Lesson 1: How SCS-C03 Works and How to Study for It

Start here: what you are preparing for

Passing SCS-C03 is a bit like a production change. You don't touch anything until you have read the runbook. For this exam the runbook is the AWS Certified Security - Specialty (SCS-C03) exam guide. AWS owns it and publishes it free on the AWS Certification site, in the AWS documentation under security-specialty-03. This course does not reproduce it. Keep your own copy open next to these lessons. Where this course and the guide differ, the guide is correct.

Three honest notes before we start:

• This course is independent of AWS. AWS does not endorse it, and it cannot promise you a pass.
• Price, length and languages change. Check them on AWS's own exam page before you book. At the time of writing the page lists 170 minutes, 300 USD, and delivery at a Pearson VUE test centre or online with a proctor. The language list has changed recently, and some languages are due to be retired at the end of 2026. Read the current list yourself.
• SCS-C03 replaced SCS-C02. The guide says C02 was in use until 1 December 2025 and C03 from 2 December 2025. Older study material may use C02 domain names and weightings.

How the exam is built

The guide says you get 50 scored questions plus 15 unscored ones. AWS uses the unscored questions to trial new items, and they are not marked. You cannot tell which ones they are, so treat every question as if it counts.

Scoring works like this:

• The result is a scaled score from 100 to 1,000, and the pass mark is 750.
• Scoring is compensatory. You do not have to pass each section, only the exam as a whole. A weak Data Protection score can be made up by a strong IAM score.
• Unanswered questions are marked wrong, and there is no penalty for guessing. Never leave a question blank.

The six domains, in real numbers

Percentages are hard to plan with, so turn them into questions. Here is the arithmetic on the 50 scored questions:

# Domain weightings from the SCS-C03 exam guide, applied to 50 scored questions
weights = {
    "1 Detection": 16,
    "2 Incident Response": 14,
    "3 Infrastructure Security": 18,
    "4 Identity and Access Management": 20,
    "5 Data Protection": 18,
    "6 Security Foundations and Governance": 14,
}
for domain, pct in weights.items():
    print(f"{domain:40} {pct:>3}%  ~{50 * pct / 100:.0f} questions")

# Output:
# 1 Detection                               16%  ~8 questions
# 2 Incident Response                       14%  ~7 questions
# 3 Infrastructure Security                 18%  ~9 questions
# 4 Identity and Access Management          20%  ~10 questions
# 5 Data Protection                         18%  ~9 questions
# 6 Security Foundations and Governance     14%  ~7 questions

These are rough figures. AWS does not publish an exact count per domain. They still show where your study hours pay off most: IAM is the largest domain, and Infrastructure Security and Data Protection come next. This course follows the guide's domain order, and each domain gets space in line with its weight. Phase 1 is Detection, which starts in the next level. After that come Incident Response, Infrastructure Security, IAM, Data Protection, and finally Foundations and Governance.

Four response types, four methods

Gotcha: Ordering and matching questions are all or nothing. Four steps out of five in the right order earns no credit, and so do six correct pairs out of seven. Allow extra time for these.

Read the constraint, not just the problem

In most scenarios, several options would work. The question is which one is best under the condition it states. Learn to spot these phrases:

• "Least operational overhead": choose the managed, native, automated option, such as a managed AWS service or an organization-wide setting. A self-built Lambda function or a script you run on EC2 is usually the trap.
• "Most secure": choose least privilege, encryption and short-lived credentials, even if that adds effort.
• "Most cost-effective": choose the cheapest option that still meets every requirement in the question.
• "With the fewest changes to the application": choose a fix at the infrastructure or policy level, not a code rewrite.

It helps to underline the constraint before you read the options.

The shared responsibility model, applied

AWS describes the split like this: AWS is responsible for security of the cloud, meaning the infrastructure that runs every service. You are responsible for security in the cloud. How much of the stack you own depends on the type of service:

AWS also names shared controls, which both parties own, each at its own layer:

• Patch management: AWS patches the infrastructure, and you patch your guest OS and applications.
• Configuration management
• Awareness and training

Physical and environmental controls are inherited: you take them over from AWS in full.

You can see your part of the model in a single command. A security group belongs to you because AWS gives you the firewall but not the rules:

# List inbound rules open to the whole internet. Fixing these is YOUR job, not AWS's.
aws ec2 describe-security-groups \
  --filters Name=ip-permission.cidr,Values=0.0.0.0/0 \
  --query 'SecurityGroups[].{Id:GroupId,Name:GroupName}' \
  --output table

Pitfall: "AWS manages the service" does not mean "AWS secures my data". A public S3 bucket or a Lambda role with too many permissions is always the customer's fault under the shared responsibility model.

What the exam asks about this

Orientation facts don't show up as questions. The shared responsibility model does, because the guide lists it as recommended knowledge. Expect scenarios that ask who must patch, configure or encrypt something for a given service type. Every question in every domain will also test the habits from this level: find the constraint, choose the managed answer when it says "least overhead", and take care with all-or-nothing formats.

Key takeaways

• The guide belongs to AWS and is free. Use it as your checklist, and check price, length and languages on the exam page.
• 50 scored + 15 unidentified unscored questions. Scaled score 100–1,000, pass at 750, compensatory scoring, no penalty for guessing.
• Weightings are 16/14/18/20/18/14%. IAM is the largest domain at roughly 10 questions.
• Ordering and matching are all or nothing.
• The constraint phrase decides the best answer.
• AWS secures of the cloud and you secure in it. The less the service abstracts, the more of the stack you own.