I recently passed the AWS Certified Security – Specialty certification, but this was not my first attempt.
I had taken the exam once before and did not pass. Although that was disappointing, it helped me identify my knowledge gaps and understand how the exam approaches complex security scenarios.
Instead of treating the first attempt as wasted time, I changed my study strategy, returned to my notes, and focused on how AWS security services work together.
This time, I passed—while on maternity leave and studying between feeds, naps, and everything else that comes with becoming a first-time mother.
Here is what helped me.
About the Exam
The current AWS Certified Security – Specialty exam, SCS-C03, includes 65 multiple-choice or multiple-response questions and lasts 170 minutes.
It covers six domains:
- Detection – 16%
- Incident Response – 14%
- Infrastructure Security – 18%
- Identity and Access Management – 20%
- Data Protection – 18%
- Security Foundations and Governance – 14%
You need to understand more than individual service definitions. The exam tests whether you can select the best solution for a complete security scenario.
My Background—and My Blind Spots
I work as a Cloud Infrastructure Engineer and regularly use AWS, Terraform, EC2, IAM, VPC, monitoring, and Infrastructure as Code.
However, professional experience alone was not enough.
In my daily work, I mostly use Terraform, so I underestimated how much attention I needed to give to CloudFormation and other AWS-native governance tools.
The Topics I Would Know Inside Out
Although every exam experience is different, I would pay particular attention to four areas.
Service Control Policies
Understand SCPs in depth.
An SCP defines the maximum available permissions for accounts or organizational units, but it does not grant permissions.
Study:
- SCP inheritance
- Explicit denies
- Organizational units
- Member accounts
- Central security guardrails
- How SCPs interact with IAM policies
Always distinguish between granting access and limiting the permissions available across an organization.
Permissions Boundaries
A permissions boundary defines the maximum permissions that an IAM user or role can receive. It also does not grant permissions by itself.
Remember the main difference:
- An SCP limits permissions at the account or organization level.
- A permissions boundary limits a specific IAM user or role.
Make sure you understand how permissions boundaries interact with identity-based policies, resource-based policies, session policies, and SCPs.
Amazon GuardDuty
Know GuardDuty beyond its basic definition.
Focus on:
- Multi-account management
- Delegated administrators
- AWS Organizations integration
- Finding types and severity
- GuardDuty protection plans
- Integration with Security Hub
- Automated responses through EventBridge and Lambda
- Differences between GuardDuty, Inspector, Macie, Detective, and Security Hub
GuardDuty detects suspicious activity, Inspector identifies vulnerabilities, Macie discovers sensitive data, Detective supports investigations, and Security Hub aggregates findings.
These differences should feel natural before the exam.
AWS CloudFormation
Do not ignore CloudFormation—even if you mainly work with Terraform.
I focused on:
- CloudFormation service roles
- StackSets
- Multi-account and multi-Region deployments
- CloudFormation Guard
- Drift detection
- Secure parameters
- AWS Organizations integration
- Consistent security controls through Infrastructure as Code
This was one of my biggest gaps during my first attempt.
Other Important Areas
I also reviewed:
- IAM policy evaluation and explicit denies
- Cross-account access and role assumption
- AWS KMS, key policies, and grants
- CloudTrail and centralized logging
- Security Hub, Inspector, Macie, and Detective
- Incident response and forensic evidence
- VPC security, WAF, Shield, and Network Firewall
- AWS Organizations and Control Tower
- AWS Config and automated remediation
- Secrets Manager and Parameter Store
- Encryption at rest and in transit
I organized my notes in Obsidian and created comparisons between services that could easily be confused.
The Resources I Used
I used the official exam guide to structure my preparation and studied through the QA AWS Certified Security – Specialty SCS-C03 learning path.
My preparation combined:
- The official SCS-C03 exam guide
- The QA learning path
- AWS documentation
- Obsidian notes
- Practice questions
- Knowledge from my daily AWS work
Whenever I answered a practice question incorrectly, I tried to understand why the correct answer was better and why the other options failed to satisfy the requirements.
Request the Extra 30 Minutes
If English is not your native language and you take the exam in English, request the ESL +30 MINUTES accommodation before registering.
AWS offers non-native English speakers an additional 30 minutes. You only need to request it once for eligible future AWS exams.
This is particularly useful for an exam with long, detailed scenarios.
You can request it from your AWS Certification account under Request Exam Accommodations.
My Online Exam Setup
I prefer taking AWS exams online from home because it is extremely convenient. I do not need to travel to a testing center, and I can choose an appointment that fits my schedule.
I usually book my exams in the morning. The Security Specialty exam is already 170 minutes—and can reach 200 minutes with the ESL accommodation—so I prefer to begin when I am rested and focused.
I normally take the exam in my bedroom instead of my office because my office has multiple external monitors. Pearson OnVUE allows only one active monitor, and additional monitors must be unplugged or removed.
Using my laptop in another quiet room is much easier than rearranging my entire office setup.
Before the exam, I make sure that:
- The room is private and quiet
- Nobody will enter
- The testing surface is completely clear
- Only one monitor is active
- My laptop is connected to power
- The internet, camera, and microphone work correctly
- I have completed the OnVUE system test
Remember that during an online AWS exam, you cannot leave the camera view—even for a break.
Final Advice
If I were preparing again, I would:
- Start with the official exam guide.
- Know SCPs and permissions boundaries in depth.
- Study GuardDuty until its integrations feel natural.
- Spend more time on CloudFormation.
- Practice IAM and KMS policy evaluation.
- Compare similar AWS security services.
- Request the ESL +30 accommodation.
- Schedule the exam when I am well-rested.
- Prepare my online testing space in advance.
Failing once did not define my final result. It simply showed me what I needed to improve.
My study schedule during maternity leave was not perfect. Some days I studied more, while on others I reviewed only a few Obsidian notes.
Progress was not always fast, but it was still progress.
If you do not pass on your first attempt, review your gaps, adjust your strategy, and try again.
That is what I did—and this time, I passed.
Top comments (0)