AWS Certified Security — Specialty
Exam SCS-C03 AWS Advanced
Specialist AWS security — detection, incident response, infrastructure protection, identity, data protection, and security foundations and governance in AWS. Labs only: StationX has no SCS-C03 course yet.
35 labs · ≈ 22 h of hands-on labs
All 35 SCS-C03 hands-on labs on one page →
Free to start: the free lessons and guides for this roadmap →
Exam domains
- Detection — 16%
- Incident Response — 14%
- Infrastructure Security — 18%
- Identity and Access Management — 20%
- Data Protection — 18%
- Security Foundations and Governance — 14%
Try a free cloud security lab: Left open (~4 min) → A scripted simulation in your browser. No account needed.
The path
Start here →
Step 1 — Security services in depth
Detection, incident response, identity, network and data protection with AWS's own security tooling.
19 labs
Learn
No StationX course teaches SCS-C03 yet. The labs assume the AWS foundations taught on the AWS Solutions Architect roadmap; use AWS's free SCS-C03 exam guide for the full task list.
Practise
- Infra LabsAWS Certified Security - Specialty — 14 labs 🔒 Add StationX Infrastructure Labs — $149 / year · 3 attempts per lab in any 12 months
- Configure Secure Identities by Using AWS ServicesLevel: GuidedDuration: 30 min
- Respond to Compromised AWS ResourcesLevel: GuidedDuration: 30 min
- Use CloudWatch Alarms to Generate AlertsLevel: GuidedDuration: 30 min
- Configure Logging for an EC2 WebsiteLevel: GuidedDuration: 1 h
- Detect AWS Threats and Automate RemediationLevel: GuidedDuration: 45 min
- Configure AWS Network Security for EC2 ResourcesLevel: GuidedDuration: 30 min
- Protect AWS Network Resources by Using WAFLevel: GuidedDuration: 30 min
- Configure a Secure Custom AMILevel: GuidedDuration: 30 min
- Can You Deploy Secure AWS EC2 Resources?Level: AdvancedDuration: 1 h
- Implement AWS Credentials and Policies by Using IAMLevel: GuidedDuration: 30 min
- Secure Remote Administration for EC2 InstancesLevel: GuidedDuration: 30 min
- Implement Encryption and Manage the Lifecycle of Data at RestLevel: GuidedDuration: 30 min
- Can You Provide Secure Access to AWS Data and ResourcesLevel: AdvancedDuration: 1 h
- Can You Configure a Secure AWS EnvironmentLevel: ExpertDuration: 1 h
- Infra LabsAWS Security and Compliance SOA.4 — 5 labs 🔒 Add StationX Infrastructure Labs — $149 / year · 3 attempts per lab in any 12 months
- Configure Security for an IAM UserLevel: GuidedDuration: 30 min
- Implement an IAM PolicyLevel: GuidedDuration: 30 min
- Implement a Security Monitoring ProcessLevel: GuidedDuration: 30 min
- Implement Encryption at RestLevel: GuidedDuration: 30 min
- Implement Protection for Data and InfrastructureLevel: GuidedDuration: 30 min
Step 2 — Secure workloads
Apply it to real applications and APIs.
8 labs
Learn
No StationX course yet. The labs build and lock down an API Gateway, Lambda and DynamoDB application step by step.
Practise
- Infra LabsImplement a Secure Serverless REST API — 8 labs 🔒 Add StationX Infrastructure Labs — $149 / year · 3 attempts per lab in any 12 months
- Deploy an AWS Lambda FunctionLevel: AdvancedDuration: 45 min
- Create an Amazon DynamoDB TableLevel: AdvancedDuration: 45 min
- Access a DynamoDB Table Securely from an AWS Lambda FunctionLevel: AdvancedDuration: 45 min
- Create a Secure API Endpoint for a Lambda Function by Using Amazon API GatewayLevel: AdvancedDuration: 45 min
- Add a PUT Method to an Amazon API GatewayLevel: AdvancedDuration: 45 min
- Create a Production Deployment Environment in Amazon API GatewayLevel: AdvancedDuration: 45 min
- Secure Amazon API Gateway REST Methods by Using an Amazon Cognito User PoolLevel: AdvancedDuration: 45 min
- Can You Create a Secure Serverless REST API in AWS?Level: ExpertDuration: 1 h
Step 3 — Security foundations and governance
Governance at scale: AWS Config rules, patch compliance and automated remediation. 14% of the exam.
8 labs
Learn
No StationX course yet, and no lab covers AWS Organizations or Control Tower; these labs cover AWS Config rule evaluation and Systems Manager patching.
Practise
- Infra LabsAWS Deployment, Provisioning, and Automation SOA.3 — 8 labs 🔒 Add StationX Infrastructure Labs — $149 / year · 3 attempts per lab in any 12 months
- Provision and Maintain AWS Resources by Using CloudFormationLevel: GuidedDuration: 30 min
- Migrate a Load Balanced Application by Using a Blue/Green and Canary Deployment StrategyLevel: GuidedDuration: 30 min
- Execute Commands and Automation Documents by Using the AWS Systems Manager ServiceLevel: GuidedDuration: 30 min
- Configure Maintenance Windows by Using AWS Systems ManagerLevel: GuidedDuration: 30 min
- Configure AWS Systems Manager Patch ManagerLevel: GuidedDuration: 30 min
- Configure an Amazon EventBridge Rule That Sends an Automated Email by Using the Simple Notification ServiceLevel: GuidedDuration: 30 min
- Can You Automate Processes by Using AWS Services?Level: AdvancedDuration: 45 min
- Evaluate AWS Config RulesLevel: GuidedDuration: 30 min
Where this leads
Choose your next roadmap
Next level
AI-Driven Security Engineering
After this roadmap: direct AI to build real security solutions. “No coding background required. You direct the AI; the AI does the building.”
See the AI-Driven Security Engineering Master’s →