CCSK study plan

Diagram the three service models and mark precisely where the customer's security responsibility ends in each.

Compare the major deployment models and list which governance and operational controls migrate to the provider in each case.

Distinguish shared responsibility from shared fate and apply the distinction to compute, storage, network, identity, and data.

Assess how multitenancy, resource pooling, and elasticity change isolation boundaries and what compensating controls each demands.

Outline the CSA security guidance domain structure and map the twelve exam domains onto it in your own words.

Draft a cloud governance charter that assigns decision rights for procurement, data classification, and provider onboarding.

Build a risk register containing ten cloud-specific risks, each scored for likelihood and impact with a stated treatment decision.

Map control framework domains to a sample audit scope and separate inherited controls from controls the customer must evidence.

Differentiate assurance types by stating exactly what each proves and what it does not: independent attestation report, certification audit, and self-attestation questionnaire.

Explain how to negotiate audit rights, regulator access, and evidence substitution in a cloud service agreement.

Define a cloud security organizational structure that separates policy ownership, platform ownership, and workload ownership.

Write role charters for three roles and identify the overlap and gap between them.

Distinguish authentication, authorization, and federation, and state the enforcement point for each.

Design a least-privilege role plus an attribute-based policy for a multi-tenant workload, describing conditions and boundaries.

Compare federation protocols and contrast the risk profile of long-lived API keys against short-lived brokered tokens.

Enumerate the log sources required for cloud detection across control plane, data plane, identity, network, and SaaS audit trails, and set a retention decision for each.

Design a detection pipeline from collection through normalization, correlation, alerting, and ticketing.

Specify five high-value alerts with thresholds, data sources, and the response each must trigger.

Separate what the provider supplies from what the customer must build for monitoring in each service model.

Design segmented cloud networking with subnets, stateful versus stateless filtering, and controlled egress.

Select between hub-and-spoke and flat topologies for a stated constraint set and justify the choice.

Harden a workload image through baseline definition, patch cadence, immutability, and secrets injection at runtime.

Explain container and serverless isolation boundaries and identify where customer controls begin in each.

Choose between agent-based and agentless workload protection for two contrasting requirement sets.

Classify data into four tiers and specify encryption requirements at rest, in transit, and in use for each tier.

Design a key hierarchy with explicit key custody, rotation, and the tradeoffs of customer-managed versus provider-managed keys.

Contrast tokenization, format-preserving encryption, and field-level encryption by use case and failure mode.

Apply secure development practices to a cloud pipeline: secrets scanning, infrastructure-as-code scanning, dependency scanning, and release gating.

Explain tenant data isolation options in a shared application and the failure modes of each.

Build an incident response plan adapted to cloud realities: provider notification paths, evidence acquisition order, and containment through identity and network controls.

Assign customer versus provider responsibilities at each incident response phase.

Define RTO and RPO targets and select a matching resilience pattern from backup-restore through active-active multi-region.

Evaluate at least three related technologies for their security impact on the domains already studied.

Execute a restore of sample data and record the actual measured time to restore.

Re-rank all twelve domains by practice accuracy and restudy only the three weakest.

Rebuild the week 1 responsibility matrix from memory and reconcile every difference against the original.

Complete two full-length timed assessments and log every miss with a root cause category.

Produce a decision aid that maps common business requirements to specific cloud security controls.