AWS Certified Security - Specialty (SCS-C03): Cost, Exam Format, and the SCS-C02 Retirement

If you studied for this exam using material written even a year ago, you were studying for a different test. AWS retired SCS-C02 on December 1, 2025, and SCS-C03 has been the only version on offer since the next day. That switch, what changed in it, plus the real all-in cost, the exam format, and all six current domain weights, is what this page covers, checked directly against AWS’s own exam guide.

Who this cert is actually for

Security Specialty targets people already doing AWS security work, not people hoping the certificate will get them into it. AWS’s own target candidate description asks for three to five years of experience securing cloud solutions generally, plus two or more years of hands-on experience specifically securing AWS workloads. That is a steep bar for a “specialty” tier that sits parallel to, not above, the Professional level.

If you are still building toward that experience, AWS Solutions Architect Associate is the more realistic next step: its Design Secure Architectures domain touches real security content without demanding years of production security work you have not accumulated yet. If your target is a vendor-neutral senior security credential rather than an AWS-specific one, weigh this against ISC2 CISSP, which tests governance and architecture across eight domains instead of AWS services specifically, or against CompTIA Security+ if you are years earlier in your security career than this exam assumes.

What it costs all-in

The exam is $300 direct from AWS, the priciest of the three AWS certifications this site currently tracks, with no discount tier for the general public and no free retake. A failed attempt costs another $300, making a wasted first attempt the single most expensive mistake available on any AWS exam.

Free and low-cost prep exists, but it matters more here than on an associate-level exam, since the material assumes years of production experience rather than fresh study. AWS’s own exam guide functions as the syllabus, and AWS Skill Builder offers official digital courses built from it at no cost. A well-regarded video course from a recognized AWS security instructor runs $20 to $30 on sale, and a dedicated SCS-C03 practice-question bank in the $20 to $30 range is worth the money, since the newer ordering and matching question types (beyond the associate-level multiple-choice and multiple-response format) reward candidates who have actually rehearsed the interaction style, not just the content. A realistic self-study budget is $300 for the voucher plus $40 to $60 in prep, assuming the years of hands-on experience are already in place. See how that all-in figure compares to every other credential on the ROI Index.

The exam itself

You get 65 questions in 170 minutes: 50 scored plus 15 unscored questions AWS is testing for future exams, unlabeled among the rest. SCS-C03 introduced two question types beyond the standard multiple-choice and multiple-response format used on AWS’s associate-level exams: ordering questions, where you arrange 3 to 5 responses into the correct sequence, and matching questions, where you pair items from two lists. Results are scored on a 100-to-1,000 scale, and 750 is the passing bar, the highest of the three AWS exams this site tracks.

The exam covers six domains under SCS-C03: Detection (16 percent), Incident Response (14 percent), Infrastructure Security (18 percent), Identity and Access Management (20 percent, the largest single share), Data Protection (18 percent), and Security Foundations and Governance (14 percent). Those six weights sum to exactly 100 percent. AWS does not publish a pass rate, so ignore any specific percentage circulating in prep communities.

What actually changed from SCS-C02: the old Domain 1 (Threat Detection and Incident Response) and Domain 2 (Security Logging and Monitoring) were reorganized into a cleaner Detection and Incident Response split, Domain 6 was renamed from “Management and Security Governance” to “Security Foundations and Governance,” and new task statements were added around generative AI guardrails (OWASP’s Top 10 for LLM applications), inter-resource encryption in transit, and data masking. If your prep material still references SCS-C02’s six domains at 14/18/20/16/18/14 percent, it is describing a retired exam.

Renewal math over 9 years

Security Specialty is valid for three years, so nine years covers three renewal cycles. AWS charges no annual maintenance fee, but unlike Cloud Practitioner or Solutions Architect Associate, AWS does not publish an auto-recertification path for this credential through a higher-tier exam. The only stated route is passing the latest version of this exam again.

That makes the honest nine-year figure a flat 3 times $300, or $900 total, the most expensive AWS renewal picture this site tracks, and there is no documented shortcut around it the way CompTIA’s higher-cert waiver or AWS’s own Associate-to-Professional auto-recertification works elsewhere. Budget the full $900 as a fixed cost of holding this specific specialty credential for nine years, separate from whatever other AWS certifications you accumulate alongside it.

What it does for the occupation you are entering

Security Specialty maps directly to the information security analyst occupation (BLS code 15-1212), the same BLS category every other security-focused certification on this site maps to. The panel on this page shows that occupation’s current national median wage and headcount, a picture of the field, not a premium this specific credential pays out. The Bureau of Labor Statistics projects continued strong growth in information security roles, and what this certification concretely buys you is a specialized AWS credential that hiring teams treat as evidence you can secure real production AWS environments, not just describe security concepts in the abstract. What it converts into in take-home pay depends on the role, the employer, and the years of hands-on experience the exam already assumes you have.

Common mistakes

Attempting this exam without the assumed experience. AWS is explicit that the target candidate already has years of hands-on AWS security work. Candidates who try to compress that timeline with pure study time tend to struggle with scenario questions that assume judgment you build on the job, not in a course.

Studying from outdated SCS-C02 material. With SCS-C02 retired since December 1, 2025, any prep resource still describing the old six domains at their old weights, or missing the generative-AI-guardrails and data-masking content added for SCS-C03, is teaching a different exam than the one you will sit.

Underestimating the new question formats. Ordering and matching questions are unfamiliar to candidates coming from AWS’s associate-level exams, which use only multiple-choice and multiple-response. Rehearse the interaction style with SCS-C03-specific practice material, not leftover SCS-C02 question banks.