ISC2Certified Cloud Security Professional
The Certified Cloud Security Professional (CCSP) certification validates your advanced technical skills to design, manage, and secure data, applications, and infrastructure in the cloud. It is ideal for experienced IT and cybersecurity professionals responsible for cloud security architecture, operations, and compliance. Earning the CCSP demonstrates you can apply best practices and policies established by ISC2's global community of cybersecurity experts to protect critical assets in the cloud.
1030 practice questions · Updated 2026-07-30
6Domains
38Objectives
310Concepts
1030Questions
CCSP Curriculum
Every domain, objective, and concept the CCSP exam measures.
- Cloud computing definitions
- Cloud service customer role
- Cloud Service Provider (CSP) role
- Cloud service partner role
- Cloud service broker role
- Regulator role in cloud
- On-demand self-service
- Broad network access
- Multi-tenancy
- Rapid elasticity and scalability
- Resource pooling
- Measured service
- Virtualization as a building block
- Storage as a building block
- Networking as a building block
- Databases as a building block
- Orchestration as a building block
- Cloud computing activities
- Cloud service capabilities
- Cloud service categories
- Cloud deployment models
- Cloud shared considerations
- Impact of related technologies
- Cryptography fundamentals
- Key management in the cloud
- Identity and access management (IAM)
- Privileged access management
- Service and workload access
- Data sanitization methods
- Media lifecycle management
- Network security controls
- Traffic inspection and monitoring
- Geofencing and geographic restrictions
- Hypervisor security
- Container security
- Ephemeral computing and serverless security
- Virtualization isolation
- Common cloud threats
- Threat modeling and risk assessment
- Patching and vulnerability management
- Baselining and configuration management
- Immutable architecture
- System hardening
- Cloud Secure Data Lifecycle
- Cloud Business Continuity and Disaster Recovery Planning
- Business Impact Analysis (BIA)
- Functional Security Requirements: Portability, Interoperability, Vendor Lock-in
- Security Responsibilities in SaaS, IaaS, and PaaS
- Cloud Design Patterns: SANS Security Principles
- Cloud Design Patterns: Well-Architected Framework
- Cloud Design Patterns: CSA Enterprise Architecture
- Secure by Design Principles
- DevOps Security (DevSecOps)
- Verification against criteria
- Criteria development
- Verification methods
- System and subsystem product certifications
- Common Criteria (CC)
- FIPS 140-2
- Other relevant certifications
- Interpreting certification results
- AI/ML in Cloud Threat Detection
- Threat Analysis with AI/ML
- Data Source Validation for AI/ML
- Verification of AI/ML Inputs
- SOAR Fundamentals
- Integrating AI/ML with SOAR
- Ethical AI/ML Use in Security
- Regulatory Compliance for AI/ML
- Cloud data life cycle phases
- Data dispersion
- Data flows
- Storage types
- Threats to storage types
- Encryption fundamentals
- Key management lifecycle
- Hashing for data integrity
- Hashing for non-repudiation
- Data masking
- Data anonymization
- Tokenization basics
- Tokenization implementation
- Data loss prevention (DLP) strategies
- DLP technologies and integration
- Secrets management
- Certificate management
- Structured data discovery
- Unstructured data discovery
- Semi-structured data discovery
- Data location mapping
- Data classification policies
- Classification levels and criteria
- Data mapping
- Data mapping techniques
- Data labeling
- Data tagging
- Labeling and tagging implementation
- IRM objectives
- Data rights and permissions
- Provisioning of IRM policies
- Access models in IRM
- IRM certificate issuance
- IRM certificate revocation
- Integration with identity and key management
- IRM tools and technologies
- Data retention policies
- Data deletion procedures and mechanisms
- Data archiving procedures and mechanisms
- Legal hold
- Event source identification
- Event attribute definition
- Logging mechanisms
- Log storage and retention
- Log analysis techniques
- Chain of custody principles
- Non-repudiation mechanisms
- Data set privacy
- Model privacy
- Data set security
- Model security
- Physical environment
- Network and communications
- Compute
- Virtualization
- Storage
- Management plane
- Tenant Partitioning
- Access Control in Logical Design
- Data Center Location Selection
- Build vs. Buy Decision
- HVAC Systems
- Multi-Vendor Pathway Connectivity
- Resilient Power Design
- Resilient HVAC Design
- Resilient Connectivity Design
- Risk identification
- Risk analysis
- Cloud vulnerabilities
- Cloud threats and attacks
- Risk treatment strategies
- Physical and environmental protection controls
- System protection controls
- Storage protection controls
- Communication protection controls
- Identification and authentication in cloud
- Authorization and access control in cloud
- Audit mechanisms and log collection
- Log correlation and analysis
- Packet capture and network monitoring
- BC/DR strategy definition
- BC/DR strategy selection
- RTO and RPO determination
- Recovery service level definition
- BC/DR plan creation
- BC/DR plan implementation
- BC/DR plan testing
- BC/DR plan maintenance
- Cloud Development Basics
- Common Pitfalls in Cloud Application Development
- OWASP Top 10
- OWASP Application Security Verification Standard (ASVS)
- OWASP Top 10 API Security Risks
- OWASP Top 10 for Large Language Model Applications
- SANS Top 25
- Applying Security Frameworks to Cloud Applications
- Business requirements in SDLC
- SDLC phases
- SDLC methodologies
- Secure SDLC integration
- Cloud-specific risks in SDLC
- Threat modeling methodologies
- Avoiding common vulnerabilities
- Secure coding standards and frameworks
- Software configuration management and versioning
- Functional testing
- Non-functional testing
- CI/CD integration in testing
- Blackbox testing
- Whitebox testing
- SAST (Static Application Security Testing)
- DAST (Dynamic Application Security Testing)
- IAST (Interactive Application Security Testing)
- SCA (Software Composition Analysis)
- Quality assurance (QA) in cloud applications
- Abuse case testing
- API Security Fundamentals
- API Lifecycle Security
- API Threat Modeling
- Supply Chain Risk Assessment
- Software Integrity and Authenticity
- Software Licensing Compliance
- Third-Party Software Lifecycle Management
- Third-Party Component Vulnerability Management
- Open Source Software Validation
- Open Source Governance and Policy
- Web Application Firewall (WAF)
- Database Activity Monitoring (DAM)
- XML Firewalls
- API Gateway
- Load Balancer
- Cryptography Fundamentals
- Key Management
- Sandboxing
- Microservices Architecture
- Containers and Docker
- Kubernetes Orchestration
- Application Virtualization
- Orchestration Security
- Federated Identity
- Identity Providers (IdP)
- Single Sign-On (SSO)
- Multi-Factor Authentication (MFA)
- Cloud Access Security Broker (CASB)
- Secrets Management
- Key Management
- Certificate Management
- Hardware Security Module (HSM) configuration
- Trusted Platform Module (TPM) configuration
- Secure by default principles
- Management plane tools installation and configuration
- Virtual network security configuration
- Virtual storage security configuration
- Virtual memory security configuration
- Virtual CPU security configuration
- Hypervisor type 1 and 2 security configuration
- Guest OS virtualization toolsets installation
- Access Controls for Local and Remote Access
- Secure Network Configuration
- Network Security Controls
- OS Hardening Baselines
- Patch Management
- Cluster Availability
- Guest OS Availability
- Performance and Capacity Monitoring
- Hardware Monitoring
- Backup and Restore Configuration
- Management Plane Operations
- Forensic data collection methodologies
- Evidence management
- Collecting digital evidence
- Acquiring digital evidence
- Preserving digital evidence
- Vendor communication management
- Customer communication management
- Partner communication management
- Regulator communication management
- Stakeholder communication management
- Security Operations Center (SOC) Fundamentals
- Security Control Monitoring
- Log Management and Analysis
- SIEM and Threat Intelligence
- Incident Response Process
- Vulnerability Assessment
- Penetration Testing
- Conflicting international legislation
- Legal risks specific to cloud computing
- Legal frameworks and guidelines
- eDiscovery standards and practices
- Cloud forensics requirements
- Contractual vs. regulated private data
- Key data privacy regulations
- Jurisdictional differences in data privacy
- Standard privacy frameworks
- Privacy Impact Assessment (PIA) process
- Internal and External Audit Controls
- Impact of Audit Requirements on Cloud
- Assurance Challenges of Virtualization and Cloud
- Types of Audit Reports (SSAE, SOC, ISAE)
- Restrictions of Audit Scope Statements
- Gap Analysis in Cloud Audits
- Audit Planning for Cloud
- Internal Information Security Management System (ISMS)
- Internal Information Security Controls System
- Policies (Organizational, Functional, Cloud Computing)
- Identification and Involvement of Relevant Stakeholders
- Specialized Compliance for Highly-Regulated Industries
- Impact of Distributed IT Model on Audits
- Provider Risk Management Program Assessment
- Data Roles in Cloud
- Regulatory Transparency Requirements
- Risk Treatment Options
- Risk Frameworks
- Risk Management Metrics
- Risk Environment Assessment
- Business Requirements in Cloud Contracts
- Vendor Assessments
- Vendor Lock-in Risks
- Vendor Viability and Escrow
- Right to Audit
- Contract Metrics and Definitions
- Termination and Litigation
- Assurance and Compliance in Contracts
- Access to Cloud and Data
- Cyber Risk Insurance
- Data Ownership and Security Requirements
- Supply-Chain Management in Cloud
Ready to practice?Test your knowledge with exam-style questions or take an intelligent quiz tailored to your level.
Percentages reflect share of the current practice bank, not official exam weightings — no structured per-skill weight is published for CCSP, so none is invented.