Security Specialty
AWS Security Specialty SCS-C02 vs SCS-C03: Every Change in the New Exam
SCS-C02 was in use until December 1, 2025 and SCS-C03 began on December 2, 2025. Detection and Incident Response are now separate domains, IAM grew from 16% to 20%, and new topics such as generative AI guardrails, OCSF and key material were added.
Key dates
- SCS-C02: in use until December 1, 2025.
- SCS-C03: in use beginning December 2, 2025.
- AWS says exam guide updates are published about one month before they are reflected on the exam.
If you are studying now, use the SCS-C03 exam guide. Our SCS-C03 exam guide summary lists the current format, scoring and domains.
Domain weights: SCS-C02 vs SCS-C03
| SCS-C02 domain (until Dec 1, 2025) | SCS-C03 domain (from Dec 2, 2025) |
|---|---|
| Domain 1: Threat Detection and Incident Response (14%) | Domain 1: Detection (16%) |
| Domain 2: Security Logging and Monitoring (18%) | Domain 2: Incident Response (14%) |
| Domain 3: Infrastructure Security (20%) | Domain 3: Infrastructure Security (18%) |
| Domain 4: Identity and Access Management (16%) | Domain 4: Identity and Access Management (20%) |
| Domain 5: Data Protection (18%) | Domain 5: Data Protection (18%) |
| Domain 6: Management and Security Governance (14%) | Domain 6: Security Foundations and Governance (14%) |
The table follows AWS's side-by-side layout. Domains 1 and 2 were restructured: "Threat Detection and Incident Response" and "Security Logging and Monitoring" became Detection and Incident Response, so those rows do not map one to one. Domain 6 was renamed.
What was added in SCS-C03
- 2.2.3: validate findings from AWS security services to assess the scope and impact of an event.
- 3.1.4: configure integrations with AWS edge services and third-party services, for example ingesting data in OCSF format or using third-party WAF rules.
- 3.2.7: implement protections and guardrails for generative AI applications, for example the GenAI OWASP Top 10 for LLM Applications protections.
- 5.1.3: design and configure inter-resource encryption in transit, for example inter-node encryption for Amazon EMR, Amazon EKS and SageMaker AI, and Nitro encryption.
- 5.3.3: describe the differences between imported key material and AWS generated key material.
- 5.3.4: mask sensitive data, for example CloudWatch Logs data protection policies and Amazon SNS message data protection.
- 5.3.5: create and manage encryption keys and certificates across a single Region or multiple Regions, for example KMS customer managed keys and AWS Private CA.
Study the key-material topics in AWS KMS: key policies, rotation and deletion and the data-protection tasks in Domain 5.
What was removed
AWS lists these items as removed from the exam content. Spending less time on them can free hours for the new topics:
- Identify security gaps through architectural reviews and cost analysis (old Task 6.4).
- AWS Security Finding Format (ASFF), and the AWS Security Incident Response Guide as a listed knowledge item.
- Log format and components, for example CloudTrail logs (old Task 2.5).
- Host-based security, for example host firewalls and hardening (old Task 3.3).
- How to analyze reachability with VPC Reachability Analyzer and Amazon Inspector, fundamental TCP/IP networking concepts, and interpreting network connectivity problems (old Task 3.4).
- Components and impact of a policy: Principal, Action, Resource, Condition (old Task 4.2).
- TLS concepts, and cross-Region networking with private and public VIFs (old Task 5.1).
- Configuring S3 static website hosting (old Task 5.2).
How to adjust your study plan
- Weight your time by the new percentages. IAM 20%, Infrastructure Security 18%, Data Protection 18%, Detection 16%, Incident Response 14%, Governance 14%.
- Add the new topics: generative AI guardrails, OCSF integrations, inter-resource encryption in transit, imported versus AWS-generated key material, masking sensitive data and multi-Region keys and certificates.
- Check older notes. If you use SCS-C02 materials, verify them against the SCS-C03 guide, especially the removed and recategorized areas.
- Use the roadmap. Our 4-week study plan is built on the SCS-C03 weights.
Our practice bank tags questions by exam version (C03 or C02), so you can filter to the current version in the practice test.
Frequently asked questions
When did the SCS-C03 exam start?
SCS-C03 began on December 2, 2025. SCS-C02 was in use until December 1, 2025.
What is the biggest change from SCS-C02 to SCS-C03?
Detection and Incident Response became separate domains, and Identity and Access Management grew from 16% to 20% of scored content. New topics include generative AI guardrails, OCSF integrations and key material.
Which topics were removed in SCS-C03?
AWS lists items such as ASFF, host-based security, TCP/IP fundamentals, TLS concepts and S3 static website hosting as removed.
Are SCS-C02 practice questions still useful?
Many topics overlap, but check them against the SCS-C03 guide: some content was added, removed or recategorized.
Sources
AWS updates its programs and documentation. Check the linked official pages for the latest details before you decide or pay.
Practice for your AWS exam
Free practice tests with instant explanations and spaced repetition. No sign-up.
Keep reading
- Security Specialty
AWS Security Specialty Study Plan: A 4-Week Roadmap
A week-by-week SCS-C03 study plan built from the domain weights: what to read, what to practice and how to finish with a timed test.
3 min read - Security Specialty
SCS-C03 In-Scope AWS Services: The Official List
Every AWS service on the Security Specialty exam, grouped by category, plus what is out of scope and the concepts AWS says to know.
2 min read - Security Specialty
AWS Security Specialty Exam Tips: 12 Must-Know Facts
12 facts and tactics for SCS-C03 test day: scoring, unscored questions, time per question, question types, retakes and managing the clock.
2 min read