AWS CSS
Amazon Web Services Certified Security - Specialty
The AWS Security Specialty is AWS's most demanding security certification and requires solid practical experience with AWS workloads. It covers a broad spectrum: from IAM and data encryption to incident response, logging, and compliance. The practical relevance is high; pure textbook candidates typically fail. The certification has high market value potential, as it is regarded as proof of quality for security architects in cloud environments. Important: Version SCS-C02 was superseded in December 2025; SCS-C03 is now current.
› Quality score
Four-axis SecProve rubric, each 0–10. SecProve editorial assessment — each axis carries a written justification so you can push back on any single call without dismissing the whole score.
› Exam format
65 questions (multiple-choice + multiple-response), 170 minutes. Proctored via Pearson VUE / PSI. Passing score: 750/1000.
14-day wait between attempts. AWS occasionally provides 50% retake vouchers after a fail.
› Recertification
Valid for 3 years. Renewal via re-exam or higher-level AWS cert.
› NICE Framework work roles
The NIST NICE work-role IDs this cert maps to. NICCS lookup.
› Core domains covered
The 2 domains this cert is centrally about. Passing the exam demonstrates working knowledge of each.
AWS/Azure/GCP security controls, IAM policies, CSPM, container security, shared responsibility model.
Reference architectures, control frameworks (NIST SP 800-53, CIS Controls), secure-by-design patterns, threat modeling, trust-boundary design, technology standards.
› Prerequisites
No formal prerequisites. Recommended: 5 years IT security experience + 2 years AWS security experience.
› Progression
requiredrecommendedWhere this cert fits in the typical learning path. Required edges are vendor-gated; recommended edges reflect de facto industry progression.
No vendor-gated prereqs.
No certs require this one.
No follow-on certs reference this one yet.
› Study materials
Curated starting points. Not exhaustive — vet each against your learning style and the current exam version.
- AWS Certified Security – Specialty Official Study Guide (2nd Ed.) — Wiley/AWS
- AWS Skill Builder — Exam Prep Path
- AWS Skill Builder (official)
- Stephane Maarek (Udemy)
- Adrian Cantrill
- Tutorials Dojo Practice Exams
- Stephane Maarek Practice Exams (Udemy)
› Version & lifecycle
SCS-C01 retired 2023-09. Domains: Threat Detection, Logging/Monitoring, Infrastructure, IAM, Data Protection.
› Salary signal
Cloud security engineer (AWS-focused), US, 3–5 years.
Robert Half Salary Guide + Glassdoor 'Cloud Security Engineer' aggregations · 2024 · US base only · p25–p75 range
› How it compares
› Common exam traps to study
Cybersecurity cert exams reuse the same 25 distractor patterns over and over — category confusion, RTO vs RPO, IDS vs IPS, MD5 vs SHA-256, and more. Once you can name the trap, you stop falling for it. Each archetype page covers what it is, the specific pairs candidates confuse, and how to avoid it.
See this cert’s domains highlighted on the interactive map, or compare it against the rest of the catalog.