AWS Certified Security - Specialty (SCS-C03)
What's actually on the current exam: 6 domains, their exact weights, format, and how to prepare, verified directly against AWS's own exam guide, not a third-party summary.
The 6 Exam Domains
Exact weights per AWS's own SCS-C03 exam guide. The exam uses compensatory scoring, you only need to pass overall, not each domain individually, but a real gap in any one domain can still cost you the pass.
Domain 1: Detection
16%Configuring and interpreting AWS's threat detection and monitoring services, designing solutions that surface security-relevant events across an account or organization.
Domain 2: Incident Response
14%Responding to and investigating security events on AWS: containment, forensic evidence collection, and recovery, the same discipline covered in our incident response service.
Domain 3: Infrastructure Security
18%Securing the network and compute layers, VPC design, security groups, edge protection, and the boundary controls that limit what's reachable in the first place.
Domain 4: Identity and Access Management
20%The largest single domain. Designing least-privilege access, multi-account identity strategies, and the policy mechanics that control who can do what.
Domain 5: Data Protection
18%Encryption at rest and in transit, key management, and data classification, protecting information regardless of which AWS service is storing it.
Domain 6: Security Foundations and Governance
14%Multi-account governance, compliance mapping, and the organizational guardrails that keep security consistent across an entire AWS Organization.
Real Preparation Resources, Not Just This Page
Reading a domain list doesn't teach you the services. These are real, in-depth resources on this site that map directly onto the exam domains above:
Security Cards
Attack vectors and defenses for 75+ individual AWS services, exactly the service-level depth the exam expects.
Glossary
Plain-language definitions for the terms and concepts that show up across every domain.
Best Practices
Deep dives per service, directly relevant to Infrastructure Security and Data Protection domains.
Compliance Frameworks
What CIS, NIST, and the other frameworks actually require, directly relevant to Domain 6.
Frequently Asked Questions
KloudSec, built by the team behind Toc Consulting
See what you're studying checked automatically, continuously
What you just read is a manual, one-time check. KloudSec runs this and 400+ more automated checks across 90+ AWS services, continuously, agentless, live in about 5 minutes.