CCAS study plan

Explain how shared responsibility is divided between provider and customer across IaaS, PaaS, and serverless, and state which controls remain yours in each model.

Map a multi-tier cloud application into trust boundaries (public edge, app tier, data tier, management plane) and identify where authentication, authorization, and encryption must sit at each boundary.

Compare architecture patterns for isolating tenants (silo, pool, bridge) and justify a choice for a given regulatory and blast-radius constraint.

Identify common design-time failure modes such as implicit trust between internal services, over-broad egress, and secrets embedded in build artifacts, and describe the compensating control for each.

Distinguish authentication from authorization and select appropriate flows (authorization code with PKCE, client credentials, device code) for browser, service-to-service, and constrained-client scenarios.

Design a role and attribute model that enforces least privilege, including separation of duties and break-glass access with logging.

Describe token lifecycle controls: short-lived access tokens, refresh rotation, audience restriction, and revocation strategy for compromised sessions.

Explain federation and identity provider trust, including how claims are mapped to roles and how to prevent privilege escalation through claim injection.

Embed security gates into a CI/CD pipeline at commit, build, and pre-deploy stages, and state which gate should block versus warn.

Implement secrets management in pipelines so no credential is stored in source, build logs, or container images.

Apply threat modeling at design review using a structured method, producing mitigations that map to backlog items.

Define infrastructure-as-code review practices that catch public storage, permissive security groups, and unencrypted volumes before deployment.

Map the exam's control areas to a recognized framework structure and explain how governance artifacts (policy, standard, procedure) differ in enforceability.

Write a cloud security policy statement that is testable rather than aspirational, including exception and risk-acceptance workflow.

Describe how to collect evidence for an audit and how continuous compliance monitoring differs from point-in-time assessment.

Explain how to translate a regulatory obligation into a technical control and a metric that proves the control operates.

Select encryption approaches for data at rest, in transit, and in use, and justify envelope encryption with a key hierarchy for multi-tenant data.

Differentiate customer-managed from provider-managed keys and describe the operational duties that come with holding key custody.

Design key rotation, separation of duties for key administration, and a crypto-shredding approach for data deletion obligations.

Identify where sensitive data classification drives masking, tokenization, or field-level encryption decisions.

Harden API exposure by applying authentication on every route, schema validation, rate limiting, and object-level authorization checks that prevent broken access control.

Explain how to inventory and classify APIs, including shadow and deprecated endpoints, and set a deprecation policy.

Build a vulnerability management workflow from scan to triage to remediation SLA, including severity scoring and false-positive handling.

Design a testing program that combines SAST, dependency scanning, DAST, and manual testing for business-logic flaws that scanners miss.

Specify which events must be logged across application, identity, and control plane, and the fields needed for investigation.

Design log protection so records are tamper-evident, retained per obligation, and access-controlled with their own audit trail.

Write detection rules for high-value scenarios such as credential stuffing, privilege escalation, and anomalous data egress, and state expected false-positive rates.

Draft an incident response sequence for a cloud application breach, including containment that preserves forensic evidence and notification triggers.

Harden container images and runtime: minimal base images, non-root execution, read-only filesystems, image signing, and admission control that rejects non-compliant workloads.

Separate build-time from runtime credentials and explain how workload identity removes long-lived secrets from containers.

Run a timed mixed-topic review across all nine domains and convert every missed item into a written correction note.

Re-verify weak areas from weeks 1 through 7 by restating the underlying principle, not memorizing the answer.