Here's a roadmap based on the current exam (SCS-C03), which replaced SCS-C02 in December 2025.
Exam at a Glance
- 65 questions (50 scored, 15 unscored), 170 minutes
- Passing score: 750/1000
- Cost: $300 USD (you get a 50% discount if you hold any active AWS cert — though yours expired, so factor this in if you renew)
- Recommended experience: 3–5 years securing cloud solutions, 2+ years hands-on AWS security
The 6 Domains (in priority order)
| # | Domain | Weight | Your Likely Gap |
|---|---|---|---|
| 4 | Identity & Access Management | 20% | Medium — SAA covered IAM basics; here you need deep policy evaluation logic, permission boundaries, ABAC/RBAC design, IAM Identity Center, cross-account patterns |
| 3 | Infrastructure Security | 18% | Medium-Low — VPC, security groups, NACLs from SAA; now add WAF, Shield, Network Firewall, edge security, container/host hardening |
| 5 | Data Protection | 18% | High — KMS key policies, CloudHSM, envelope encryption, Secrets Manager, S3 Object Lock, cross-region key management, data masking |
| 1 | Detection | 16% | High — GuardDuty, Security Hub, Security Lake, Config conformance packs, CloudWatch Logs Insights, log correlation with Athena/OpenSearch |
| 2 | Incident Response | 14% | High — Forensics (Automated Forensics Orchestrator for EC2), runbooks, containment strategies, root cause analysis with Detective |
| 6 | Security Foundations & Governance | 14% | Medium — AWS Organizations SCPs/RCPs, Control Tower, CloudFormation Guard, AWS Config rules, Audit Manager, Artifact |
Three-Phase Plan
Phase 1: Foundation Refresh (2–3 weeks)
Goal: Rebuild core AWS fluency and fill security-specific fundamentals.
- Revisit the Shared Responsibility Model — know exactly where AWS ends and you begin
- Refresh IAM deeply: policy structure, evaluation logic, condition keys, role trust policies, permission boundaries, SCPs
- Revisit VPC networking: security groups vs. NACLs, VPC endpoints, PrivateLink, flow logs
- Revisit KMS: CMKs vs. AWS-managed vs. AWS-owned keys, key policies vs. IAM policies, envelope encryption
- Review CloudTrail + CloudWatch: how to configure an organization trail, log groups, metric filters, dashboards
Phase 2: Domain-by-Domain Deep Dive (6–8 weeks)
Goal: Master each domain, roughly in weight order (IAM first, then Infrastructure, Data Protection, Detection, IR, Governance). Spend more time where your background is weakest.
For every service that appears in the in-scope list [1], you should know:
- What security problem it solves
- How to configure its security-relevant settings
- How it integrates with other security services
- Common exam scenarios and failure modes
Phase 3: Practice & Assess (3–4 weeks)
- Official practice question set (free on AWS Skill Builder)
- Official pretest (paid, on AWS Skill Builder)
- Third-party practice exams (Tutorials Dojo, Whizlabs)
- Focus on the new SCS-C03 question types: ordering and matching — not just multiple choice
- Review every wrong answer and trace it back to the AWS documentation
Key New Topics in SCS-C03 (not in the old SCS-C02)
These are likely to be emphasized, so pay extra attention:
- Generative AI security — OWASP Top 10 for LLM protections (e.g., Amazon Bedrock guardrails)
- Inter-resource encryption in transit — Nitro encryption, inter-node encryption (EMR, EKS, SageMaker)
- Data masking — CloudWatch Logs data protection policies, SNS message data protection
- OCSF (Open Cybersecurity Schema Framework) — ingesting third-party data into AWS security tools
- AWS Verified Access — Zero Trust-based access to corporate applications (replaces VPN)
- RCPs (Resource Control Policies) — new alongside SCPs in Organizations
- Amazon Security Lake — centralizing security logs into a data lake
- Cross-region key and certificate management — multi-region KMS keys, Private CA
Recommended Core Resources
| Resource | Purpose |
|---|---|
| AWS Skill Builder — Security Specialty learning path | Official digital courses + labs |
| Exam Guide (SCS-C03) | Your permanent reference — map every task statement to a hands-on exercise |
| Tutorials Dojo practice exams | Widely praised for realistic questions and excellent explanations |
| AWS re:Inforce talks (YouTube) | Deep dives on security services from AWS experts |
| AWS Security Blog | Real-world patterns and new feature announcements |
| Hands-on labs (AWS Builder Labs / personal sandbox) | Nothing replaces building: set up an Organization, deploy SCPs, configure GuardDuty, encrypt an RDS with KMS, write a WAF rule, etc. |
Suggested Timeline
- Total: 12–16 weeks part-time (or 6–8 weeks full-time)
- Lean toward 14–16 weeks to rebuild muscle memory
- Aim for 2–3 hours/day, 5 days/week with a hands-on lab session every week