All certifications
SCS-C02 to SCS-C03
Security Specialty restructures detection and incident response
The first two domains of the old guide were restructured into Detection and Incident Response, the Identity and Access Management domain grew, and the last domain was renamed.
Older version
SCS-C02
Retired
Newer version
SCS-C03
Dates
- SCS-C02 was in use until 1 Dec 2025
- SCS-C03 has been in use since 2 Dec 2025
Domain weights
| SCS-C02 domains | % |
|---|---|
| Domain 1: Threat Detection and Incident Response | 14 |
| Domain 2: Security Logging and Monitoring | 18 |
| Domain 3: Infrastructure Security | 20 |
| Domain 4: Identity and Access Management | 16 |
| Domain 5: Data Protection | 18 |
| Domain 6: Management and Security Governance | 14 |
| Total | 100 |
| SCS-C03 domains | % |
|---|---|
| Domain 1: Detection | 16 |
| Domain 2: Incident Response | 14 |
| Domain 3: Infrastructure Security | 18 |
| Domain 4: Identity and Access Management | 20 |
| Domain 5: Data Protection | 18 |
| Domain 6: Security Foundations and Governance | 14 |
| Total | 100 |
New
- 2.2.3: validate findings from AWS security services to assess the scope and impact of an event.
- 3.1.4: integrations with AWS edge services and third-party services, for example ingesting data in OCSF format and third-party WAF rules.
- 3.2.7: protections and guardrails for generative AI applications, for example the GenAI OWASP Top 10 for LLM Applications.
- 5.1.3: inter-resource encryption in transit, for example inter-node encryption for Amazon EMR, Amazon EKS and SageMaker AI, and Nitro encryption.
- 5.3.3: the differences between imported key material and AWS-generated key material.
- 5.3.4: masking sensitive data, for example CloudWatch Logs data protection policies and SNS message data protection.
- 5.3.5: creating and managing keys and certificates across one or more Regions, for example customer managed KMS keys and AWS Private CA.
Removed
- AWS Security Finding Format (ASFF).
- The AWS Security Incident Response Guide.
- Log format and components, for example CloudTrail logs.
- Host-based security, for example firewalls and hardening.
- Analyzing reachability with VPC Reachability Analyzer and Amazon Inspector, and fundamental TCP/IP networking concepts.
- The components and impact of a policy (Principal, Action, Resource, Condition).
- TLS concepts, and designing cross-Region networking with private and public VIFs.
- Configuring S3 static website hosting.
- Identifying security gaps through architectural reviews and cost analysis.
Changed
- Domains 1 and 2 of SCS-C02 (Threat Detection and Incident Response, Security Logging and Monitoring) are now Detection and Incident Response.
- Domain 6 was renamed from Management and Security Governance to Security Foundations and Governance.
- Weights changed for the first four domains: 14/18/20/16 became 16/14/18/20.
- Many task statements were recategorized. For example, old Task 1.1 maps to four C03 tasks (1.1, 1.2, 2.1 and 2.2).
Exam format
- SCS-C03: 50 scored questions and 15 unscored questions.
- SCS-C03: multiple choice, multiple response, ordering and matching questions.
- SCS-C03: scaled score of 100 to 1,000, minimum passing score 750.
- The SCS-C03 guide does not state the exam duration.
Sources
- SCS-C03 exam guide(opens in a new tab)
- Appendix: Comparison of SCS-C02 and SCS-C03(opens in a new tab)
This is a summary of the pages above. Check the official exam guide before you book an exam.