CC-CEM study plan
CC-CEM · Give each week a clear focus.
8 weeks · About 6 hours per week
Cloud Email Architecture and Deployment Models & Email Authentication and Anti-Spoofing (SPF, DKIM, DMARC, ARC)
Map the four cloud email delivery topologies (MX-hosted gateway, API-to-API, hybrid connector, journaling) and write one paragraph on where SPF evaluation happens in each.
Trace a single inbound message hop-by-hop through a cloud gateway and annotate which component rewrites headers, which adds authentication results, and which applies policy.
List the DNS records a tenant needs at cutover (MX, SPF, DKIM selectors, DMARC, MTA-STS, TLS-RPT) and note the TTL strategy for each.
Explain how a connector or transport rule changes the envelope sender versus the header From, and why that matters for downstream SPF checks.
Your checkpoint
A one-page annotated message-flow diagram covering all four topologies, with the DNS record set for each deployment model listed beside it.
Email Authentication and Anti-Spoofing (SPF, DKIM, DMARC, ARC)
Construct a working SPF record with include, ip4, and a ~all qualifier, then calculate the DNS lookup count by hand and confirm it stays at or under 10.
Generate a 2048-bit DKIM key pair, publish the selector, and verify a signed test message passes with the correct selector and fails with a wrong one.
Write a DMARC record at p=none with rua and ruf reporting, then describe the exact sequence to move to p=quarantine and p=reject.
Diagnose three common alignment failures: subdomain mismatch, third-party sender rewriting, and forwarded mail breaking SPF.
Explain how ARC seals preserve authentication results across forwarders and when a receiver should trust the chain.
Your checkpoint
A troubleshooting matrix of at least eight authentication failure symptoms mapped to root cause, fix, and the header field that confirms the diagnosis.
Inbound Threat Protection (Phishing, BEC, Malware, URL and Attachment Sandboxing)
Compare impersonation, display-name spoofing, lookalike domain, and thread-hijacking BEC patterns and state the control that catches each.
Configure a URL-rewrite and time-of-click detonation policy and describe what happens to a link already delivered when the verdict flips to malicious.
Design an attachment sandbox policy that detonates Office macros, PDFs, and archives, and specify the hold-and-release behavior for each file type.
Build a quarantine policy set with end-user release rules, admin review, and notification cadence for phishing versus malware versus bulk.
Draft an allow-list governance rule that prevents a user-reported false positive from permanently bypassing sandboxing.
Your checkpoint
A written inbound policy specification covering URL rewrite, attachment detonation, quarantine tiers, and allow-list expiry rules, with the expected verdict for five sample message scenarios.
Inbound Threat Protection (Phishing, BEC, Malware, URL and Attachment Sandboxing) & Outbound Security, DLP and Encryption
Create outbound DLP policies for at least three sensitive information types and test each against a sample message to confirm block, encrypt, or notify behavior.
Configure message encryption so that an external recipient can open an encrypted message without a tenant account, and document the recipient experience.
Set an outbound anti-spam and rate-limit policy that catches a compromised mailbox sending bursts, and describe the alert that fires.
Explain the difference between transport-rule encryption and client-side encryption and when each is appropriate.
Your checkpoint
A tested DLP and encryption runbook with three policy definitions, the observed outcome for each test message, and the recipient-side open procedure for encrypted mail.
Data Residency, Privacy and Regulatory Compliance & Identity, Access Management and API Integrations
Map each data type handled by the mail system to a residency requirement and identify where mailbox, journal, and log data physically reside.
Draft a retention and eDiscovery policy that satisfies a stated legal hold scenario without over-retaining transient logs.
Configure conditional access so that mail clients and API integrations require compliant device or MFA, and test one blocked scenario.
Register an application for Graph or SMTP AUTH-based mail access, scope it to least privilege, and rotate its secret on a defined schedule.
Explain how service principals and managed identities differ for a mail-sending integration and which to prefer.
Your checkpoint
A residency and access control matrix listing data type, storage location, retention period, and the identity control protecting access to it.
Logging, Monitoring, Incident Response and Forensics
Enable and query the audit and message-trace logs to reconstruct the full path of a delivered message including all policy hits.
Write a search that finds all messages from a suspected compromised account in the last 24 hours and exports the results for review.
Build an incident response playbook for a confirmed BEC: contain the mailbox, revoke sessions, purge delivered mail, and notify affected parties.
Define the forensic evidence to capture before remediation (headers, audit records, sign-in logs) and the order of operations.
Set up at least two monitoring alerts: one for a spike in authentication failures, one for a sudden outbound volume change.
Your checkpoint
An incident response playbook with a step-by-step BEC containment sequence and the exact log queries used at each step.
Migration, Administration and Operational Governance & Cloud Email Architecture and Deployment Models
Plan a phased mailbox migration with a pilot batch, cutover criteria, and a rollback trigger for each phase.
Write the coexistence routing rules that keep mail flowing between source and target during a long migration window.
Draft an operational governance checklist covering change approval, policy exception review, and quarterly authentication posture review.
Document a domain cutover runbook including MX change timing, TTL lowering, and post-cutover validation checks.
Your checkpoint
A migration and cutover runbook with a phased schedule, coexistence routing table, rollback criteria, and a post-cutover validation checklist.
Cloud Email Architecture and Deployment Models & Email Authentication and Anti-Spoofing (SPF, DKIM, DMARC, ARC) & Inbound Threat Protection (Phishing, BEC, Malware, URL and Attachment Sandboxing) & Outbound Security, DLP and Encryption & Data Residency, Privacy and Regulatory Compliance & Identity, Access Management and API Integrations & Logging, Monitoring, Incident Response and Forensics & Migration, Administration and Operational Governance
Take two full-length practice exams and log every missed question by domain to identify weak areas.
Re-drill the two lowest-scoring domains with targeted review of the specific failure symptoms already documented.
Recite the SPF lookup limit, DMARC policy progression, and quarantine tier behavior from memory without notes.
Review the troubleshooting matrix, DLP runbook, and incident playbook end to end to confirm each step is still accurate.
Your checkpoint
A scored practice-exam log with per-domain accuracy percentages and a prioritized list of remaining gaps with a fix action for each.
Milestones
Week 2: Can build, publish, and validate SPF, DKIM, and DMARC records for a test domain and correctly diagnose at least three alignment failures from headers alone.
Week 4: Inbound sandboxing and outbound DLP/encryption policies are written, tested against sample messages, and produce the expected verdicts.
Week 6: Can reconstruct a message's full delivery path from logs and execute a BEC containment sequence from the playbook without referring to external notes.
Week 8: Practice exams show at least 80% accuracy in domains 2 and 3 and no domain below 70%, with a written remediation list for any remaining gap.