CCSK study guide
CCSK · Work through your exam, one topic at a time.
The Certificate of Cloud Security Knowledge (CCSK) is a cloud security credential from the Cloud Security Alliance, described by CSA as the industry benchmark for cloud security expertise. CCSK v5 is aimed at IT professionals working in cloud computing, including security staff, developers, IT operations staff, audit and compliance professionals, sales and solution engineers, and product marketers. The CCSK study guide has 11 sections and about 3,316 words.
01Cloud Computing Concepts & Architectures
NIST SP 800-145 supplies the vocabulary the exam assumes. Five essential characteristics: on-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service.
321 words, about 2 min02Cloud Governance, Risk, Audit, & Compliance
Cloud governance is the set of policies, decision rights, and oversight mechanisms that keep cloud use aligned with business objectives. Practical artifacts include an enterprise cloud policy, acceptable-use rules, data classification, a service approval workflow, and defined exception handling.
332 words, about 2 min03Organization Management
Traditional separation, where a build team hands artifacts to an operations team, breaks when product teams self-provision. Expect questions on the Cloud Center of Excellence (CCoE), platform teams, cloud service owners, and federated security champions.
305 words, about 2 min04Identity & Access Management
Cover the identity lifecycle (joiner, mover, leaver, with deprovisioning as the perennial exam answer), authentication, authorization, federation and single sign-on, multi-factor authentication, privileged access management, just-in-time elevation, secrets management, and role-based versus attribute-based access control. SAML and OpenID Connect handle authentication and federation; OAuth 2.0 is a delegated authorization framework.
298 words, about 1 min05Security Monitoring
Monitoring in cloud means collecting, retaining, correlating, and alerting on both the management plane (API calls that create or change resources) and the data plane (access to data and network traffic). Representative native services: AWS CloudTrail, VPC Flow Logs, GuardDuty, and Config; Azure Activity Log, Monitor, Defender for Cloud, and NSG flow logs; Google Cloud Audit Logs, VPC Flow Logs, and Security Command Center.
273 words, about 1 min06Infrastructure & Networking
Cloud networks are software-defined. The objects to know: VPC or VNet, subnets (public versus private), route tables, internet and NAT gateways, security groups, network ACLs, load balancers, DNS, and private connectivity options such as site-to-site VPN, AWS Direct Connect, Azure ExpressRoute, Google Cloud Interconnect, and private endpoints.
287 words, about 1 min07Cloud Workload Security
Workloads include virtual machines, containers, serverless functions, and managed platform runtimes. Unifying practices: hardened minimal base images, vulnerability and patch management, immutable infrastructure where change means redeployment rather than in-place patching, scanned and signed image registries, infrastructure-as-code scanning, runtime protection, and configuration hardening against a recognized benchmark.
291 words, about 1 min08Data Security
Think in lifecycle terms: create, store, use, share, archive, destroy. Control it with classification, inventory (including unknown or shadow data stores), ownership, and handling rules.
306 words, about 2 min09Application Security
Secure development in cloud means threat modeling, secure design review, static and dynamic analysis, software composition analysis, secrets management, dependency scanning, and infrastructure-as-code scanning inside the pipeline. In cloud, the API is the application: inventory APIs, authenticate and authorize every call, validate input, rate-limit, and log.
313 words, about 2 min10Incident Response & Resilience
The incident response lifecycle is preparation, detection and analysis, containment, eradication, recovery, and post-incident activity. Cloud changes the mechanics: you cannot unplug a disk, instances may be terminated by an attacker or by an autoscaler, and scope spans accounts, regions, and provider status events.
286 words, about 1 min11Related Technologies & Strategies
The exam expects literate awareness rather than depth of adjacent topics: big data and analytics pipelines, where data gravity and residency bite; IoT, with hard device-identity problems, weak update paths, and edge processing; containers and orchestration; serverless; edge computing; machine learning, including training-data exposure and model theft; blockchain, whose immutability conflicts with erasure obligations; confidential computing; and post-quantum planning. Cloud access security brokers discover and govern shadow SaaS, operating in forward or reverse proxy mode, API mode, or log-based mode.
304 words, about 2 min