← All roadmaps/Security

Security roadmap

You design and operate identity, network and data protection in AWS environments. Building on an understanding of architecture (SAA), you go deeper with the security specialty certification (SCS).

A security role knows how things are connected before it asks what to block. SCS comes as scenarios in which VPC boundaries, identity flows, key management and log collection interlock, so without SAA-level reading of architecture, half of each question reads as background. That is why the security path places a design certification one step ahead of the specialty certification.

Certifications: 3
Curriculum length: 30 weeks · 150 days
Total exam fees: $550

Security certification exams at a glance

Exam	Questions · Time	Passing score	Exam fee	Recommended level
CLF-C02	65 questions · 90 min	700 / 1000	$100	Foundational · No prior knowledge required
SAA-C03	65 questions · 130 min	720 / 1000	$150	Intermediate · 1-2 years of relevant hands-on experience recommended
SCS-C03	65 questions · 170 min	750 / 1000	$300	Specialty · Hands-on experience in the relevant domain recommended

How to study for the Security certifications

The security specialty certification (SCS) starts from the premise that you understand architecture. Build the basic structure of VPC, IAM and encryption with SAA first, and the detection and response questions in SCS become readable.
The logic of IAM policy evaluation (explicit deny, SCPs, permissions boundaries, resource policies) is the backbone of the security exam. Practice with examples of how the final result comes out when several policies overlap.
If you organize detection (GuardDuty, Security Hub, CloudTrail) and response (isolation, revoking credentials, preserving forensic evidence) as pairs, you can solve incident response scenario questions quickly.

Frequently asked questions

Which AWS security certification should I start with?: Even if the security specialty certification (SCS) is your final goal, we recommend preparing for SAA first if you lack an architecture foundation. Most SCS questions are written on the premise that you know the structure of VPC, IAM and encryption.
Is SCS useful even if I am not in a security role?: It helps if your job involves cloud infrastructure. You can systematically organize what every AWS environment needs, such as permission design, log auditing and encryption key management.
What do people get wrong most often when studying for the security certification?: The IAM evaluation result when several policies overlap, and KMS key policies. When you read the explanations, it is effective to practice tracing which policy made the final decision.
How long does it take to finish the Security roadmap?: In the order CLF-C02 → SAA-C03 → SCS-C03, that comes to 30 weeks (150 days in total) of the CertNote curriculum. We based this on reading one day's lesson per day; if you have hands-on experience, you can move quickly through the weeks you already know. The exam fees add up to $550 in total.

The notes for every certification are free in every week. Prepare in order to fit your target role. Exam fees are based on the official AWS exam guides; exchange rates and taxes at the time of payment are extra.

Security certification exams at a glance

Exam	Questions · Time	Passing score	Exam fee	Recommended level
CLF-C02	65 questions · 90 min	700 / 1000	$100	Foundational · No prior knowledge required
SAA-C03	65 questions · 130 min	720 / 1000	$150	Intermediate · 1-2 years of relevant hands-on experience recommended
SCS-C03	65 questions · 170 min	750 / 1000	$300	Specialty · Hands-on experience in the relevant domain recommended

How to study for the Security certifications

The security specialty certification (SCS) starts from the premise that you understand architecture. Build the basic structure of VPC, IAM and encryption with SAA first, and the detection and response questions in SCS become readable.

The logic of IAM policy evaluation (explicit deny, SCPs, permissions boundaries, resource policies) is the backbone of the security exam. Practice with examples of how the final result comes out when several policies overlap.

If you organize detection (GuardDuty, Security Hub, CloudTrail) and response (isolation, revoking credentials, preserving forensic evidence) as pairs, you can solve incident response scenario questions quickly.

Frequently asked questions

Which AWS security certification should I start with?

Even if the security specialty certification (SCS) is your final goal, we recommend preparing for SAA first if you lack an architecture foundation. Most SCS questions are written on the premise that you know the structure of VPC, IAM and encryption.

Is SCS useful even if I am not in a security role?

It helps if your job involves cloud infrastructure. You can systematically organize what every AWS environment needs, such as permission design, log auditing and encryption key management.

What do people get wrong most often when studying for the security certification?

The IAM evaluation result when several policies overlap, and KMS key policies. When you read the explanations, it is effective to practice tracing which policy made the final decision.

How long does it take to finish the Security roadmap?

In the order CLF-C02 → SAA-C03 → SCS-C03, that comes to 30 weeks (150 days in total) of the CertNote curriculum. We based this on reading one day's lesson per day; if you have hands-on experience, you can move quickly through the weeks you already know. The exam fees add up to $550 in total.