AWS Certified Security – Specialty: the experience behind SCS-C03 and what preparing costs

By Alexander Shick · Updated November 5, 2026

What AWS means by a security specialist

AWS says the certification "validates your expertise in creating and implementing security solutions in the AWS Cloud." The exam guide adds data classification, encryption in transit and at rest, and trade-offs between cost, security and deployment complexity. Its target candidate has the equivalent of 3 to 5 years securing cloud solutions; the certification page describes candidates with five years of IT security work and two or more years securing AWS workloads. Out of scope: designing cryptographic algorithms, packet-level traffic analysis, architecting whole deployments, end-user computing and training ML models.

Who can book, and how SCS-C03 is built

Eligibility: AWS says you are not required to earn any specific certification first. Recommended experience: five years of IT security designing and implementing security solutions, and two or more years of hands-on work securing AWS workloads. Format: 65 questions in 170 minutes, at a Pearson VUE center or online. The guide lists ordering and matching questions alongside multiple choice and multiple response; ordering and matching earn credit only when fully correct. 50 questions are scored and 15 are unscored. The scaled score runs from 100 to 1,000, 750 passes, and only the overall score counts.

Version: SCS-C03 has been the exam since December 2, 2025. It split detection and incident response into separate domains, renamed the governance domain, and added generative AI guardrails, OCSF data from third-party sources, inter-node encryption, sensitive-data masking and multi-Region key management. As of November 5, 2026, AWS's exam guide list shows no replacement announced for SCS-C03; the November changes are to Solutions Architect Professional (SAP-C03 from November 17) and Developer Associate (DVA-C02 ends November 30).

Preparing for the security specialty

• AWS Skill Builder exam prep, free. The SCS-C03 Exam Prep Plan runs 21 hours 45 minutes and includes domain reviews and an official practice question set. The official pretest and practice exam are marked Subscription. A 20-hour AWS Security Engineer Advanced learning plan with labs sits alongside it. Suits engineers already doing the work who need to see AWS's framing.
• A sandbox organization. Set up GuardDuty, Security Hub, CloudTrail organization trails, KMS keys with key policies, and service control policies, then run a mock incident. The scenarios read faster once you have done these.
• Independent practice exams. Tutorials Dojo sells 140 SCS-C03 questions with one year of access at $17.99 list, and says it updates them against the SCS-C03 guide.
• Security Engineering on AWS. AWS's official three-day security course, taught by training partners. Learning Tree lists Architecting on AWS among its recommended prerequisites. Suits people who want instructor-led labs or whose employer pays.

Security Specialty preparation prices

Costs people miss: a retake costs another $300 after a 14-day wait. Skill Builder items marked Subscription need a paid plan. Security services you switch on in a sandbox bill like any other usage, so turn them off when you finish practicing.

Comparing Security Engineering on AWS classes

• Does it cover SCS-C03? None of the three class listings names SCS-C03. Ask whether the labs include the generative AI guardrails and key management additions.
• Who pays for the exam? Only New Horizons prices a voucher, as a $300 add-on; Global Knowledge and Learning Tree do not state a voucher, so budget the $300 fee separately.
• What it says about prerequisites. Learning Tree recommends Architecting on AWS and working knowledge of IT security first. If you lack them, the class moves fast.
• Timing against your exam date. Learning Tree lists December 16 to 18 as a virtual session; a class close to your booking leaves little time for practice exams afterward.

Keeping Security Specialty active

The certification is valid for 3 years. Renew by passing the latest version of the exam, with the 50% discount voucher in your AWS Certification Account, or by AWS's Skill Builder maintenance route, which adds 1 year and needs an active Skill Builder subscription and a certification within 90 days of expiry.

For security teams on AWS

The exam maps closely to a cloud security team's daily work, so a shared sandbox organization and the free plan cover most of it. Fund the class for people moving into AWS security from on-premises roles, and keep the 750 pass mark in mind when setting dates.

SCS-C03 questions

Is SCS-C02 still available?

No. SCS-C02 was in use until December 1, 2025; SCS-C03 is the exam now.

What score passes?

750 on a scale of 100 to 1,000.

Do I need another AWS certification first?

No. AWS does not require one, though it recommends two or more years securing AWS workloads.

How much does it cost?

$300 in the US as of November 2026; each retake costs the same.

Next step

Send your security background and AWS experience, and we will suggest an SCS-C03 plan and whether a class adds anything.

Ask for help choosing AWS Security Specialty training