How I Passed the AWS Certified Security - Specialty (SCS-C03)

I passed the AWS Certified Security – Specialty (SCS-C02). Hard exam, but a fair one — it doesn't care whether you memorized service names. It cares whether you can pick the right control when three of the four options would technically work.

The basics

65 questions, 170 minutes, $300. Scaled score out of 1,000 and you need 750. About 15 of the questions are unscored pilot questions and you'll never know which ones.

That's roughly two and a half minutes per question, which sounds fine until you hit a 90-word scenario with five answer options that each run three lines. The reading is the real time pressure, not the difficulty. I flagged anything that made me read the stem twice and kept moving.

What it actually tests

Six domains: Infrastructure Security is the biggest slice at 20%, then Logging & Monitoring and Data Protection at 18% each, IAM at 16%, and Threat Detection/Incident Response and Governance at 14% each.

Look at that spread. Logging and Data Protection together are 36% of the exam. This is a detection-and-evidence test as much as a hardening test. If your instinct is to lock down the network edge and call it done, this exam will find that gap fast.

Most questions aren't "which service does X." They're "here's a sketchy architecture — what's the correct fix." And "correct" means whatever lines up with AWS's own security best practices. A few patterns decided most questions for me:

• Least privilege wins. Wildcard action vs. a scoped resource ARN with a condition key? Take the scoped one. Almost every time.

• Roles over access keys. Long-lived IAM user credentials are rarely the intended answer.

• Layers matter. Security groups, NACLs, WAF, Shield, Network Firewall — know which one handles which kind of attack.

• Encrypt everything, and know who holds the key. AWS-managed vs. customer-managed vs. CloudHSM is usually a compliance question, not a technical one.

• Protect the logs. A log an attacker can delete isn't evidence. Object Lock, cross-account archive, tight bucket policies.

• Automate the response. If the answer involves a human spotting something on a dashboard, it's probably wrong. EventBridge → Lambda is probably right.

• Contain before you eradicate. Isolate the instance, snapshot the volume, capture memory, then dig in. "Terminate the instance" shows up as bait more than once.

The services I actually had to learn

I came in comfortable with a few of these. I left comfortable with all of them.

IAM is the highest-leverage topic, full stop. You need to walk an explicit deny, an SCP, a permissions boundary, and a resource policy in the right order and land on the right answer.

KMS deserves its own study block — key policies vs. IAM policies, grants, encryption context, multi-Region keys, what happens on key deletion.

Detection: GuardDuty, Security Hub, Detective, Inspector. Know what each one is for in one sentence, because they blur together under time pressure.

Logging: CloudTrail (org trails, data vs. management events), VPC Flow Logs, CloudWatch metric filters, Athena for querying the archive. Half the domain is just knowing which log would even contain the evidence.

Everything else: VPC endpoints, WAF against the OWASP Top 10, Macie, Secrets Manager, ACM, Config with auto-remediation, Organizations and SCPs, Systems Manager.

The pattern: AWS has a purpose-built service for basically every control, and the exam wants that one. Sensitive data discovery? It's Macie, not a Lambda you wrote yourself.

What made it hard

The distractors are genuinely good. Multiple answers work — only one is the least-privilege, lowest-overhead, AWS-native option. Read the qualifiers in the question ("with the least operational overhead," "without modifying the application"). Those phrases are the question.

Worth it?

Yeah. Security work is cloud security work now whether the job title says so or not. And studying for this changed how I read an environment — I catch stuff I'd have walked past before. An overly broad trust policy. A log bucket with no Object Lock. A security group someone opened "temporarily."

The cert is the receipt. The reasoning is what you keep.

If you're going for it: learn IAM policy evaluation cold before anything else, get hands-on with KMS (build a key, lock yourself out, you'll never forget how key policies work), and use practice exams to find gaps — not to memorize questions. If you can't say why the wrong answers are wrong, you don't know it yet.