AWS Certified Security - Specialty (SCS-C02)

The Security Specialty is the AWS certification that assumes you already run things on AWS. It does not teach you the platform — it asks whether you can tell why a request that should have been denied was allowed, and find the answer in logs you configured yourself.

What the weights tell you to study

Infrastructure Security leads at 20%, with Logging and Monitoring and Data Protection at 18% each. Those three are more than half the exam, and all three reward hands-on work over reading.

Identity and Access Management is nominally 16%, and that number understates it badly. Policy evaluation logic is the machinery underneath questions in every other domain: an infrastructure question about a VPC endpoint, a data question about a KMS key, a governance question about an SCP all resolve to whether a specific principal is allowed a specific action. Learn the evaluation order first and the rest of the exam gets easier.

Threat Detection and Incident Response and Management and Security Governance sit at 14% each. They are the smallest domains and they overlap heavily — both assume a multi-account organisation with centralised, automated controls.

What the exam is actually like

170 minutes, 65 questions, and only 50 of them count. Fifteen are unscored and unmarked, so a question that seems unreasonably obscure may simply not be scored. Answer it and move on rather than losing four minutes to it.

Scaled scoring, 100 to 1,000, pass at 750, compensatory across the whole exam. No individual domain has to be passed. There is no penalty for a wrong answer, which makes leaving anything blank strictly worse than guessing.

Questions are scenarios with long stems. Most describe an architecture, state a symptom, and offer four plausible remedies. The skill being tested is elimination under time pressure — reading the last sentence first, to find out what is actually being asked, is worth practising.

Where the marks are lost

Two places. The first is the boundary between a resource policy and an identity policy — S3 bucket policies and KMS key policies both need to agree with IAM, and questions are built precisely on that seam. The second is troubleshooting: several task statements are explicitly about diagnosing something already broken, and candidates who only ever built working configurations have never seen the failure mode being described.

Before you book

The exam is $300 and the certification is valid for three years. AWS publishes the in-scope and out-of-scope service lists in the exam guide appendix — read them before planning your study, because the surface is narrower than "AWS security" implies, and weeks are lost to services that cannot appear.