CSPM study plan

Map every objective in Domain 1 to a one-line definition and a concrete cloud example in your own words

Build a personal terminology glossary of 40 CSPM terms, marking each as known, shaky, or unknown

Sketch the shared responsibility model for one IaaS, one PaaS, and one SaaS workload and label who owns each control layer

Score yourself on 20 self-written Domain 1 recall questions and log misses in a running error journal

Diagram the CSPM workflow from asset discovery through policy evaluation to finding triage and remediation

Compare three major cloud providers' native posture and configuration tooling on five criteria you define

Write a one-page explanation of how agentless versus agent-based scanning changes coverage and detection latency

Rank the ten most common cloud misconfiguration categories by real-world breach impact and justify each ranking in two sentences

Re-test the Domain 1 and Domain 2 concepts you flagged as shaky and record whether each is now resolved

Classify 15 sample findings by severity tier using a written rubric you author

Trace two findings end to end, from detection to owner assignment to verified closure, documenting each handoff

Draft the questions you would ask a cloud team to assess whether posture controls are actually operating

Translate a control framework's intent into concrete cloud configuration checks for identity, storage, and network

Write five policy-as-code style rules in plain logic that express real guardrails and state the failure condition for each

Map ten common compliance obligations to the technical evidence that would satisfy an auditor

Identify three places where a passing configuration check can still leave a real risk and explain the gap

Describe how identity, network, data, and workload posture signals combine into a single risk score and where that model can mislead

Build a threat model for one multi-tenant cloud workload listing assets, trust boundaries, and five plausible attack paths

Explain how to prioritize remediation when hundreds of findings compete for limited engineering time

Compare how drift detection and infrastructure-as-code scanning catch different classes of posture failure

Draft a 90-day CSPM program rollout plan covering ownership, tooling, reporting cadence, and success metrics

Design three metrics that show posture improvement rather than raw finding counts, and state how each could be gamed

Write an incident-response playbook section for a posture-related exposure, from alert to containment to postmortem

Produce a one-page executive summary of posture risk written for a non-technical audience

Explain how CSPM findings integrate with SIEM, ticketing, and CI/CD pipelines, naming the data each integration needs

List the top data-quality failure modes in posture tooling and the validation step that catches each

Describe how to scope scans across accounts, subscriptions, and projects without creating blind spots or runaway cost

Audit your own study notes for gaps across all six domains and write a targeted remediation list

Complete a timed 100-question mixed-domain practice set and score it by domain

Review every missed item and write the underlying concept, not just the correct answer

Re-run your weakest-domain quizzes from weeks 1 through 7 and confirm measurable improvement

Condense all six domains into a two-page personal review sheet you can reread in 20 minutes