Failed SCP-C02 Again. This Exam Reads Like a Monty Python Skit.

If you've failed the AWS Certified Security – Specialty exam twice, you don't need another 'study harder.' You need someone to admit that **SCP-C02**—the code people keep searching for—reads like an absurdist comedy sketch.

The official exam code is **SCS-C02**, not SCP-C02. But after enough attempts, the letters start moving. That is fitting, because a huge portion of the exam is about **service control policies (SCPs)**, IAM policy evaluation order, and cross-account permission chains. It's not a trivia test. It's a puzzle about AWS authorization.

The exam has a Bridge of Death problem

Monty Python's Bridge of Death asks you three questions. The Security Specialty asks about five services, two policies, and one logging condition. If you pick the wrong evaluation order, you're cast into the gorge of retake.

The questions aren't impossible. They're too plausible. A typical prompt looks like this:

An SCP allows `s3:GetObject`.

A bucket policy allows access from `aws:PrincipalOrgID`.

An IAM policy explicitly denies `s3:GetObject`.

The question asks whether the principal can read the object.

According to the [AWS IAM policy evaluation logic](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_evaluation-logic.html), the explicit deny wins. The principal cannot read the object. That is the whole exam. Once you internalize the flow—SCP limits the account, permissions boundaries limit the principal, session policies limit the session, resource and identity policies grant—the strange wording starts to make sense.

Nobody expects the SCP evaluation order

SCP-C02 is not the official code, but SCPs are still a central character. [Service control policies](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html) attach to AWS Organizations accounts or OUs. They do not grant access. They set the maximum available permissions.

Think of an SCP as a ceiling, not a keycard. If an SCP allows `s3:GetObject`, you still need an IAM or bucket policy allow. If an SCP denies `s3:GetObject`, no bucket policy or IAM policy can override it. If the SCP is silent or lacks an allow, the request is denied from that account boundary.

The absurdly practical study plan

1. Draw the evaluation chain

Write it down like a code path:

Is there an explicit deny anywhere? Denied.

Is there an SCP boundary that doesn't allow the action? Denied.

Is there a permissions boundary that doesn't allow the action? Denied.

Does the identity policy and the resource policy both allow? If yes, allowed for cross-account access.

If the question asks about cross-account access, the resource policy and identity policy must both allow, unless an explicit deny says otherwise.

2. Learn the logging matrix

The exam loves to ask which signal answers which question. Build this table:

| Signal | What it tells you |

| CloudTrail | Who called which API, from where |

| VPC Flow Logs | Which IPs talked to which IPs, on which ports |

| GuardDuty | What looks like reconnaissance, malware, or unusual behavior |

| Security Hub | Which findings map to which standard and account |

Use [CloudTrail](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-user-guide.html) for API activity, [VPC Flow Logs](https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html) for network metadata, and [GuardDuty](https://docs.aws.amazon.com/guardduty/latest/ug/what-is-guardduty.html) for threat detection.

3. Build the smallest possible lab

Don't read 500 pages. Use two AWS accounts. Set up Organizations. Attach an SCP that denies `s3:*`. Create an IAM role with an S3 allow policy. Try the request. You will see the explicit deny in the error message, and the exam's surreal logic will start to feel like a spec.

You can also test a role with the [IAM policy simulator](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_testing-policies.html):

aws iam simulate-principal-policy --policy-source-arn arn:aws:iam::123456789012:role/lab-role --action-names s3:GetObject

4. Read the exam guide like a parser

The [AWS Certified Security – Specialty Exam Guide](https://aws.amazon.com/certification/certified-security-specialty/) lists the domains. The weird questions are usually a test of identity and access management, data protection, or logging and monitoring. If a question feels like a Monty Python sketch, parse it by asking: What is the deny boundary? What is the log source? What is the account relationship?

The punchline is the evaluation order

SCP-C02 is not trying to humiliate you. It is testing whether you understand how AWS authorization evaluates a request. If you treat the exam as a system design problem with security constraints instead of a memorization contest, it stops feeling like Monty Python and starts feeling like an AWS spec.

At Sapior, we build scenario-based practice exams and labs around these exact evaluation-order failure modes. We care less about acronym trivia and more about why the request was denied.