CCSP Exam Mindset Rules
Target audience: Cloud engineers, DevSecOps architects, and security practitioners securing AWS, Azure, GCP, and SaaS environments.
- Shared responsibility depends on IaaS vs. PaaS vs. SaaS, but accountability never leaves the customer: You can transfer operational tasks to a Cloud Service Provider (CSP) via contract, but you can never transfer regulatory or legal accountability for customer data.
- Use crypto-shredding and customer-managed keys (BYOK/HYOK) for multi-tenant cloud media: Because you cannot physically shred or degauss a multi-tenant cloud SSD in AWS/Azure, cryptographic erasure (destroying the encryption key stored in a dedicated HSM/KMS) is the primary sanitization method.
- Enforce identity and API boundaries over perimeter assumptions: In cloud-native architectures, IAM roles, short-lived workload tokens (OIDC), and object-level API checks replace traditional flat network perimeters.
DOMAIN 1 · 17% OF EXAM
Domain 1: Cloud Concepts, Architecture, and Design
Cloud reference architecture, IaaS/PaaS/SaaS shared responsibility, multi-tenancy isolation, and secure design principles.
Drill Domain 1 practice questions ↗
Objectives & Mapped Field Lessons
Objective 1.1: Understand cloud service/deployment models and the Shared Responsibility Matrix
Domain 1 Rapid-Review Cheat Sheet
DOMAIN 2 · 20% OF EXAM
Domain 2: Cloud Data Security
Cloud data lifecycle, storage architectures, encryption key management (BYOK, HYOK, KMS, HSM), data discovery/classification, DLP, and cryptographic erasure.
Drill Domain 2 practice questions ↗
Objectives & Mapped Field Lessons
Objective 2.1: Secure data across the cloud lifecycle and apply NIST SP 800-88 cryptographic erasure
- Data lifecycle, classification, and governance roles (D2a · 10 min)
- Data remanence, retention, and NIST SP 800-88 sanitization (D2b · 10 min)
- Symmetric and asymmetric cryptography: ciphers, modes, and hybrid envelopes (AR3 · 11 min)
- Hashing, HMAC, digital signatures, and PKI lifecycle (AR4 · 11 min)
Domain 2 Rapid-Review Cheat Sheet
DOMAIN 3 · 17% OF EXAM
Domain 3: Cloud Platform and Infrastructure Security
Virtualization hypervisors, containers, network microsegmentation, SDN, ZTNA/SASE, and cloud disaster recovery / business continuity.
Drill Domain 3 practice questions ↗
Objectives & Mapped Field Lessons
Objective 3.1: Assess virtualization/container isolation, cloud network controls, and cloud DR/BCP
- Secure hardware, TCB, OS rings, and virtualization (AR2 · 11 min)
- Network segmentation, firewall generations, SASE, and NAC (N2 · 10 min)
- IPsec VPNs (AH vs ESP), WPA3 wireless, and converged networks (N3 · 11 min)
- Continuity operations: recovery sites, backup strategies, RAID, and DR testing (S6 · 14 min)
- Quantitative risk and BIA math: SLE, ALE, RTO, and RPO (R6 · 11 min)
Domain 3 Rapid-Review Cheat Sheet
DOMAIN 4 · 17% OF EXAM
Domain 4: Cloud Application Security
Secure SDLC in the cloud, API security, threat modeling, supply chain / SBOM, SAST/DAST/IAST, and federated identity (OAuth 2.0, OIDC, SAML).
Drill Domain 4 practice questions ↗
Objectives & Mapped Field Lessons
Objective 4.1: Secure cloud APIs, federated tokens, CI/CD pipelines, and AI/agent integrations
- Application trust boundaries: why the client UI is never a security gate (F5b · 9 min)
- Threat modeling a service: data flows, trust boundaries, and STRIDE (A1 · 9 min)
- Who holds the ticket: OAuth 2.0 roles and bearer token verification (IF1 · 10 min)
- OAuth 2.0 Authorization Code + PKCE: front channel vs back channel (IF1a · 8 min)
- OIDC and SAML assertions: signed identity claims are not admin permission (IF2 · 11 min)
- Federation failure modes: five ways SSO and token trust break (IF3 · 11 min)
- CI/CD trust boundaries: writing code vs promoting to production (A3 · 9 min)
- SBOM evidence and priority: binding inventory to the running build (A4 · 7 min)
- Excessive agency: why a model sentence is never an authorization decision (G2 · 10 min)
Domain 4 Rapid-Review Cheat Sheet
DOMAIN 5 · 16% OF EXAM
Domain 5: Cloud Security Operations
Cloud telemetry, SIEM/SOAR, vulnerability prioritization, incident response, forensics in the cloud, and continuous monitoring.
Drill Domain 5 practice questions ↗
Objectives & Mapped Field Lessons
Objective 5.1: Operate cloud detection, incident triage, forensic snapshots, and verified response
- Logs, alerts, and evidence: why an alert title is a hypothesis, not proof (F7 · 8 min)
- Identity alert triage: reconstructing who, what, and how across logs (S1 · 11 min)
- Investigate, respond, and verify: why HTTP 200 or 504 is not containment proof (S3 · 10 min)
- Vulnerability prioritization: combining CVSS, KEV, EPSS, and asset exposure (S2 · 9 min)
- Digital forensics: order of volatility, chain of custody, and legal evidence (S5 · 10 min)
- Agentic SOC architecture: autonomous triage vs human-gated containment (S4 · 10 min)
Domain 5 Rapid-Review Cheat Sheet
DOMAIN 6 · 13% OF EXAM
Domain 6: Legal, Risk, and Compliance
Cross-border data transfers, GDPR/HIPAA/FedRAMP, eDiscovery in the cloud, SOC 1/2/3 and ISO 27001/27017/27018 audits, and contract SLAs.
Drill Domain 6 practice questions ↗
Objectives & Mapped Field Lessons
Objective 6.1: Navigate cloud audit reports (SOC 2, FedRAMP, ISO 27001), privacy laws, and legal holds
- Security audits, SOC 1 / 2 / 3 reports, and Type 1 vs Type 2 evidence (AT1 · 10 min)
- Law, ethics, and personnel security (R4 · 10 min)
- Privacy vs security: why an encrypted database can still violate privacy (P1 · 10 min)
- Write the risk sentence: cause, asset, and business impact (R1 · 9 min)
- Choose the control and its evidence: policies do not execute themselves (R2 · 10 min)
- Governance as an operating cadence: NIST CSF 2.0 Govern in practice (R3 · 11 min)