Exam prep for

AWS Certified Security – Specialty

Exam set and awarded by Amazon Web Services On demand SCS-C03

For experienced cloud security practitioners preparing for AWS Certified Security – Specialty: strengthen specialist AWS security judgment and prepare to pursue the credential.

Start preparing
See all sittings
Try a sample question

Included with Elandi Pro: practice on all 6 exam domains and unlimited mock exams.

Independent exam prep. Elandi is not affiliated with, endorsed by or approved by Amazon Web Services, and does not award Amazon Web Services credentials. Our practice questions and mocks are written by Elandi, not taken from the real exam. Exam names are trademarks of their owners. AWS, Amazon Web Services and all related certification names are trademarks of Amazon.com, Inc. or its affiliates.

The exam in numbers

The exam assesses specialist ability to secure AWS products, services and cloud solutions: designing detection and incident response, protecting infrastructure and data, managing identities and access, and applying security governance. It tests decisions that balance security, cost and deployment complexity in production environments. Your mock exams use this learning plan's question count, time limit and pass mark.

Questions
65
Time limit
170min
Mock pass mark
75%
49 correct
Exam fee (paid to Amazon Web Services)
US$300
When you book the exam
Sitting
On demand
  • Single select (Radio): 4 options
  • Multiple select (Checkbox): 5 options
  • Ordering / Sequence: 3 steps · 3 choices
  • Matching pairs: 3 prompts · 3 choices

Upcoming sittings

Pick a sitting when you start. Your workspace counts down to it and paces your prep from there.

  1. On demand Book any day
    Book your exam

What AWS Certified Security – Specialty covers

6 modules · 16 units · ~16h of structured prep. Each exam domain with the weight the exam gives it, and the modules that prepare you for it.

  1. 01Detection 16%
    1. Design and implement monitoring and alerting solutions for an AWS account or organization
    2. Design and implement logging solutions
    3. Troubleshoot security monitoring, logging, and alerting solutions
  2. 02Incident Response 14%
    1. Design and test an incident response plan
    2. Respond to security events
  3. 03Infrastructure Security 18%
    1. Design, implement, and troubleshoot security controls for network edge services
    2. Design, implement, and troubleshoot security controls for compute workloads
    3. Design and troubleshoot network security controls
  4. 04Identity and Access Management 20%
    1. Design, implement, and troubleshoot authentication strategies
    2. Design, implement, and troubleshoot authorization strategies
  5. 05Data Protection 18%
    1. Design and implement controls for data in transit
    2. Design and implement controls for data at rest
    3. Design and implement controls to protect confidential data, credentials, secrets, and cryptographic key materials
  6. 06Security Foundations and Governance 14%
    1. Develop a strategy to centrally deploy and manage AWS accounts
    2. Implement a secure and consistent deployment strategy for cloud resources
    3. Evaluate the compliance of AWS resources

Your exam workspace counts down and keeps score

Set your exam day once. The workspace paces your prep in four phases, weighs your coverage by what each topic is worth, and shows where the marks are still open after every mock.

Exam in 42 days Start mock exam
  • Overview
  • All attempts
  • Review
  • Preview questions
Questions
65
Time limit
170 minutes
Pass score
75% · 49 correct
42

days until your exam

6 weeks

Thursday, 24 December 2026

  1. Learn 8+ weeks out
  2. Mock and repair 8 to 2 weeks out
  3. Simulate Last 2 weeks
  4. Consolidate Last 3 days

Now: Mock and repair. Sit a full mock every week or two, then practise the topics you missed.

How ready you are

Exam-weighted coverage
70% of the plan, counted by what each topic is worth
Full mocks taken
2 Prep guides suggest three to five before the exam
Latest mock
71% 4 points below the 75% pass mark

Where the marks are still open

  1. Identity and Access Management 20% of the exam 54%
  2. Security Foundations and Governance 14% of the exam 47%
  3. Data Protection 18% of the exam 63%
  4. Infrastructure Security 18% of the exam 71%
  5. Detection 16% of the exam 88%
  6. Incident Response 14% of the exam 100%

How the content is written

Write concise, technically precise AWS security exam preparation for experienced practitioners. Explain control selection, troubleshooting and security trade-offs through focused operational decisions.

Worked examples
Heavy
Technical jargon
Heavy
Maths & formulas
Light
Code
Light
Diagrams
Light

Try a sample question

Elandi wrote these in this learning plan's style. Pick an answer to see whether it's right and why. They are not taken from the exam.

Select one answer
  • A security team needs ongoing delivery of AWS management events from all current and future accounts in an organization, in all enabled Regions, to a central S3 bucket. Investigators need event history beyond the default CloudTrail event history retention. Which configuration best meets these requirements? One answer
    Select one answer
  • An EC2 workload role has accumulated broad IAM permissions. CloudTrail has recorded a representative deployment cycle, but a quarterly recovery workflow was not exercised. The security team must reduce permissions without assuming that unobserved actions are unnecessary. Which actions should it take? (Select TWO.) Select all that apply
    Select all that apply
  • A security engineer must verify a new cross-account evidence-access path. The target account has an evidence bucket and suitable bucket and key policies, but the investigation role does not yet exist. The source principal is already authorized to assume that named role once created. The test must use a role session, and its final audit check must inspect the CloudTrail data event generated by that specific successful object read; data-event logging is already enabled and delivery is confirmed before the audit check. Order the actions needed for this verification. Put in order

    Choose 4 steps and put them in order. Use each choice once.

    Available choices

    Your sequence

    Step 1 · Drop a choice here
    Step 2 · Drop a choice here
    Step 3 · Drop a choice here
    Step 4 · Drop a choice here
  • During a cross-account S3 exposure investigation, the team needs three distinct kinds of evidence. Match each investigative question to the AWS capability that directly addresses it. Use each capability once. Match

    Select an answer for each prompt. Choices may be reused.

Start your AWS Certified Security – Specialty learning plan.

Start preparing for AWS Certified Security – Specialtywith Elandi Pro today.

Start preparing Browse more exams