CCAS study guide
CCAS · Work through your exam, one topic at a time.
The Certified Cloud Application Security (CCAS) credential targets security engineers, cloud architects, application security analysts, and DevSecOps practitioners who are responsible for protecting workloads that run on public cloud platforms rather than on-premises data centres. It tests whether you can reason about security across the whole application lifecycle: how a cloud-native design is threat-modelled, how identities and secrets are handled, how code moves through a pipeline, how data is encrypted and keys are governed, how APIs are exposed and defended, and how runtime activity is logged and investigated when something goes wrong. The CCAS study guide has 9 sections and about 3,522 words.
01Cloud Application Architecture and Design Security
Cloud application architecture and design security tests whether you can build a system whose security properties survive elastic scaling, multi-tenancy, and provider-managed infrastructure. The exam focuses on where trust boundaries fall, how data crosses them, and which controls belong to the provider versus the customer.
420 words, about 2 min02Identity, Authentication, and Access Management for Cloud Applications
This domain tests whether you can separate authentication from authorization and design least-privilege access for three populations: workforce users, workloads, and customers. Most exam items hinge on choosing short-lived, federated credentials over static secrets and on scoping policy to specific resources rather than whole accounts.
412 words, about 2 min03Cloud Application Security Standards, Frameworks, and Governance
This domain asks how you prove and continuously maintain control, not merely which certificate you hold. Items test framework mapping, the limits of third-party attestations, and how written policy becomes enforceable guardrails in a cloud estate.
415 words, about 2 min04Secure Software Development Lifecycle and DevSecOps in the Cloud
This domain tests how security activities attach to each delivery phase and how the pipeline itself becomes an attack surface. Items typically ask you to place a control in the right phase or to decide whether a gate should block a build.
397 words, about 2 min05Cloud Data Protection, Encryption, and Key Management
This domain tests whether you can pick the right protection for a given data state and tenancy model, and whether you understand the key hierarchy well enough to explain what rotation does and does not do. Controls, retention, and residency follow from classification and contractual obligation, not from the storage service chosen.
397 words, about 2 min06API Security and Application Integration Security
API and integration security concentrates on the interfaces between components: how callers are authenticated, how individual objects are authorized, and how gateways, queues, and webhooks are hardened. Items often present a valid token and ask why access still succeeded.
389 words, about 2 min07Cloud Application Security Testing and Vulnerability Management
This domain tests prioritization and coverage: scanners produce findings, not risk. Expect items that give you two findings and ask which to fix first, or that probe what a given tool class can and cannot see.
364 words, about 2 min08Cloud Application Logging, Monitoring, and Incident Response
This domain tests whether you can detect an event, reconstruct it, and contain it without destroying the evidence. Items commonly present an active compromise and ask for the first action.
359 words, about 2 min09Cloud Application Deployment, Runtime, and Container Security
This domain covers the layer between code and infrastructure: images, orchestrators, serverless functions, and the runtime controls that must hold after deployment. Items often show an insecure workload manifest and ask which control removes the greatest risk.
369 words, about 2 min