CCSP Exam Preparation Course: Master Cloud Security with Confidence

The Certified Cloud Security Professional (CCSP) credential is the gold standard for cloud security professionals, co-developed by (ISC)2 and the Cloud Security Alliance. Our comprehensive course covers all six exam domains in full, with every concept tied directly to what appears on the Computerized Adaptive Test (CAT).

The Exam and Mindset

The CCSP exam uses the CAT format, consisting of 125 scored questions, 4 hours, and a passing score of 700 out of 1000. The most important discipline this course teaches is vendor-neutral thinking: always choose the CSA and NIST-aligned answer, never the AWS-specific or Azure-specific one unless the question forces it.

Domain 1: Cloud Concepts, Architecture, and Design

• Cover the NIST SP 800-145 five essential cloud characteristics
• Explain the three service models and how shared responsibility shifts across IaaS, PaaS, and SaaS
• Discuss the four deployment models, including the critical distinction between hybrid cloud and multi-cloud
• Explore Type 1 versus Type 2 hypervisors, container and serverless security, and the three cloud storage types
• Learn about VPC networking with the stateful versus stateless distinction between Security Groups and Network ACLs
• Examine the four disaster recovery strategies and Privacy by Design under GDPR Article 25

Domain 2: Cloud Data Security (Highest Weighted at 20%)

• Cover the CSA six-phase data lifecycle and data classification roles, including the GDPR distinction between Controller and Processor
• Explain AES-256 and TLS 1.3 encryption standards, the full key management hierarchy from CSP-managed keys to BYOK to HYOK
• Discuss FIPS 140-2 HSM levels, envelope encryption with DEK and KEK, data masking versus tokenization, and all four CASB deployment modes
• Examine IRM persistent protection, cryptographic erasure as the correct cloud destruction method, GDPR, including the 72-hour breach notification and Schrems II impact on EU-US data transfers, HIPAA, PCI-DSS, and CCPA

Domain 3: Cloud Platform and Infrastructure Security

• Cover hypervisor threats, including VM escape, Blue Pill rootkit attacks, and Spectre and Meltdown side-channel attacks
• Explain Kubernetes security, including the critical fact that Kubernetes Secrets are only base64 encoded and not encrypted by default
• Discuss Infrastructure as Code security with static analysis tools like Checkov and Terrascan, supply chain risk, and SBOM requirements under US Executive Order 14028
• Examine CIS Benchmarks for cloud hardening, CVSS-based patch timelines, and the distinction between CSPM, CWPP, CIEM, and CNAPP

Domain 4: Cloud Application Security

• Cover the full Secure SDLC with DevSecOps pipeline integration
• Explain OWASP Top 10 2021, with particular depth on A05 Misconfiguration as the number one cloud breach cause and A10 SSRF as the path to stealing IAM credentials from the Instance Metadata Service at 169.254.169.254
• Discuss OWASP API Top 10, with BOLA as the most common API vulnerability, all OAuth 2.0 grant types, including why the Implicit flow is deprecated and why Authorization Code with PKCE is the correct choice for public clients
• Examine STRIDE threat modeling with the security property each category violates and the distinction between SAST, DAST, IAST, and RASP

Domain 5: Cloud Security Operations

<