CC-CEM study guide
CC-CEM · Work through your exam, one topic at a time.
The CC-CEM (Certified Cloud Email Security Professional) is an independent vendor-neutral credential aimed at practitioners who secure email in cloud-hosted environments such as Microsoft 365, Google Workspace and hybrid gateways. It suits security engineers, email administrators, SOC analysts and consultants who already operate mail flow and now need to defend it. The CC-CEM study guide has 8 sections and about 3,668 words.
01Cloud Email Architecture and Deployment Models
Domain 1 tests how a cloud email service is laid out: where mail enters, how a namespace is shared with legacy systems, and which component is authoritative for a given recipient. Expect scenario questions that describe a topology and ask what happens to a message at each hop, or which record an administrator must change.
473 words, about 2 min02Email Authentication and Anti-Spoofing (SPF, DKIM, DMARC, ARC)
This domain tests whether you can read an authentication result chain and predict the outcome. Questions typically give you records or a trace header and ask why a message passed, failed, or landed in quarantine.
492 words, about 2 min03Inbound Threat Protection (Phishing, BEC, Malware, URL and Attachment Sandboxing)
This domain tests the inbound filtering pipeline and where each control sits in it. Expect questions about why a message was delivered, why a blocking control failed, and which policy layer should be changed.
445 words, about 2 min04Outbound Security, DLP and Encryption
This domain covers the controls that govern what leaves the tenant and in what form. Questions test outbound reputation protection, data loss prevention policy logic, and the difference between transport encryption and message-level encryption.
437 words, about 2 min05Data Residency, Privacy and Regulatory Compliance
This domain tests whether you can separate three ideas that candidates routinely merge: where data is stored at rest, whose law applies, and which contract or certification actually covers the workload. Scenario questions ask you to scope a commitment precisely or to choose the correct compliance artefact.
459 words, about 2 min06Identity, Access Management and API Integrations
This domain tests the identity plane that gates the mail service: how users authenticate, how administrators are constrained, and how applications obtain mailbox access without a human. Questions are usually about blast radius - what a misconfigured grant or exclusion actually permits.
429 words, about 2 min07Logging, Monitoring, Incident Response and Forensics
This domain tests whether you know which log answers which question and how long it survives. Scenario questions present a suspected compromise and ask what to query, in what order, and what evidence is still available.
472 words, about 2 min08Migration, Administration and Operational Governance
This domain tests execution: choosing a migration method, sequencing the cutover, and running the tenant afterwards so it does not quietly decay. Questions are usually about ordering, prerequisites, and the hygiene tasks that prevent incidents.
461 words, about 2 min