CSPCC study guide
CSPCC · Work through your exam, one topic at a time.
The Certified Security Professional in Cloud Computing (CSPCC) is a vendor-neutral credential aimed at security practitioners who design, govern, and defend workloads that run on public, private, and hybrid cloud platforms. It suits security engineers, cloud architects, DevSecOps practitioners, risk and compliance analysts, and IT auditors who already understand traditional security controls and now need to apply them to elastic, API-driven, multi-tenant environments. The CSPCC study guide has 8 sections and about 2,856 words.
01Cloud Architecture Concepts and Design
Cloud Architecture Concepts and Design tests whether you can map business and security requirements to NIST-style service models (IaaS, PaaS, SaaS), deployment models (public, private, hybrid, community), and reference architectures. You must reason about shared responsibility, multi-tenancy, elasticity, resiliency, portability, and data gravity rather than recite definitions.
350 words, about 2 min02Cloud Security Governance and Risk Management
Cloud Security Governance and Risk Management tests how you set direction, assign accountability, and treat risk when infrastructure is outsourced. Expect questions on policy hierarchy, risk appetite, third-party risk, control inheritance, CSA CCM, ISO/IEC 27017, and NIST RMF/CSF concepts.
359 words, about 2 min03Identity, Access, and Credential Management in the Cloud
Identity, Access, and Credential Management in the Cloud tests policy evaluation, federation, least privilege, and credential lifecycle. You must know the difference between authentication and authorization, how roles and trust policies work, and why temporary credentials beat static keys.
372 words, about 2 min04Data Security, Privacy, and Protection in Cloud Environments
Data Security, Privacy, and Protection in Cloud Environments tests classification, encryption, key management, privacy obligations, and data lifecycle. Expect scenarios on residency, deletion, tokenization, DLP, and who controls cryptographic keys.
353 words, about 2 min05Cloud Infrastructure and Network Security
Cloud Infrastructure and Network Security tests segmentation, traffic control, hybrid connectivity, and protection of management planes. You must design VPC/VNet layouts, choose security groups versus network ACLs, and secure ingress, egress, and administrative access.
349 words, about 2 min06Application Security and Secure DevOps in the Cloud
Application Security and Secure DevOps in the Cloud tests how security is built into the software lifecycle and CI/CD pipeline. Expect questions on IaC scanning, SAST/DAST/SCA, container security, supply-chain integrity, secrets handling, and least-privilege deployment identities.
345 words, about 2 min07Cloud Security Operations, Monitoring, and Incident Response
Cloud Security Operations, Monitoring, and Incident Response tests detection, logging, triage, containment, and forensics in elastic environments. You must know which logs the provider supplies, which the customer must enable, and how to preserve evidence before destroying it.
349 words, about 2 min08Compliance, Legal, and Audit Considerations for Cloud Services
Compliance, Legal, and Audit Considerations for Cloud Services tests how contracts, audit evidence, jurisdiction, and retention obligations apply when data and operations sit with a provider. Expect questions on SOC 2, ISO/IEC 27001/27017/27018, FedRAMP, GDPR, DPAs, subprocessors, eDiscovery, and right-to-audit clauses.
379 words, about 2 min