CertNote/ Commute Study Notes
Roadmap
KOEN
CLF-C02 · FoundationalCloud Practitioner - Foundational
DVA-C02 · AssociateDeveloper - Associate
SAA-C03 · AssociateSolutions Architect - Associate
SOA-C02 · AssociateCloudOps Engineer - Associate
SAP-C02 · ProfessionalSolutions Architect - Professional
DOP-C02 · ProfessionalDevOps Engineer - Professional
Linux Master 2 · 2급KAIT Linux Master - Level 2
SCS-C03 · SpecialtySecurity - Specialty
  • Week 1
    • 1.Shared Responsibility Model and SCS-C03's 6 Domains: The Big Picture for Security Engineers
    • 2.IAM Core: Users, Groups, Roles, Policies and the Basic Flow of Policy Evaluation
    • 3.IAM Policies in Depth: Identity vs Resource Policies, Condition Keys, Least Privilege Design
    • 4.STS and Temporary Credentials: AssumeRole, Federation, Role Chaining, Confused Deputy Prevention
    • 5.Week 1 Synthesis: Integrating IAM and Credentials Through Scenarios
  • Week 2
  • Week 3
  • Week 4
  • Week 5
  • Week 6
  • Week 7
  • Week 8
  • Week 9
  • Week 10
  • Week 11
  • Week 12
Linux Master 1 · 1급KAIT Linux Master - Level 1
MLA-C01 · AssociateMachine Learning Engineer - Associate
AIF-C01 · FoundationalAI Practitioner - Foundational
DEA-C01 · AssociateData Engineer - Associate
MLS-C01 · SpecialtyMachine Learning - Specialty
SQLD · 개발자SQL Developer (SQLD)

© CertNote · 주간랩스

  • About
  • Changelog
  • Contact
  • Terms
  • Privacy
← All certifications/SCS-C03

Security - Specialty

12 weeks · 60 days · Specialty

Start with Week 1

Read SCS-C03 pass reviews →

Exam Information

Specialty · Hands-on experience in the relevant domain recommended
Questions
65
Duration
170min
Passing
750 / 1000
Cost
$300
Validity
3y

Domain Weights

Detection16%
Incident Response14%
Infrastructure Security18%
Identity and Access Management20%
Data Protection18%
Security Foundations and Governance14%
FormatMultiple-choice, multiple-response, ordering, and matching
PrerequisitesNone (recommended: 5 years of IT security experience and 2 years of securing AWS workloads)
LanguagesEnglish, Korean, Japanese, Portuguese (Brazil), Simplified Chinese, Spanish (Latin America)

Benefits & Tips

  • Passing earns you a 50% discount voucher for your next exam. Find it under "Benefits" in your AWS Certification account and use it for recertification or another certification (it has an expiry date, so use it before then).
  • The certification is valid for 3 years and must be renewed before it expires. You can use the 50% voucher for recertification too.
  • There is no free retake (every attempt is paid in full). Passing on the first try is the cheapest route, so take the real exam once your mock exam scores clear the passing mark.
  • Passing also earns you a Credly digital badge that you can add to LinkedIn and your email signature.

FAQ

How many questions are on the SCS-C03 exam, and how long is it?+

SCS-C03 has 65 questions and a time limit of 170 minutes. Questions are multiple-choice, multiple-response, ordering, and matching.

What is the passing score?+

A score of 750 or higher out of 1000 is required to pass. Scores are scaled to account for question difficulty, so they are not the same as a simple percentage of correct answers.

How much does the exam cost, and how do I register?+

The exam fee is US $300. You can take it through Pearson VUE at a test center or as an online proctored exam. There is no free retake, so you pay the full fee each time you sit the exam.

How long is the certification valid, and how do I recertify?+

The certification is valid for 3 years after you pass, and you must recertify before it expires. Passing the exam earns you a 50% discount voucher for your next exam, which you can use to recertify or to take another AWS certification.

Can I take the exam in Korean?+

Yes. The exam is offered in 6 languages, including Korean. You can choose your language when you register for the exam.

Official Exam Guide Register for Exam

Week 1

  • Day 1Shared Responsibility Model and SCS-C03's 6 Domains: The Big Picture for Security Engineers
  • Day 2IAM Core: Users, Groups, Roles, Policies and the Basic Flow of Policy Evaluation
  • Day 3IAM Policies in Depth: Identity vs Resource Policies, Condition Keys, Least Privilege Design
  • Day 4STS and Temporary Credentials: AssumeRole, Federation, Role Chaining, Confused Deputy Prevention
  • Day 5Week 1 Synthesis: Integrating IAM and Credentials Through Scenarios

Week 2

  • Day 1Mastering Policy Evaluation Logic: Explicit Deny Beats Everything
  • Day 2Permission Boundaries and Delegation: The Art of Safely Handing Permissions to Developers
  • Day 3AWS Organizations and SCPs: Designing Account-Level Guardrails
  • Day 4IAM Identity Center and Federation: SAML, OIDC, and ABAC
  • Day 5Week 2 Integration: Multi-Account IAM Governance Scenario

Week 3

  • Day 1VPC Security Design: Network as Your First Line of Defense
  • Day 2Security Groups vs Network ACLs: The Essence of Stateful and Stateless
  • Day 3VPC Flow Logs and Traffic Visibility: Reading a Breach from the Logs
  • Day 4Private Connectivity: VPC Endpoints and Sealing Off Data Exfiltration
  • Day 5Week 3 Integration: Network Isolation and Traffic Control as One

Week 4

  • Day 1AWS WAF: Web ACLs, Rules and Rule Groups, Rate-Based Rules, SQLi/XSS Defense
  • Day 2AWS Shield (Standard/Advanced) and DDoS Protection: Layered Defense, CloudFront/Route 53 Integration
  • Day 3AWS Network Firewall and DNS Firewall: Stateful Inspection, Domain Filtering, Centralized Inspection VPC
  • Day 4Edge Security Integration: CloudFront (OAC, Signed URLs), ACM Certificates, Perimeter Security Architecture
  • Day 5Week 4 Synthesis: Integrated Review of Edge and Perimeter Defense Scenarios

Week 5

  • Day 1AWS KMS Fundamentals: CMK Types, Key Policy vs IAM, Symmetric/Asymmetric Keys
  • Day 2Envelope Encryption and Data Keys: GenerateDataKey, Encryption Context
  • Day 3Key Policies, Grants, and Cross-Account Sharing: ViaService Condition and Key Governance
  • Day 4Encryption at Rest/in Transit: TLS, Service-Specific Encryption, Key Rotation
  • Day 5Week 5 Synthesis: Integrated Review of Encryption and Key Management Scenarios

Week 6

  • Day 1Secrets Manager: Automatic Rotation (Lambda), Parameter Store Comparison, Cross-Account Secrets
  • Day 2S3 Data Protection: SSE-S3/SSE-KMS/DSSE, Bucket Keys, Object Lock, Versioning, Block Public Access
  • Day 3S3 Access Control in Depth: Bucket Policies, ACLs, Access Points, Enforcing Encryption, Data Exfiltration Prevention
  • Day 4ACM and Macie: Certificate Lifecycle and Integration, Macie Sensitive Data (PII) Discovery and Classification
  • Day 5Week 6 Synthesis: Integrated Review of Secrets, Storage, and Sensitive Data Scenarios

Week 7

  • Day 1CloudTrail: Management/Data Events, Organization Trail, Log File Integrity Validation, CloudTrail Lake
  • Day 2AWS Config: Configuration Items and Records, Rules (Managed/Custom Lambda), Conformance Pack, Auto-Remediation
  • Day 3VPC Flow Logs and Network Logging: Detecting Breaches/Misconfig via Traffic, Route 53 Resolver Query Logs
  • Day 4Log Integrity, Retention, and Centralization: S3 Object Lock, Cross-Account Log Aggregation, KMS Encryption of Logs
  • Day 5Week 7 Integration: Audit Trail Scenario Review

Week 8

  • Day 1CloudWatch: Log Groups, Metric Filters, Alarms, Anomaly Detection, Security Event Notifications
  • Day 2Security Hub: Security Standards (CIS/FSBP), Consolidated Score, Finding Aggregation and Normalization (ASFF), Automated Response
  • Day 3Log Analysis: Query CloudTrail/VPC Flow with Athena, OpenSearch, CloudWatch Logs Insights
  • Day 4EventBridge Security Automation: Finding Routing, Alert Pipelines, Security Data Lake Concept
  • Day 5Week 8 Integration: Monitoring, Aggregation, and Analysis Scenarios, a Comprehensive Review

Week 9

  • Day 1Amazon GuardDuty: Threat Detection Principles, Finding Types, Threat Intelligence, Multi-Account Delegated Administrator
  • Day 2Amazon Detective: Finding Investigation and Root Cause, Behavior Graph, GuardDuty Integration
  • Day 3Amazon Inspector: EC2/ECR/Lambda Vulnerability Scanning, CVE, Automated Assessment
  • Day 4Detection Integration: GuardDuty + Security Hub + Detective + Inspector One Picture, Multi-Account Detection Baseline
  • Day 5Week 9 Synthesis: Integrated Review of Threat Detection Scenarios

Week 10

  • Day 1Automated Response Pipeline: EventBridge + SSM Automation + Lambda for Auto-Remediation of Findings
  • Day 2Incident Response for Compromised EC2: Isolation, Snapshots, Forensics, Credential Revocation
  • Day 3Credential Exposure Response: Access Key Exposure, Root Compromise, IAM Neutralization and Rotation Playbook
  • Day 4Incident Response Framework: NIST Phases, Runbooks, Automation vs Human Judgment Boundary
  • Day 5Week 10 Synthesis: Integrated Incident Response Scenario Review

Week 11

  • Day 1AWS Organizations Security Governance: SCP Design, Delegated Administrators, and the Central Security Account Model
  • Day 2Control Tower and the Landing Zone: Guardrails (Preventive/Detective), Account Factory, Compliance Baseline
  • Day 3Audit Manager and Compliance: Automated Evidence Collection, Frameworks (CIS/PCI), and Integration with Config
  • Day 4Multi-Account Security Operations: Firewall Manager, Central Policy Distribution, Cost/Tag Governance, Security Baseline Automation
  • Day 5Week 11 Comprehensive Review: Integrated Governance Scenarios

Week 12

  • Day 1Integrated Review Domains 1 & 2: Detection ↔ Incident Response
  • Day 2Integrated Review Domains 3 & 4: Infrastructure Security ↔ Identity and Access Management
  • Day 3Integrated Review Domains 5 & 6: Data Protection ↔ Security Foundations and Governance
  • Day 4Full Mock Exam Pacing: A Cross-Domain Scenario Check Across the 6 Domains
  • Day 5D-Day Wrap-Up: Exam-Day Strategy, Keyword → Service Translation, and a Full Roundup of Traps