CSA (Other exams) study guide
CSA · Work through your exam, one topic at a time.
The CSA abbreviation is shared by several unrelated credentials: a security-architect certification, an entry-level cybersecurity analyst certification, and a ServiceNow system-administrator certification. This page describes a vendor-neutral security architect credential spanning eight domains: foundations and governance; risk, compliance, and frameworks; identity and access management; network security architecture and segmentation; cloud and virtualization security; data protection and cryptography; application security; and security operations and incident response. The CSA study guide has 8 sections and about 3,357 words.
01Security Architecture Foundations and Governance
This domain tests whether you can connect business drivers to a security architecture and then prove the connection through governance. Expect questions on architecture frameworks (SABSA, TOGAF, Zachman), the policy hierarchy, design principles, and the review and exception machinery that keeps an architecture defensible over time.
442 words, about 2 min02Risk, Compliance, and Security Frameworks
This domain tests whether you can quantify and treat risk, then map obligations onto a control set without confusing a certificate with security. Expect questions on risk vocabulary, treatment options, framework structure, and scoping decisions.
452 words, about 2 min03Identity, Authentication, and Access Management
This domain tests identity architecture: how assurance levels are chosen, how authorization is modelled, how federation and lifecycle work, and where token handling fails. Expect specifics on NIST SP 800-63B, OAuth versus OpenID Connect, and provisioning.
391 words, about 2 min04Network Security Architecture and Segmentation
This domain tests whether you can turn a data flow into zones and enforcement points, then defend the segmentation you drew. Expect questions on zone design, east-west traffic, microsegmentation, ZTNA, and inspection trade-offs.
424 words, about 2 min05Cloud and Virtualization Security Architecture
This domain tests how responsibility shifts across IaaS, PaaS, and SaaS, how landing zones enforce guardrails, and where virtualisation and container layers introduce new attack surface. Expect questions on scope reduction, organisational policy, and workload identity.
403 words, about 2 min06Data Protection, Cryptography, and Privacy
This domain tests classification and lifecycle handling, algorithm and key-management choices, and privacy obligations. Expect questions that distinguish tokenization, masking, hashing, and encryption, and that probe whether keys - not just ciphertext - are controlled.
410 words, about 2 min07Application and Software Security Architecture
This domain tests secure design and the software development lifecycle: threat modelling at design time, assurance tooling across the pipeline, and service-to-service security in distributed applications. Expect questions that force you to pick the control that actually removes the flaw.
404 words, about 2 min08Security Operations, Monitoring, and Incident Response
This domain tests detection engineering and the response lifecycle: where logs live, how alerts are tuned, how incidents are contained without destroying evidence, and how recovery targets are set. Expect questions on NIST SP 800-61 phases, order of volatility, and RTO/RPO.
431 words, about 2 min