Security Specialty
AWS Security Specialty Study Plan: A 4-Week SCS-C03 Roadmap Built on the Exam Weights
Spend most of your time where the points are: IAM (20%), Infrastructure Security (18%) and Data Protection (18%). This 4-week plan covers all six SCS-C03 domains, adds weekly practice and saves the last days for full-length timed tests.
Before you start
This plan is our recommendation, not an official AWS plan. It assumes you already work with AWS. AWS recommends six months to two years of hands-on experience and describes the Security Specialty candidate as having 3–5 years of experience securing cloud solutions. If you are newer to AWS, stretch each week into two.
The exam has 65 questions in 170 minutes and a passing score of 750 out of 1,000. Details in the SCS-C03 exam guide.
The plan at a glance
| Week | Focus | Exam domains | Weight |
|---|---|---|---|
| 1 | Identity, authorization and governance | Domain 4 (IAM) and Domain 6 (Governance) | 20% + 14% |
| 2 | Data protection and encryption | Domain 5 (Data Protection) | 18% |
| 3 | Network and compute security, then detection | Domain 3 (Infrastructure) and Domain 1 (Detection) | 18% + 16% |
| 4 | Incident response, review and full practice exams | Domain 2 (Incident Response) plus everything | 14% + review |
Week 1: IAM and governance (34% of the exam)
- Read: Domain 4: IAM, Domain 6: Governance and IAM policy evaluation, SCPs and permissions boundaries.
- Know cold: explicit deny always wins; permissions boundaries and SCPs only limit; resource policies and identity policies combine differently in the same account.
- Also cover: confused deputy and External ID and IAM Access Analyzer.
- Do: in a sandbox account, attach an SCP to a test OU and see which actions fail; build a role with a permissions boundary; run Access Analyzer.
- Practice: two 20-question tests on IAM, reviewing every miss.
Week 2: data protection (18%)
- Read: Domain 5, AWS KMS: key policies, rotation and deletion and S3 Object Lock, Macie and Secrets Manager.
- Know cold: key policy versus IAM policy, automatic versus on-demand rotation, key deletion waiting period, imported key material.
- Compare: KMS vs CloudHSM and Secrets Manager vs Parameter Store.
- Do: create a customer managed key, read its default key policy, schedule a deletion and cancel it, and rotate on demand.
- Practice: one 30-question test on data protection.
Week 3: infrastructure and detection (34%)
- Read: Domain 3, Domain 1, network security topics and GuardDuty, CloudTrail and Config.
- Know cold: security groups are stateful and NACLs are stateless; S3 gateway versus interface endpoints; what GuardDuty analyzes on its own; CloudTrail log file validation.
- Compare: WAF vs Shield vs Network Firewall vs Firewall Manager and GuardDuty vs Inspector vs Macie vs Security Hub.
- Do: enable GuardDuty in a test account, turn on CloudTrail log file validation, and start a Session Manager session with logging.
- Practice: two 20-question tests, one per domain.
Week 4: incident response and full practice
- Read: Domain 2 and incident response notes.
- Know cold: capture memory before isolating or shutting down a compromised instance; changing a security group does not cut tracked connections; how to contain compromised access keys and temporary credentials.
- Practice: one full-length test in exam mode (65 questions, 170 minutes) early in the week and another two days before the exam.
- Review: work through your incorrect questions bank until it is empty, and re-read the topics behind your most frequent misses.
Daily routine that works
- 30 minutes of reading from a study topic, with the official source open.
- 20 practice questions, marking whether you guessed, doubted or were sure.
- 10 minutes of review: the incorrect questions bank and the questions due for spaced repetition.
Start a free practice test and the app handles the review schedule for you.
Short on time or more relaxed?
- 2 weeks: combine weeks 1 and 2, then 3 and 4. Keep the full-length tests.
- 8 weeks: one domain per week, with a final fortnight of mixed practice and full-length tests.
Frequently asked questions
How long should I study for the AWS Security Specialty?
It depends on your experience. AWS recommends six months to two years of hands-on AWS experience, and this plan assumes you already work with AWS security. If not, double each week.
Which SCS-C03 domain should I study first?
IAM. It is the heaviest domain at 20% of scored content, and its policy-evaluation rules appear in questions across other domains.
How many practice questions should I do?
Aim for around 20 a day and review every mistake. The review matters more than the volume.
Should I take a full-length practice exam?
Yes. Do at least two in exam mode: the exam has 65 questions in 170 minutes, about 2 minutes 37 seconds per question.
Sources
AWS updates its programs and documentation. Check the linked official pages for the latest details before you decide or pay.
Practice for your AWS exam
Free practice tests with instant explanations and spaced repetition. No sign-up.
Keep reading
- Security Specialty
AWS Security Specialty Exam Tips: 12 Must-Know Facts
12 facts and tactics for SCS-C03 test day: scoring, unscored questions, time per question, question types, retakes and managing the clock.
2 min read - Security Specialty
SCS-C02 vs SCS-C03: Every Change in the New Exam
SCS-C03 replaced SCS-C02 on Dec 2, 2025. See the new domain weights, every topic added or removed, and how to adjust your study plan.
3 min read - Security Specialty
SCS-C03 In-Scope AWS Services: The Official List
Every AWS service on the Security Specialty exam, grouped by category, plus what is out of scope and the concepts AWS says to know.
2 min read