AWS Certified Security - Specialty (SCS-C03) Exam Prep

What's inside

1. Level 1: How SCS-C03 Works and How to Study for ItFree
   [Exam orientation] Covers how the exam is built: the guide belongs to AWS and is free on the AWS Certification site, so this course does not reproduce it. The guide lists four response types (multiple choice, multiple response, ordering, matching), 50 scored and 15 unscored questions, a scaled pass mark of 750 with compensatory scoring, and six weighted domains. You check price, length and languages on AWS's exam page yourself, and this course is independent of AWS, not endorsed by it, and cannot promise a pass.
2. Level 2: Monitoring Requirements and Health ChecksFree
   [Content Domain 1: Detection – Task 1.1, Skills 1.1.1–1.1.2] Covers how to analyze a workload to decide what to monitor, then build a monitoring strategy from CloudWatch metrics, alarms and resource health checks such as Route 53 health checks.
3. Level 3: Amazon GuardDuty Across an Organization
   [Content Domain 1: Detection – Task 1.1, Skills 1.1.3–1.1.4] Covers using Amazon GuardDuty for organization-wide threat detection: a delegated administrator, auto-enable for member accounts, protection plans, finding types and severities, and suppression rules that cut noise without hiding real threats.
4. Level 4: Security Hub, Macie and Alerting Dashboards
   [Content Domain 1: Detection – Task 1.1, Skills 1.1.3–1.1.4] Covers pulling security events into AWS Security Hub with cross-Region aggregation and a delegated administrator, finding sensitive data with Amazon Macie, and building metrics, alerts and dashboards that surface anomalous data and events.
5. Level 5: Automated Assessments: Config and State Manager
   [Content Domain 1: Detection – Task 1.1, Skill 1.1.5] Covers automations that run regular assessments and investigations: AWS Config rules and conformance packs deployed across accounts, Security Hub controls, and AWS Systems Manager State Manager associations that keep instances in the configuration you defined.
6. Level 6: CloudTrail Organization Trails and Log Architecture
   [Content Domain 1: Detection – Task 1.2, Skills 1.2.1–1.2.2] Covers choosing log sources and storage to fit requirements: an AWS CloudTrail trail for the whole organization, management vs data events, a dedicated CloudWatch logging account, and setting up the CloudWatch Logs agent on instances.
7. Level 7: Network Log Sources: Flow Logs and Resolver Logs
   [Content Domain 1: Detection – Task 1.2, Skill 1.2.6] Covers picking network log sources to match the network design, threats and attacks: VPC Flow Logs, transit gateway flow logs and Amazon Route 53 Resolver query logs, including what each one records and what it misses.
8. Level 8: Security Lake, OCSF and Log Analysis
   [Content Domain 1: Detection – Task 1.2, Skills 1.2.3–1.2.5] Covers building a security data lake with Amazon Security Lake in the OCSF format, connecting third-party tools as subscribers, querying logs with CloudWatch Logs Insights and Amazon Athena, and normalizing and correlating logs with Amazon OpenSearch Service, AWS Lambda and Amazon Managed Grafana.
9. Level 9: Troubleshooting Missing Logs and Silent Alerts
   [Content Domain 1: Detection – Task 1.3, Skills 1.3.1–1.3.2] Covers working out why logs or alerts are missing by checking the function, permissions and configuration of Lambda function logging, Amazon API Gateway logging, health checks, Amazon CloudFront logging and the CloudWatch agent, then fixing the misconfiguration.
10. Level 10: Incident Response Plans and Runbooks
    [Content Domain 2: Incident Response – Task 2.1, Skill 2.1.1] Covers designing response plans and runbooks for security incidents, using AWS Systems Manager OpsCenter to track OpsItems and Amazon SageMaker AI notebooks for repeatable investigation playbooks.
11. Level 11: Preparing Accounts for Incidents
    [Content Domain 2: Incident Response – Task 2.1, Skill 2.1.2] Covers configuring services before an incident happens: provisioning responder and break-glass access, deploying security tools ahead of time, and shrinking the blast radius with account separation and least privilege.
12. Level 12: Automated Remediation with EventBridge and Lambda
    [Content Domain 2: Incident Response – Task 2.1, Skill 2.1.4] Covers automatically remediating incidents using EventBridge rules that trigger Lambda functions, Systems Manager Automation runbooks, AWS Step Functions workflows and Amazon Application Recovery Controller for recovery actions.
13. Level 13: Testing the Plan: FIS and Resilience Hub
    [Content Domain 2: Incident Response – Task 2.1, Skill 2.1.3] Covers procedures for testing and validating an incident response plan with tabletop exercises and game days, AWS Fault Injection Service experiments and AWS Resilience Hub assessments.
14. Level 14: Capturing Forensic Artifacts
    [Content Domain 2: Incident Response – Tasks 2.2 and 2.1, Skills 2.2.1 and 2.1.4] Covers capturing and storing system and application logs, EBS snapshots and memory as forensic artifacts with integrity protection, including the Automated Forensics Orchestrator for Amazon EC2 solution and S3 Object Lock for evidence storage.
15. Level 15: Scoping Events and Root Cause with Detective
    [Content Domain 2: Incident Response – Task 2.2, Skills 2.2.2, 2.2.3 and 2.2.5] Covers searching and correlating logs across applications and AWS services, checking findings from AWS security services to judge scope and impact, and running root cause analysis with Amazon Detective.
16. Level 16: Containment, Credential Compromise and Recovery
    [Content Domain 2: Incident Response – Task 2.2, Skill 2.2.4] Covers containing and eradicating threats and then recovering resources: network containment with isolation security groups and NACLs, responding to compromised IAM credentials by deactivating keys and revoking active sessions, and restoring from backups.
17. Level 17: Edge Security Strategy and CloudFront Controls
    [Content Domain 3: Infrastructure Security – Task 3.1, Skills 3.1.1–3.1.2] Covers choosing edge security strategies for expected threats: Amazon CloudFront headers and origin protection, Amazon S3 cross-origin resource sharing (CORS) and AWS IoT policies.
18. Level 18: AWS WAF Rules: OWASP, Geo, Rate and Fingerprints
    [Content Domain 3: Infrastructure Security – Task 3.1, Skills 3.1.2–3.1.4] Covers designing AWS WAF web ACLs that protect against OWASP Top 10 threats with managed rule groups, plus rules for geography and geolocation, rate limiting and client fingerprinting, and using third-party WAF rules.
19. Level 19: Shield Advanced and Edge Integrations
    [Content Domain 3: Infrastructure Security – Tasks 3.1 and 2.1, Skills 3.1.2, 3.1.4 and 2.1.2] Covers configuring AWS Shield Advanced protections for DDoS resilience and incident readiness (health-based detection, Shield Response Team access, proactive engagement), and connecting edge services to third-party tools, including ingesting data in Open Cybersecurity Schema Framework (OCSF) format.
20. Level 20: Hardened AMIs and Container Images
    [Content Domain 3: Infrastructure Security – Task 3.2, Skill 3.2.1] Covers designing and building hardened Amazon EC2 AMIs and container images that embed security controls, using EC2 Image Builder pipelines and Systems Manager.
21. Level 21: Compute Roles and Secure Admin Access
    [Content Domain 3: Infrastructure Security] Task 3.2, Skills 3.2.2 and 3.2.5: when each compute workload should use an instance profile, a service role or an execution role, and how to give admins access to instances through Systems Manager Session Manager and EC2 Instance Connect instead of SSH keys and open port 22.
22. Level 22: Vulnerability Scanning and Patch Automation
    [Content Domain 3: Infrastructure Security] Task 3.2, Skills 3.2.3 and 3.2.4: scanning EC2, container images and Lambda functions with Amazon Inspector, watching running workloads with GuardDuty Runtime Monitoring, and patching automatically with Systems Manager Patch Manager while Amazon Inspector keeps checking the results.
23. Level 23: Pipeline Security and GenAI App Guardrails
    [Content Domain 3: Infrastructure Security] Task 3.2, Skills 3.2.6 and 3.2.7: finding and fixing vulnerabilities inside a CI/CD pipeline with Amazon Q Developer and Amazon CodeGuru Security (the guide names it, but AWS ended support for it on 20 November 2025 and points users to Amazon Q Developer and Amazon Inspector code scanning), and protecting generative AI applications against the OWASP Top 10 for LLM Applications.
24. Level 24: Network Controls and Segmentation
    [Content Domain 3: Infrastructure Security] Task 3.3, Skills 3.3.1 and 3.3.4: designing and troubleshooting security groups, network ACLs and AWS Network Firewall, and segmenting networks for north/south and east/west traffic with isolated subnets.
25. Level 25: Hybrid Connectivity and Removing Excess Access
    [Content Domain 3: Infrastructure Security] Task 3.3, Skills 3.3.2, 3.3.3 and 3.3.5: secure hybrid and multi-cloud links with AWS Site-to-Site VPN, AWS Direct Connect and MACsec, application access without a VPN through AWS Verified Access, and finding unneeded access with Network Access Analyzer and Amazon Inspector network reachability findings.
26. Level 26: Workforce Identity with IAM Identity Center
    [Content Domain 4: Identity and Access Management] Task 4.1, Skill 4.1.1: designing human authentication with AWS IAM Identity Center, external identity provider (IdP) integration through SAML 2.0 and SCIM, permission sets and multi-factor authentication (MFA).
27. Level 27: Customer and App Identity with Amazon Cognito
    [Content Domain 4: Identity and Access Management] Task 4.1, Skill 4.1.1: application and customer authentication with Amazon Cognito user pools, which sign users in, and identity pools, which hand out AWS credentials, including social and SAML federation and MFA.
28. Level 28: Temporary Credentials: STS and Presigned URLs
    [Content Domain 4: Identity and Access Management] Task 4.1, Skill 4.1.2: issuing short-lived credentials with AWS STS (AssumeRole, AssumeRoleWithSAML, AssumeRoleWithWebIdentity, GetSessionToken) and Amazon S3 presigned URLs.
29. Level 29: Troubleshooting Authentication Failures
    [Content Domain 4: Identity and Access Management] Task 4.1, Skill 4.1.3: diagnosing sign-in and federation failures using CloudTrail, Amazon Cognito, IAM Identity Center permission sets and AWS Directory Service.
30. Level 30: Policy Evaluation Logic, SCPs and RCPs
    [Content Domain 4: Identity and Access Management] Task 4.2, Skill 4.2.3: how AWS combines identity policies, resource policies, SCPs, RCPs, permissions boundaries and session policies into one allow-or-deny decision, and how to write least-privilege policy JSON with conditions.
31. Level 31: Permissions Boundaries and Session Policies
    [Content Domain 4: Identity and Access Management] Task 4.2, Skill 4.2.3: capping permissions with permissions boundaries so developers can safely create roles themselves, and narrowing a single session with session policies.
32. Level 32: Cross-Account Access, Trust Policies, Roles Anywhere
    [Content Domain 4: Identity and Access Management] Task 4.2, Skill 4.2.1: authorizing human, application and system access with IAM role trust policies, resource policies for cross-account access, IAM paths and IAM Roles Anywhere for workloads running outside AWS.
33. Level 33: ABAC, RBAC and Amazon Verified Permissions
    [Content Domain 4: Identity and Access Management] Task 4.2, Skills 4.2.1 and 4.2.2: designing attribute-based (ABAC) and role-based (RBAC) access control with tags and session tags, and fine-grained application authorization with Amazon Verified Permissions and Cedar policies.
34. Level 34: Analyzing Authorization Failures
    [Content Domain 4: Identity and Access Management] Task 4.2, Skill 4.2.4: finding out why access was denied, and what a policy change would do, with the IAM Policy Simulator, IAM Access Analyzer and AccessDenied error context.
35. Level 35: Finding and Fixing Unintended Permissions
    [Content Domain 4: Identity and Access Management] Task 4.2, Skill 4.2.5: using IAM Access Analyzer to find external, internal and unused access, then right-sizing permissions with policy generation and last-accessed data.
36. Level 36: Enforcing Encryption in Transit
    [Content Domain 5: Data Protection] Task 5.1, Skill 5.1.1: requiring encrypted connections with ELB security policies, TLS enforcement, aws:SecureTransport conditions and certificates from AWS Certificate Manager.
37. Level 37: Private Access: PrivateLink, Endpoints, Client VPN
    [Content Domain 5: Data Protection] Task 5.1, Skill 5.1.2: secure, private access to resources with AWS PrivateLink, gateway and interface VPC endpoints and endpoint policies, and AWS Client VPN compared with AWS Verified Access.
38. Level 38: Inter-Resource and Inter-Node Encryption
    [Content Domain 5: Data Protection] Task 5.1, Skill 5.1.3: encrypting traffic between resources, using Amazon EMR security configurations, Amazon EKS service-to-service encryption, SageMaker AI inter-container traffic encryption and Nitro encryption between instances.
39. Level 39: Choosing Encryption at Rest: KMS vs CloudHSM
    [Content Domain 5: Data Protection] Task 5.2, Skill 5.2.1: choosing the right key service (AWS KMS or AWS CloudHSM) and encryption type (client-side or server-side, with SSE-S3, SSE-KMS, DSSE-KMS or SSE-C) for a set of requirements.
40. Level 40: KMS Key Policies, Grants and Context
    [Content Domain 5: Data Protection] Task 5.2, Skill 5.2.1: controlling who can use AWS KMS keys with key policies, grants, encryption context and kms:ViaService, including cross-account key use.
41. Level 41: Lifecycle, Retention, Backup and Ransomware Recovery
    [Content Domain 5: Data Protection] Serves Task 5.2, Skills 5.2.3 and 5.2.4. You learn to design automatic lifecycle management and retention with S3 Lifecycle policies, S3 Object Lock retention, Amazon EFS Lifecycle policies and Amazon FSx for Lustre backup policies, and to build secure replication and backup with Amazon Data Lifecycle Manager, AWS Backup and AWS DataSync, with ransomware protection as the deciding requirement throughout.
42. Level 42: Secrets Manager: Storing and Rotating Credentials
    [Content Domain 5: Data Protection] Serves Task 5.3, Skill 5.3.1. You learn to design how credentials and secrets are managed and rotated with AWS Secrets Manager: managed rotation compared with Lambda rotation functions, single-user and alternating-users strategies, resource policies, cross-account access with a customer managed KMS key, and when Systems Manager Parameter Store SecureString is enough.
43. Level 43: Imported Key Material and External Key Stores
    [Content Domain 5: Data Protection] Serves Task 5.3, Skills 5.3.2 and 5.3.3. You learn to manage and rotate imported key material in AWS KMS and to configure external key stores (XKS), and to explain how imported key material differs from AWS generated key material in durability, expiration, deletion and rotation.
44. Level 44: Multi-Region Keys, Private CA and Masking Sensitive Data
    [Content Domain 5: Data Protection] Serves Task 5.3, Skills 5.3.4 and 5.3.5. You learn to create and manage customer managed KMS keys and certificates within one Region and across several, using multi-Region keys, AWS Private Certificate Authority and AWS Certificate Manager. You also learn to mask sensitive data with CloudWatch Logs data protection policies and Amazon SNS message data protection. AWS has closed SNS message data protection to new customers from 30 April 2026, but it is still named in the exam guide.
45. Level 45: AWS Organizations Design and Delegated Administrators
    [Content Domain 6: Security Foundations and Governance] Serves Task 6.1, Skills 6.1.1 and 6.1.4. You learn to deploy and configure an organization with AWS Organizations: OU structure, trusted access and a dedicated security tooling account. You also learn to manage security services centrally through delegated administrator accounts for GuardDuty, Security Hub, Inspector, Macie, Detective and AWS Config.
46. Level 46: AWS Control Tower: Landing Zones and Controls
    [Content Domain 6: Security Foundations and Governance] Serves Task 6.1, Skill 6.1.2. You learn to implement and manage AWS Control Tower in new and existing environments: setting up a landing zone, enrolling existing accounts and OUs, Account Factory, and deploying optional and custom controls (preventive, detective and proactive).
47. Level 47: Organization Policies and Root User Management
    [Content Domain 6: Security Foundations and Governance] Serves Task 6.1, Skills 6.1.3 and 6.1.5. Building on the SCPs and RCPs from Domain 4, you learn organization policies through a governance lens, including AI service opt-out policies and declarative policies. You also learn to manage AWS account root user credentials: centralizing root access for member accounts, managing MFA and designing break-glass procedures.
48. Level 48: Secure IaC with StackSets, Guard, cfn-lint and Tags
    [Content Domain 6: Security Foundations and Governance] Serves Task 6.2, Skills 6.2.1 and 6.2.2. You learn to deploy cloud resources consistently and securely across accounts with infrastructure as code (CloudFormation StackSets with service-managed permissions, third-party IaC tools), to check templates before deployment with CloudFormation Guard and cfn-lint, and to use tags to group resources by department, cost center and environment.
49. Level 49: Central Enforcement and Sharing: Firewall Manager, RAM
    [Content Domain 6: Security Foundations and Governance] Serves Task 6.2, Skills 6.2.3 and 6.2.4. You learn to deploy and enforce policies and configurations from a central source with AWS Firewall Manager (AWS WAF, Shield Advanced, security group and Network Firewall policies), and to share resources securely across AWS accounts with AWS Resource Access Manager (AWS RAM) and AWS Service Catalog.
50. Level 50: Detect and Remediate Noncompliance: Config and Security Hub
    [Content Domain 6: Security Foundations and Governance] Serves Task 6.3, Skill 6.3.1. You learn to create or enable rules that detect noncompliant AWS resources, remediate them and send notifications: AWS Config managed and custom rules, conformance packs, aggregators and automatic remediation with Systems Manager Automation documents, plus Security Hub security standards and controls across the organization.
51. Level 51: Audit Evidence and Well-Architected Reviews
    [Content Domain 6: Security Foundations and Governance] Serves Task 6.3, Skills 6.3.2 and 6.3.3. You learn to collect and organize audit evidence with AWS Audit Manager and AWS Artifact, and to evaluate an architecture against AWS security best practices with the AWS Well-Architected Tool. Audit Manager has been in maintenance mode and closed to new setups since 30 April 2026, but it is still named in the exam guide.
52. Level 52: Final Timed Mock Exam (SCS-C03) Timed mock
    [All Content Domains] The timed mock exam: 50 original scenario questions in 170 minutes, weighted like the six SCS-C03 domains, with a pass mark of 75%. It tests every task statement from Detection to Security Foundations and Governance using the exam's multiple-choice, multiple-response, ordering and matching formats.

Access

The first 2 levels are free with a free account. Every level, the podcast edition and the AI tutor come with All Access at £4.99/month or any Creator plan — see pricing.

Start free →