TL;DR: You can only take SCS-C03 now. AWS retired SCS-C02 on December 1, 2025, and SCS-C03 has been the live AWS Certified Security – Specialty exam since December 2, 2025. So the real question is not “which one to book” but “how much of my old SCS-C02 material still helps”. Most of it does: IAM, KMS, VPC security, logging, and governance are still core. What changed is the structure and the scope. The old Domains 1 and 2 were split into separate Detection and Incident Response domains; IAM became the heaviest domain at 20%, and the exam now covers generative AI security, OCSF data ingestion, inter-resource encryption in transit, key material choices, and data masking. The exam removed low-level topics such as TCP/IP fundamentals, host-based firewalls, and VPC Reachability Analyzer. The price (USD 300), the pass mark (750 out of 1,000), and the 3-year validity did not change.
Quick Facts
| Item | SCS-C02 (retired) | SCS-C03 (current) |
| Status | Last testing date: December 1, 2025 | In use since December 2, 2025 |
| Exam fee | USD 300 | USD 300 |
| Length | 170 minutes | 170 minutes |
| Questions | 65 | 65 (50 scored plus 15 unscored) |
| Question types | Multiple choice, multiple response (check AWS archives for others) | Multiple choice, multiple response, ordering, matching |
| Scoring | Scaled 100 to 1,000, 750 to pass | Scaled 100 to 1,000, 750 to pass |
| Scoring model | Compensatory | Compensatory (you only need to pass the overall exam) |
| Domains | 6 | 6 (Detection and Incident Response now separate) |
| Validity | 3 years | 3 years |
| Target experience | Advanced security background on AWS | 3 to 5 years securing cloud solutions; AWS recommends 5 years of IT security experience and 2+ years securing AWS workloads |
| Delivery | Pearson VUE or online proctored | Pearson VUE or online proctored |
| Exam languages | Several | English, Japanese, Korean, Portuguese (Brazil), Simplified Chinese, Spanish (Latin America) |
Figures are taken from AWS’s certification page, the SCS-C03 exam guide and the SCS-C02 to SCS-C03 comparison appendix, checked in November 2026. AWS updates these pages, so confirm on the official page before you book.
AWS has also announced that the Simplified Chinese, Spanish (Latin America) and Portuguese (Brazil) versions of the exam will be retired after December 31, 2026. If you plan to test in one of those languages, check your timeline.
Key Takeaways
- SCS-C02 can no longer be booked. Any prep resource built only for SCS-C02 is partly outdated.
- SCS-C03 keeps the same price, length, question count and pass mark, so your exam-day pacing plan barely changes.
- The biggest content shifts are a new Detection vs Incident Response split, a heavier IAM domain and new GenAI security tasks.
- Ordering and matching questions are listed in the SCS-C03 exam guide. Practise them, because they give no partial credit.
- Old SCS-C02 knowledge is still valuable for roughly the core of Domains 3, 4, 5 and 6. Fill the gaps listed below rather than starting over.
What Is the Difference Between SCS-C02 and SCS-C03?
The two exams certify the same thing: that you can secure workloads on AWS. The difference is in how the blueprint is organised and what it now expects.
1. The domain structure changed
SCS-C02 had “Threat Detection and Incident Response” in Domain 1 and “Security Logging and Monitoring” in Domain 2. SCS-C03 breaks those apart and rebuilds them as two cleaner domains: Detection and Incident Response. AWS also renamed Domain 6 from “Management and Security Governance” to “Security Foundations and Governance”.
| Domain | SCS-C02 | Weight | SCS-C03 | Weight |
| 1 | Threat Detection and Incident Response | 14% | Detection | 16% |
| 2 | Security Logging and Monitoring | 18% | Incident Response | 14% |
| 3 | Infrastructure Security | 20% | Infrastructure Security | 18% |
| 4 | Identity and Access Management | 16% | Identity and Access Management | 20% |
| 5 | Data Protection | 18% | Data Protection | 18% |
| 6 | Management and Security Governance | 14% | Security Foundations and Governance | 14% |
Two things stand out. Identity and Access Management moved from 16% to 20%, so it is now the single heaviest domain. Infrastructure Security dropped from 20% to 18%. Domains 5 and 6 kept their weights.
AWS notes that task statements were recategorised and that the mapping between old and new tasks is not one-to-one. For example, the old logging and monitoring tasks now sit inside the new Detection and Incident Response domains. Do not assume that an SCS-C02 domain score tells you exactly where you stand on SCS-C03.
2. New topics added in SCS-C03
These are the additions AWS lists in its comparison appendix:
- Validating findings from AWS security services to assess the scope and impact of an event.
- Edge and third-party integrations, including ingesting data in Open Cybersecurity Schema Framework (OCSF) format and using third-party WAF rules.
- Generative AI protections and guardrails, for example applying the OWASP Top 10 for LLM Applications.
- Inter-resource encryption in transit, such as inter-node encryption for Amazon EMR, Amazon EKS and SageMaker AI, and Nitro encryption.
- Imported vs AWS-generated key material, and the differences between them.
- Masking sensitive data, for example CloudWatch Logs data protection policies and Amazon SNS message data protection.
- Creating and managing keys and certificates across one or several Regions, for example customer managed AWS KMS keys and AWS Private Certificate Authority.
The theme is clear. AWS wants security engineers who can protect AI workloads, move security data between tools, and manage encryption at scale.
3. Topics removed in SCS-C03
The removals tell you what you can safely spend less time on:
- AWS Security Finding Format (ASFF) and the AWS Security Incident Response Guide as listed knowledge items.
- Log format and components, for example reading raw CloudTrail log structure.
- Host-based security, such as host firewalls and hardening.
- Network reachability analysis with VPC Reachability Analyzer and Amazon Inspector Network Reachability.
- Fundamental TCP/IP concepts: UDP vs TCP, ports, the OSI model and network utilities.
- Components of an IAM policy (Principal, Action, Resource, Condition) as a separate knowledge item.
- TLS concepts and cross-Region networking with private and public VIFs.
- S3 static website hosting configuration.
- Identifying security gaps through architectural reviews and cost analysis.
Removed does not mean irrelevant in real life. It means AWS no longer lists these as testable task knowledge. You will still use policy logic constantly when you answer IAM scenario questions.
4. The exam format gained more question types
The SCS-C03 guide lists four question types: multiple choice (one correct, three distractors), multiple response (two or more correct out of five or more options), ordering (3 to 5 responses placed in the right order) and matching (3 to 7 prompts to pair). Ordering and matching need every item correct to earn credit. Unanswered questions score as incorrect and there is no penalty for guessing, so answer everything.
15 of the 65 questions are unscored and are not marked. Treat every question as if it counts.
5. How the old SCS-C02 tasks map to the new blueprint
AWS publishes a task-by-task mapping and states that it is not one-to-one. These examples show how much the content was reshuffled:
| SCS-C02 task | Now appears in SCS-C03 tasks |
| 1.1 | 1.1, 1.2, 2.1 and 2.2 |
| 2.2 | 1.1, 1.2 and 1.3 |
| 3.1 | 1.2 and 3.1 |
| 3.3 | 3.2 and 5.3 |
| 4.1 | 4.1 (nearly unchanged) |
| 4.2 | 4.2 (nearly unchanged) |
| 5.1 | 3.2, 3.3 and 5.1 |
| 5.2 | 4.2 and 5.2 |
| 6.1 | 4.2 and 6.1 |
| 6.2 | 6.2 (nearly unchanged) |
| 6.4 | 1.1, 2.1 and 6.3 |
Read this table in two ways. Identity tasks (4.1, 4.2) and the governance task 6.2 carried over almost intact, so your existing notes there are safe. Logging, monitoring and network tasks were spread across several new domains, so notes organised by the old domains will not line up with the new ones. Rebuild your notes around the six SCS-C03 domains instead of patching the old ones.
What Should You Study in Each SCS-C03 Domain?
The exam guide says it is not a complete list of exam content, so use this as a study map, not a guarantee. Domain weights are AWS’s.
Domain 1: Detection (16%)
This domain now stands alone. Expect scenario questions on how you detect threats across accounts and services, how findings from AWS security services are collected, and how third-party data gets in. The new edge and third-party integration task (OCSF ingestion and third-party WAF rules) is listed under Infrastructure Security as Task 3.1.4, so connect it with this domain in your notes. Practise reading a scenario and deciding which AWS security service would surface the signal.
Domain 2: Incident Response (14%)
Incident response became its own domain, with a new task on validating findings from AWS security services to judge the scope and impact of an event. The guide’s recommended knowledge also includes security incident prevention and response strategies and incident root cause analysis. Study the order of response actions (contain, investigate, recover) because ordering questions fit this topic well.
Domain 3: Infrastructure Security (18%)
Weight dropped by 2 points and several low-level items were removed (host-based security, reachability analysis, TCP/IP basics). What was added is protection of generative AI applications, with the OWASP Top 10 for LLM Applications as the named example, plus edge and third-party integrations. The guide also lists developing firewall rules at scale for layers 3 to 7, so expect questions on layered network and application protection rather than packet-level detail.
Domain 4: Identity and Access Management (20%)
This is the heaviest domain. The guide’s recommended knowledge includes managing identity at scale and multi-account governance. Even though the policy components item was removed as a separate knowledge point, you still need to read policies fluently to answer scenario questions about cross-account access, permission boundaries and least privilege. Because this domain is 20% of scored content, a weak spot here costs more than anywhere else.
Domain 5: Data Protection (18%)
Weight is unchanged, but the content grew. New tasks cover inter-resource encryption in transit (EMR, EKS, SageMaker AI and Nitro encryption), differences between imported and AWS-generated key material, masking sensitive data (CloudWatch Logs data protection policies, Amazon SNS message data protection) and managing keys and certificates across one or several Regions (customer managed KMS keys, AWS Private Certificate Authority). TLS concepts and VIF-based cross-Region networking were removed, and so was S3 static website hosting.
Domain 6: Security Foundations and Governance (14%)
Renamed from “Management and Security Governance”. The guide’s recommended knowledge here includes the shared responsibility model, managing software supply chain risks, vulnerability management in the cloud, experience responding to an audit and disaster recovery controls including backup strategies. The task on identifying security gaps through architectural reviews and cost analysis was removed.
Common Mistakes When Moving From SCS-C02 to SCS-C03
- Studying with old SCS-C02 practice material only. It will not cover GenAI protections, OCSF, key material choices or data masking.
- Spending hours on removed topics. TCP/IP fundamentals, host firewalls and Reachability Analyzer are no longer listed as tested knowledge.
- Ignoring ordering and matching questions. They need every item right. Practise them under time pressure.
- Treating domains as the old six. Detection and Incident Response now carry separate weights (16% and 14%).
- Underweighting IAM. At 20% it is now the biggest slice.
- Skipping the lab. Scenario questions reward people who have configured the services, not people who only read about them.
- Leaving questions blank. There is no penalty for guessing, and unanswered questions count as wrong.
Can You Still Take SCS-C02?
No. AWS’s own comparison page states that SCS-C02 was in use until December 1, 2025 and SCS-C03 has been in use since December 2, 2025. If you passed SCS-C02 before that date, your credential stays valid for its 3-year period. If you did not pass in time, you now prepare for SCS-C03.
If your SCS-C02 certification is nearing expiry, you recertify on the current version. Check AWS’s recertification options in your Certification account for the current rules.
Which One Should You Study? A Decision Framework
Because only one exam is bookable, the useful decision is how to reuse what you already have.
| Your situation | What to do |
| You studied SCS-C02 and never tested | Keep your IAM, KMS, VPC and logging notes. Add GenAI security, OCSF, key material, data masking and inter-resource encryption. Re-map your notes to the six new domains. |
| You hold SCS-C02 and it is still valid | No action needed until renewal. Plan SCS-C03 prep before your expiry date. |
| You are starting from zero | Study from the SCS-C03 exam guide only. Ignore SCS-C02-only material. |
| You are strong on networking, weak on identity | Prioritise Domain 4 (20%). It is now the biggest slice. |
| You work mostly in a SOC | Spend extra time on the new Incident Response domain and on validating findings, since both are now explicit. |
| You use third-party tools heavily | Study OCSF ingestion and third-party WAF rule integration. |
A simple 6-step plan:
- Read the SCS-C03 exam guide’s six domains and task statements.
- Mark every topic from your old SCS-C02 notes as keep, review, or drop using the removal list above.
- Study the seven additions listed earlier. They are the most likely source of surprises.
- Build a small lab: a multi-account setup with GuardDuty, Security Hub, KMS keys across two Regions and a CloudWatch Logs data protection policy.
- Practise ordering and matching questions so the format feels normal.
- Take timed practice sets of 65 questions in 170 minutes.
A sample 6-week study schedule
This is a suggested pacing, not an AWS requirement. Adjust it to your experience.
| Week | Focus | Output |
| 1 | Read the exam guide, map old notes to six domains, list gaps | A gap list with the seven new topics at the top |
| 2 | Domain 4 (IAM) and Domain 6 (governance) | Notes on cross-account access, multi-account governance, supply chain risk |
| 3 | Domains 1 and 2 (Detection, Incident Response) | A written incident response runbook and a finding-validation checklist |
| 4 | Domain 3 (Infrastructure Security) including GenAI protections | A short summary of OWASP Top 10 for LLM Applications mapped to AWS controls |
| 5 | Domain 5 (Data Protection) | Lab with KMS keys in two Regions, private CA, log masking policy |
| 6 | Timed full-length practice and weak-area review | Two timed 65-question sets and a final weak-spot list |
Exam-day pacing
You have 170 minutes for 65 questions, which is about 2.6 minutes per question. Because 15 questions are unscored and unmarked, you cannot tell which ones to skip, so do not spend ten minutes on a single hard item. Flag it, move on and return. Ordering and matching questions take longer to read, so budget a little extra time for them. Because scoring is compensatory, a weak domain can be offset by strength in another, but only the overall score decides pass or fail.
Is SCS-C03 Harder Than SCS-C02?
AWS does not publish difficulty ratings, so any claim is opinion. What the documents do show is a shift in expectation. SCS-C03 targets candidates with 3 to 5 years of experience securing cloud solutions, puts more weight on identity, and adds scenario areas such as GenAI and encryption design. It also drops several low-level networking and host topics. Candidates who rely on memorised service facts may find it harder. Candidates with real incident response and IAM experience may find it more natural.
What Is Out of Scope for SCS-C03?
The exam guide lists tasks AWS does not expect you to do, including designing cryptographic algorithms, analysing traffic at the packet level, architecting overall cloud deployments, managing end-user compute resources and training machine learning models. You need to know how to secure AI workloads, not how to build them.
Where Does the Security Specialty Fit in Your AWS Path?
The Security Specialty is an advanced credential. Many people add it after an associate or professional exam. If you are still deciding your AWS route, start with our AWS certification guide. If you want to see how other AWS exams moved to new versions, read our comparisons of SAP-C02 vs SAP-C03, DVA-C02 vs DVA-C03 and MLA-C01 vs MLA-C02. Planning the cost? See how to use an AWS certification discount voucher and our overview of AWS certification salary trends. For the broader security career picture, our cybersecurity career path article explains where cloud security fits.
FAQS
What is the difference between AWS SCS-C02 and SCS-C03?
SCS-C03 splits the old Detection and Incident Response coverage into two domains, raises the Identity and Access Management weight to 20%, adds GenAI security, OCSF ingestion, inter-resource encryption, key material and data masking topics, and removes low-level networking and host-based security items. Price, length and pass mark stayed the same.
Can I still take the AWS SCS-C02 exam?
No. AWS lists SCS-C02 as in use until December 1, 2025. SCS-C03 has been the active exam since December 2, 2025.
When did AWS SCS-C03 launch?
AWS states that SCS-C03 has been in use since December 2, 2025. AWS opened registration for the updated exam in October 2025.
How much does the AWS Security Specialty exam cost?
USD 300, plus tax where applicable. Check the AWS exam pricing page for any regional difference.
How many questions are on SCS-C03 and how long is the exam?
65 questions in 170 minutes. 50 are scored and 15 are unscored. Unscored questions are not marked as such.
What is the passing score for SCS-C03?
750 on a scaled range of 100 to 1,000. The exam uses compensatory scoring, so you do not need to pass each domain, only the overall exam.
What are the SCS-C03 exam domains and weights?
Detection 16%, Incident Response 14%, Infrastructure Security 18%, Identity and Access Management 20%, Data Protection 18% and Security Foundations and Governance 14%.
Does SCS-C03 include generative AI security?
Yes. AWS added a task on implementing protections and guardrails for generative AI applications, with the OWASP Top 10 for LLM Applications given as an example.
Is my SCS-C02 study material still useful?
Mostly yes for IAM, KMS, VPC security, logging and governance. It will miss the new topics and the new domain structure, so supplement it with SCS-C03 material and map your notes to the new blueprint.
Does an SCS-C02 certification stay valid?
AWS certifications are valid for 3 years from the date you earned them. A credential earned on SCS-C02 before it retired stays valid for its normal period. Confirm your expiry date in your AWS Certification account.
Are there prerequisites for the AWS Certified Security – Specialty exam?
No formal prerequisite is required. AWS recommends five years of IT security experience designing and implementing security solutions and two or more years of hands-on experience securing AWS workloads. The SCS-C03 guide describes the target candidate as having 3 to 5 years of experience securing cloud solutions.
What question types appear on SCS-C03?
Multiple choice, multiple response, ordering and matching. Ordering and matching require every item to be correct for credit.
Is the AWS Security Specialty worth taking in 2026?
It is a reasonable choice if you work in cloud security, incident response or compliance on AWS and want a recognised specialty credential. Its value depends on your role and employer, so review job listings in your target market before you decide.
Final Thoughts
SCS-C02 is closed, so the decision is made for you. The useful move is to treat SCS-C03 as an update, not a restart: keep your IAM, encryption and infrastructure knowledge, learn the seven new topics, and rebalance your time toward identity and incident response. Check the current exam guide and price on AWS’s official Security Specialty page before you book, since languages, fees and policies can change.
