Amazon AWS SCS-C02 to SCS-C03: Security Specialty Transition

Amazon AWS SCS-C02 is no longer the current Security – Specialty blueprint. In 2026 AWS introduced SCS-C03, so candidates should not build a new study plan around the older SCS-C02 domain structure. The useful approach is to preserve the security knowledge that transfers, identify what the current exam emphasizes, and use the SCS-C03 guide as the source of truth for preparation.

What changed with Amazon AWS SCS-C03

The current SCS-C03 blueprint organizes the exam into six domains: Detection at 16%, Incident Response at 14%, Infrastructure Security at 18%, Identity and Access Management at 20%, Data Protection at 18%, and Security Foundations and Governance at 14%. That structure makes two things clear. First, identity remains central. Second, the exam expects security professionals to connect preventive controls with detection, response, governance, and evidence rather than treating each service as an isolated feature.

For a full current overview, use the SCS-C03 Security Specialty preparation roadmap rather than an SCS-C02 checklist.

Which SCS-C02 skills still transfer

Strong SCS-C02 preparation is not wasted. IAM policies, roles, federation, AWS Organizations, KMS, CloudHSM, VPC security, logging, monitoring, encryption, and incident-response thinking all remain useful. The difference is that your study plan must now map those skills to the current SCS-C03 objectives and current AWS service behavior.

Do not memorize individual service names without understanding the control they provide. When a scenario asks about identity, determine who or what needs access, how trust is established, which policy layer can allow or deny the request, and how you would verify the decision. ExamSnap’s IAM and federation guide for SCS-C03 is useful for that reasoning model.

Rebuild data-protection knowledge around keys and boundaries

Data-protection questions often become easier when you separate the data, the encryption mechanism, the key, and the identity allowed to use the key. Practice KMS key policies, IAM permissions, grants, cross-account use, rotation considerations, envelope encryption, and the distinction between AWS managed and customer managed controls. Then connect encryption to storage, databases, application secrets, backups, and data movement.

The SCS-C03 data protection and KMS guide can help turn those pieces into one model rather than a set of service facts.

Make detection and incident response evidence-driven

SCS-C03 expects candidates to reason from signals. Know what CloudTrail, CloudWatch, GuardDuty, Security Hub, Config, and service-specific logs can tell you. A good response sequence usually begins with preserving evidence and understanding scope before making a broad change that could destroy context. Practice scenarios where an access key is exposed, an unusual API pattern appears, a workload is compromised, or a configuration drifts from policy.

Ask four questions in every drill: what evidence establishes the event, how do you contain risk, what is the safest recovery action, and what control reduces recurrence? That sequence is more durable than memorizing a single incident runbook.

Infrastructure security is about traffic paths

Build diagrams. Mark VPCs, subnets, route tables, gateways, load balancers, endpoints, security groups, network ACLs, private connectivity, and inspection points. Then trace one permitted and one blocked flow. Many difficult questions are really asking whether you understand where a control operates and what information it can see.

Governance should connect accounts, policy, and evidence

Security Foundations and Governance is not administrative filler. Understand account strategy, Organizations, service control policies, delegated administration, security standards, compliance evidence, and how preventive and detective controls work across multiple accounts. Practice explaining what a central security team should own and what application teams can safely control.

How to transition an existing SCS-C02 study plan

Keep your strongest labs, but relabel every exercise against an SCS-C03 domain. Remove time spent on objectives that existed only because of the old weighting or wording. Add a current-objective gap review, then finish with mixed scenarios that cross identity, network, encryption, logging, and response.

If you have already studied SCS-C02, your advantage is context. Do not throw it away. Re-map it. If you are beginning now, skip the legacy blueprint entirely and build directly from SCS-C03. The certification still rewards deep AWS security judgment, but the current blueprint should determine where that judgment is tested.