AWS Certified Security – Specialty (SCS-C02)
Design and implement comprehensive security controls across AWS workloads, covering identity and access management, threat detection, incident response, infrastructure security, and data protection.
Official Exam Specification & Quick Facts
Question Difficulty Breakdown
Recommended Study Guides & Exam Preparation Blueprints
Reinforce your knowledge with domain breakdowns, trap question analyses, and architectural cheat sheets:
Exam Guidelines & Simulation Rules
Frequently Asked Questions (FAQ)
The SCS-C02 exam contains 65 multiple-choice and multiple-response scenario questions over 170 minutes. Cost is $300 USD with a passing threshold of 750/1000 (75%).
Domains include: (1) Threat Detection and Incident Response (~14%), (2) Security Logging and Monitoring (~18%), (3) Infrastructure Security (~20%), (4) Identity and Access Management (~16%), (5) Data Protection (~18%), and (6) Management and Security Governance (~14%).
Envelope encryption encrypts plaintext data with a unique Data Key, and then encrypts the Data Key under a Customer Master Key (CMK) stored in a FIPS 140-2 Level 3 HSM.
Permission boundaries limit the maximum permissions an IAM entity (user or role) can have within an individual account. Service Control Policies (SCPs) define maximum permissions across entire AWS accounts in an organization.
GuardDuty uses machine learning, anomaly detection, and integrated threat intelligence to analyze AWS CloudTrail event logs, VPC Flow Logs, DNS logs, and EKS audit logs for malicious activity.
AWS Network Firewall is a stateful, managed network security service that provides deep packet inspection (DPI), intrusion prevention (IPS), and application layer filtering across VPC perimeters.
Security Hub consolidates security alerts and findings from GuardDuty, Inspector, Macie, IAM Access Analyzer, and third-party tools into a single pane of glass, benchmarking posture against CIS and NIST baselines.
Amazon Macie uses machine learning and pattern matching to continuously scan Amazon S3 buckets, discovering and alerting on sensitive personally identifiable information (PII) and unencrypted buckets.
AWS WAF filters layer 7 web traffic against SQL injection, XSS, and rate flooding. AWS Shield Advanced provides enhanced layer 3/4 and layer 7 DDoS mitigation, 24/7 access to the DDoS Response Team (DRT), and cost protection.
VPC Endpoint Policies attach to Interface or Gateway endpoints, controlling which IAM principals can access which specific AWS resources through the endpoint, preventing data exfiltration.
The SCS-C02 credential is valid for three years from the date earned.
SCS-C02 certifies Cloud Security Architects, DevSecOps Leads, and Cyber Defense Specialists earning average US salaries between $145,000 and $195,000+.