 2: Know These Well
AWS Config
- Config rules (managed and custom)
- Conformance packs
- Remediation actions
- Multi-account aggregation
- Configuration timeline and compliance history
Amazon Macie
- S3 data discovery and classification
- Sensitive data findings
- Custom data identifiers
- Automated discovery jobs
AWS WAF (Web Application Firewall)
- Web ACLs and rules
- Rate-based rules
- Managed rule groups
- Logging and metrics
- Integration with CloudFront, ALB, API Gateway
AWS Shield
- Shield Standard vs Shield Advanced
- DDoS protection capabilities
- Response team access (Advanced)
- Cost protection (Advanced)
VPC Security
- Security groups vs NACLs
- VPC Flow Logs
- VPC endpoints (Interface and Gateway)
- PrivateLink
- Network Firewall
Tier 3: Know the Basics
- AWS Certificate Manager (ACM) - SSL/TLS certificate management
- AWS Secrets Manager - Secret rotation and management
- AWS Systems Manager - Parameter Store, Session Manager, Patch Manager
- Amazon Inspector - Automated vulnerability scanning
- AWS Firewall Manager - Central firewall management across accounts
- AWS Organizations - SCPs, multi-account governance
- Amazon Detective - Security investigation and analysis
- AWS Audit Manager - Compliance auditing
Study Plan: 8-10 Weeks
Weeks 1-2: Foundation and Assessment
What to do:
- Review the official SCS-C02 exam guide from AWS
- Take an initial practice exam or assessment to identify your starting point
- Review IAM fundamentals if needed
- Read the AWS Shared Responsibility Model whitepaper
- Set up a study schedule (1-2 hours per day)
Weeks 3-4: Identity, Access, and Data Protection
Focus areas:
- Deep dive into IAM policies (write and analyze policy JSON)
- KMS key management and encryption patterns
- Cross-account access patterns
- S3 bucket policies and access control
- Secrets Manager and Parameter Store
- Certificate management with ACM
Hands-on labs:
- Create and test IAM policies with policy simulator
- Set up KMS keys and encrypt/decrypt data
- Configure cross-account roles
- Implement S3 bucket policies with conditions
Weeks 5-6: Detection, Logging, and Monitoring
Focus areas:
- CloudTrail configuration and log analysis
- GuardDuty findings and response workflows
- Security Hub standards and findings aggregation
- VPC Flow Logs analysis
- CloudWatch alarms for security events
- EventBridge rules for automated response
Hands-on labs:
- Set up an organization trail in CloudTrail
- Enable GuardDuty and generate sample findings
- Configure Security Hub with compliance standards
- Create automated remediation with EventBridge and Lambda
Weeks 7-8: Infrastructure Security and Governance
Focus areas:
- VPC security architecture (public/private subnets, NACLs, security groups)
- WAF rule configuration
- Shield Advanced features
- Network Firewall
- AWS Config rules and remediation
- Organizations and SCPs
- Firewall Manager policies
Hands-on labs:
- Build a secure VPC architecture
- Configure WAF rules on an ALB
- Create AWS Config rules with auto-remediation
- Write and test SCPs
Weeks 9-10: Practice and Review
What to do:
- Take full-length practice exams (timed)
- Review every wrong answer thoroughly
- Focus extra time on your weakest domains
- Re-read key whitepapers
- Take final practice exam 2-3 days before the real exam
Target practice scores:
- Week 9: 75-80%
- Week 10: 85%+
Exam Strategy: What Separates Pass From Fail
1. Think Like a Security Engineer, Not a Developer
Many questions present a scenario and ask for the MOST secure solution. The answer is almost always the option that:
- Follows least privilege
- Uses encryption by default
- Minimizes the attack surface
- Automates security controls
- Uses AWS-managed services over self-managed
2. Know the Difference Between Similar Services
Common confusion points:
| When to Use | Service |
|---|---|
| Detect threats automatically | GuardDuty |
| Check compliance against standards | Security Hub |
| Track API calls and changes | CloudTrail |
| Track resource configurations | AWS Config |
| Investigate security findings | Amazon Detective |
| Scan for vulnerabilities | Amazon Inspector |
| Classify sensitive data | Amazon Macie |
3. Understand Encryption Patterns
You will see many encryption questions. Know these patterns:
- S3 encryption: SSE-S3, SSE-KMS, SSE-C, and client-side encryption
- EBS encryption: KMS-based, can encrypt existing volumes via snapshot
- RDS encryption: KMS-based, must be enabled at creation
- In-transit encryption: TLS/SSL, ACM certificates, VPN, PrivateLink
4. Master Cross-Account Patterns
Cross-account security is heavily tested:
- IAM roles for cross-account access (preferred over sharing credentials)
- Resource-based policies for cross-account S3 access
- KMS key policies for cross-account encryption
- Organizations SCPs for guardrails
- GuardDuty and Security Hub delegated administrator
5. Time Management
170 minutes for 65 questions gives you about 2.5 minutes per question. Security Specialty questions are often long with detailed scenarios.
Strategy:
- First pass (90 minutes): Answer confident questions, flag uncertain ones
- Second pass (60 minutes): Return to flagged questions
- Final review (20 minutes): Check flagged answers one more time
Essential Reading
These AWS resources are critical for the exam:
- AWS Security Best Practices whitepaper
- AWS Well-Architected Framework - Security Pillar
- AWS Shared Responsibility Model
- KMS Developer Guide (especially key policies section)
- IAM documentation (policy evaluation logic)
- GuardDuty User Guide (finding types)
Frequently Asked Questions
How hard is the AWS Security Specialty exam?
The AWS Security Specialty (SCS-C02) is considered a high-difficulty exam with an estimated pass rate of 45-55%. It requires deep knowledge of AWS security services, encryption patterns, IAM policies, and incident response. Most successful candidates have 2+ years of hands-on AWS security experience and study for 8-10 weeks.
Do I need Solutions Architect before Security Specialty?
There is no formal prerequisite, but having Solutions Architect Associate or Professional significantly helps. The SAA provides foundational knowledge of AWS services and architecture that Security Specialty builds upon. If you do not have SAA, plan additional study time for core AWS service concepts.
What is the best study material for SCS-C02?
The best approach combines the official AWS exam guide, hands-on labs in your own AWS account, AWS security whitepapers, and quality practice exams. Focus on understanding security service interactions rather than memorizing facts. Gap-based learning tools that identify your weak areas are more efficient than watching 40+ hours of video.
How much does the AWS Security Specialty pay?
AWS Security Specialty certified professionals typically earn $140,000-180,000+ depending on location and experience. Security is one of the highest-paying specializations in cloud computing due to high demand and the critical nature of the work.
The Bottom Line
AWS Security Specialty is challenging but incredibly rewarding. It validates deep security expertise that employers actively seek and pay premium salaries for.
The key to passing is structured preparation: understand the domains, master the core services, practice hands-on, and test yourself relentlessly. Do not just read about security. Build secure architectures. Respond to simulated incidents. Write IAM policies. Configure encryption.
Your security certification journey starts with knowing what you need to learn.