CCSP: Complete Cloud Security Professional Exam Prep

The CCSP is the gold standard cloud security credential, co-developed by

(ISC)2 and the Cloud Security Alliance. This course covers all six exam

domains in full, with every concept tied directly to what appears on the

Computerized Adaptive Test.

THE EXAM AND MINDSET

The CCSP uses CAT format: 125 scored questions, 4 hours, 700 out of 1000

passing score, and you cannot go back to change an answer. The most

important discipline this course teaches is vendor-neutral thinking: always

choose the CSA and NIST-aligned answer, never the AWS-specific or

Azure-specific one unless the question forces it.

DOMAIN 1 — CLOUD CONCEPTS, ARCHITECTURE AND DESIGN

You will cover the NIST SP 800-145 five essential cloud characteristics,

the three service models and how shared responsibility shifts across

IaaS, PaaS, and SaaS, the four deployment models including the critical

distinction between hybrid cloud and multi-cloud, Type 1 versus Type 2

hypervisors, container and serverless security, the three cloud storage

types, VPC networking with the stateful versus stateless distinction

between Security Groups and Network ACLs, the four disaster recovery

strategies, and Privacy by Design under GDPR Article 25.

DOMAIN 2 — CLOUD DATA SECURITY (HIGHEST WEIGHTED AT 20%)

This is the single biggest scoring domain and the one most candidates

underestimate. You will cover the CSA six-phase data lifecycle, data

classification roles including the GDPR distinction between Controller

and Processor, AES-256 and TLS 1.3 encryption standards, the full key

management hierarchy from CSP-managed keys to BYOK to HYOK, FIPS 140-2

HSM levels, envelope encryption with DEK and KEK, data masking versus

tokenization, all four CASB deployment modes, IRM persistent protection,

cryptographic erasure as the correct cloud destruction method, GDPR

including the 72-hour breach notification and Schrems II impact on

EU-US data transfers, HIPAA, PCI-DSS, and CCPA.

DOMAIN 3 — CLOUD PLATFORM AND INFRASTRUCTURE SECURITY

You will cover hypervisor threats including VM escape, Blue Pill rootkit

attacks, and Spectre and Meltdown side-channel attacks, Kubernetes security

including the critical fact that Kubernetes Secrets are only base64 encoded

and not encrypted by default, Infrastructure as Code security with static

analysis tools like Checkov and Terrascan, supply chain risk including the

SolarWinds build pipeline compromise pattern, SBOM requirements under US

Executive Order 14028, CIS Benchmarks for cloud hardening, CVSS-based

patch timelines, and the distinction between CSPM, CWPP, CIEM, and CNAPP.

DOMAIN 4 — CLOUD web application security owasp top 10 testing defense

You will cover the full Secure SDLC with DevSecOps pipeline integration,

OWASP Top 10 2021 with particular depth on A05 Misconfiguration as the

number one cloud breach cause and A10 SSRF as the path to stealing IAM

credentials from the Instance Metadata Service at 169.254.169.254, the

OWASP API Top 10 with BOLA as the most common API vulnerability, all OAuth

2.0 grant types including why the Implicit flow is deprecated and why

Authorization Code with PKCE is the correct choice for public clients,

STRIDE threat modeling with the security property each category violates,

and the distinction between SAST, DAST, IAST, and RASP.

DOMAIN 5 — CLOUD SECURITY OPERATIONS

You will cover cloud SOC design as an identity-centric and API-centric

discipline, UEBA behavioral anomaly detection for compromised credentials

and insider threats, the NIST SP 800-61 four-phase incident response cycle

adapted for cloud including the rule to always snapshot before terminating

a compromised instance, digital forensics chain of custody in multi-tenant

environments, STIX as the threat intelligence data format and TAXII as the

transport protocol, the MFA hierarchy from SMS at the weakest through TOTP

to FIDO2 hardware keys at the strongest, SOAR automation for known-pattern

response playbooks, mandatory CloudTrail alerting scenarios, threat hunting

with MITRE ATT&CK for Cloud, and MTTD and MTTR as the primary security

operations metrics.

DOMAIN 6 — LEGAL, RISK AND COMPLIANCE

You will cover cloud contract essentials including why a BAA is mandatory

for HIPAA PHI and a DPA is mandatory for GDPR processor relationships, the

NIST RMF seven steps, the FAIR quantitative risk framework with ALE

calculation, all four risk treatment options and why risk acceptance must

always be formally documented, GDPR in depth including the 72-hour

supervisory authority notification, Schrems II and Standard Contractual

Clauses as the current EU-US transfer mechanism, SOC 2 Type I versus Type

II operating effectiveness, all three CSA STAR levels, CCM v4 with 197

controls across 17 domains, FedRAMP for US federal cloud compliance, and

why SLA compliance is completely separate from security compliance.

MODULE 7 — EXAM PREPARATION AND CAT STRATEGY

The final module consolidates every domain through realistic multi-domain

scenario questions, catalogs the eleven highest-frequency exam traps

including the BYOK versus HYOK distinction, the SOC 2 Type I versus Type

II confusion, and why the OAuth Implicit flow is never correct, delivers

a consolidated numbers and timelines cheat sheet, and provides a

six-step strategy specifically designed for the CAT format where you

cannot change any answer once submitted.

This course is built for security professionals preparing for the CCSP

exam who want dense, exam-aligned content with zero filler.