CSPCC study plan
CSPCC · Give each week a clear focus.
8 weeks · About 6 hours per week
Cloud Architecture Concepts and Design
Explain the shared responsibility model and differentiate provider vs. customer duties across IaaS, PaaS, and SaaS
Compare cloud deployment models (public, private, hybrid, community) and service models (IaaS, PaaS, SaaS) using concrete examples
Identify key cloud reference architectures (NIST, CSA, vendor frameworks) and their security implications
Design a simple multi-tier cloud architecture that maps security controls to each layer
Your checkpoint
A one-page architecture diagram with a control mapping table for a three-tier web application in a public cloud, annotated with shared responsibility boundaries.
Cloud Architecture Concepts and Design & Cloud Infrastructure and Network Security
Evaluate network segmentation options (VPCs, subnets, security groups, NACLs) for isolating workloads
Describe how virtual private networks (VPNs) and dedicated interconnects extend on-premises networks to the cloud
Analyze the security implications of cloud network services such as load balancers, DNS, and CDNs
Design a secure network topology for a hybrid cloud scenario with public and private subnets
Your checkpoint
A network topology diagram (logical) for a hybrid cloud environment showing VPCs, subnets, security groups, VPN gateways, and traffic flows, with a short written justification of segmentation choices.
Cloud Security Governance and Risk Management
Outline a cloud security governance framework including policies, roles, and responsibilities
Perform a risk assessment for a cloud migration using a standard methodology (e.g., NIST RMF, ISO 27005)
Identify key cloud-specific risks (data breach, misconfiguration, insecure APIs, account hijacking) and propose mitigations
Explain the role of a Cloud Security Alliance (CSA) Cloud Controls Matrix (CCM) in governance
Your checkpoint
A risk register with at least 10 cloud-specific risks, each with likelihood, impact, risk score, and mitigation strategy, plus a governance RACI chart.
Identity, Access, and Credential Management in the Cloud
Compare identity federation standards (SAML, OAuth 2.0, OpenID Connect) and their use cases
Design a role-based access control (RBAC) model for a multi-tenant cloud application
Implement least privilege using just-in-time access and privileged access management (PAM) concepts
Evaluate multi-factor authentication (MFA) and passwordless authentication options for cloud identities
Your checkpoint
An identity and access management design document for a fictional organization, including an RBAC matrix, federation architecture, and MFA enforcement policy.
Data Security, Privacy, and Protection in Cloud Environments
Classify data according to sensitivity and map appropriate encryption controls (at rest, in transit, in use)
Describe key management services (KMS) and hardware security modules (HSM) and their role in cloud data protection
Explain data residency, sovereignty, and privacy regulations (e.g., GDPR, CCPA) affecting cloud data storage
Design a data loss prevention (DLP) strategy for cloud storage and SaaS applications
Your checkpoint
A data protection plan for a cloud-based customer database, covering classification, encryption, key management, access controls, and compliance with at least two privacy regulations.
Application Security and Secure DevOps in the Cloud
Integrate security into CI/CD pipelines (SAST, DAST, SCA, secrets scanning)
Implement infrastructure as code (IaC) security scanning and policy as code
Describe secure configuration management and immutable infrastructure patterns
Evaluate container and serverless security best practices
Your checkpoint
A secure DevOps pipeline diagram with tooling for each stage (plan, code, build, test, release, deploy, operate) and a sample policy-as-code rule that blocks insecure configurations.
Cloud Security Operations, Monitoring, and Incident Response
Configure centralized logging and monitoring for cloud resources using native services
Develop incident response playbooks for common cloud incidents (e.g., compromised credentials, data exfiltration)
Use cloud security posture management (CSPM) tools to detect misconfigurations
Explain the role of SIEM and SOAR in cloud security operations
Your checkpoint
An incident response playbook for a compromised cloud account, including detection, containment, eradication, recovery, and lessons learned, plus a monitoring dashboard mockup.
Compliance, Legal, and Audit Considerations for Cloud Services & Cloud Security Governance and Risk Management
Interpret cloud compliance requirements (e.g., SOC 2, ISO 27001, PCI DSS, HIPAA) and map them to cloud controls
Explain the audit process in the cloud, including evidence collection and third-party attestations
Analyze legal considerations such as eDiscovery, data ownership, and cross-border data transfers
Review contract and SLA security clauses for cloud services
Your checkpoint
A compliance matrix mapping at least 10 controls from a chosen framework (e.g., ISO 27001) to cloud provider capabilities, with a summary of audit evidence requirements.
Milestones
Week 2: Can explain the shared responsibility model and design a secure network topology for a hybrid cloud without notes.
Week 4: Can produce a risk register and an RBAC design that passes peer review for completeness and least privilege.
Week 6: Can describe a secure CI/CD pipeline and data protection strategy, and has completed at least two practice exams with scores above 80%.
Week 8: Can map compliance controls to cloud services and has completed a full-length practice exam with a score above 85%.