CCSP study plan

Diagram the three cloud service models and four deployment models, labeling exactly where the security responsibility boundary falls in each

Build a customer-versus-provider control list for IaaS, PaaS, and SaaS across identity, network, host, data, application, and physical layers

Compare cloud reference architectures and identify the actors, activities, and security-relevant artifacts in each

Explain core cloud design patterns (multi-tenancy, federation, statelessness, elasticity) and state the security implication of each

Map the Cloud Controls Matrix domains to the six CCSP domains and note where coverage overlaps

Describe the full data lifecycle from creation through destruction and assign at least one control to each stage

Classify a sample data set into sensitivity tiers and derive encryption and retention requirements from the tier

Compute SLE, ALE, and a qualitative risk ranking for a sample cloud migration scenario

Identify the data roles (controller, processor, owner, custodian) in a given cloud contract

Compare encryption at rest approaches (full-volume, database, application-level, object storage) and select the right one per data state

Design a key management hierarchy covering generation, custody, escrow, rotation, revocation, and destruction

Place DLP, CASB, and discovery/classification tooling on a data-flow diagram and explain what each can and cannot see

Differentiate tokenization, masking, anonymization, and rights management, and justify when each is appropriate

Decompose a cloud stack into physical, network, compute, storage, and virtualization layers and list the top threats at each layer

Design network segmentation for a three-tier application using VPC/VNet, subnets, security groups, and network ACLs

Explain the hypervisor and container host attack surface and apply a CIS-style hardening baseline to each

Position WAF, IDS/IPS, stateful firewalls, and micro-segmentation in a reference topology and state the failure mode of each

Apply a secure SDLC to a cloud-native application from threat modeling through build, deploy, and runtime assurance

Trace SAML, OIDC, and OAuth 2.0 federation flows and identify where tokens are issued, validated, and revoked

Detect and mitigate common cloud application flaws including broken object-level authorization, SSRF to the instance metadata service, and insecure APIs

Harden a CI/CD pipeline with artifact signing, secrets management, and infrastructure-as-code scanning

Architect logging and monitoring that ingests cloud-native logs into a SIEM with defined retention and integrity protections

Write incident response procedures across the full NIST lifecycle, emphasizing cloud containment through IAM and network controls

Describe change management and configuration drift detection for infrastructure deployed as code

Map backup, pilot light, warm standby, and multi-site strategies to stated RTO and RPO targets

Map GDPR, HIPAA, PCI DSS, and SOX obligations onto cloud hosting arrangements and identify data residency constraints

Interpret SLA, MSA, DPA, right-to-audit, and data portability/exit clauses and flag the risky ones

Perform a cloud risk assessment using a recognized methodology and record a treatment decision for each finding

Evaluate SOC 2 Type II, ISO/IEC 27001, and CSA STAR evidence and test whether the audit scope actually covers the service in use

Sit two full-length timed practice exams and log every miss by domain and by root cause (unknown fact, misread, or wrong reasoning)

Rewrite condensed notes for the two weakest domains identified in the score reports

Drill the cross-domain overlaps, especially key management and logging, which surface in Domains 2, 3, and 5

Rehearse exam-day logistics including scheduling, break timing, and per-question pacing