AWS Security Specialty

No. It mixes single-answer multiple choice with multiple-response items where you must select two or three correct options. Format details and any changes to the item types are published in the official exam guide on the AWS Training and Certification site, so check there rather than relying on second-hand summaries.

Noticeably harder. Associate exams reward recognising the right service; this one rewards understanding how services interact under constraints. Questions commonly describe a working but non-compliant design and ask for the minimal change. Candidates with only study-guide knowledge usually find the logging and KMS scenarios the most punishing.

Retakes are permitted, and AWS applies a waiting period between attempts plus a fee for each sitting. The exact wait interval and current fee are set by AWS and change over time, so confirm them on the official certification page before you book a second attempt rather than planning around a remembered number.

Most working engineers need a few months of part-time study, but the honest variable is hands-on exposure, not hours. If you have never written a KMS key policy or debugged a VPC endpoint policy, budget extra lab time. If you already run production security tooling on AWS daily, focused review of weaker domains is often enough.

Start with identity and access management and data protection, because policy-evaluation reasoning underpins questions elsewhere. Then do logging and monitoring, which is heavily tested and feeds incident response. Infrastructure security and governance come last as they lean on the earlier material. Weight your time by the published domain percentages.

Those are operational details that AWS revises periodically. The authoritative source is the official exam guide and certification page on the AWS Training and Certification site. Treat any figure quoted in a blog, forum, or course description as possibly stale, and confirm before you schedule so you can plan your pacing correctly.

Three patterns dominate: choosing a broadly permissive fix when a scoped policy would satisfy the requirement, confusing detective controls with preventive ones, and overlooking that encrypted data still needs access controls on the key. A fourth is ignoring cross-account implications in answers that only work within a single account.

AWS certifications are valid for a defined period and then require recertification or an eligible higher-level certification. The validity period and recertification rules are published by AWS and may be revised, so verify the current policy on the official site and diarise your expiry date when you pass.

You need to read policy documents confidently, including conditions, NotAction, and resource versus identity policies, but not to reproduce syntax from memory. The skill tested is prediction: given a policy and a request, decide whether it is allowed, denied, or denied by an explicit deny that overrides everything else.