CrowdStrike CCCS study plan

Define the shared responsibility model for IaaS, PaaS, and SaaS and map which controls belong to the customer versus the provider.

Describe the core components of cloud-native architecture (regions, availability zones, VPCs, managed services) and explain how each changes the attack surface.

Differentiate cloud security posture management from cloud workload protection and state where each fits in a defense-in-depth design.

Explain why traditional perimeter security fails in cloud environments and identify the visibility gaps that result.

Compare agent-based and agentless workload protection and identify which telemetry each approach can and cannot collect.

Describe how runtime protection detects and blocks malicious process behavior on Linux and Windows cloud workloads.

Explain how container and Kubernetes workloads differ from virtual machines in image layers, ephemeral lifecycles, and host-level visibility.

Outline a vulnerability management workflow for cloud workloads from asset discovery through patch prioritization and verification.

Configure least-privilege workload identities and eliminate long-lived static credentials in favor of short-lived tokens or instance roles.

Trace how a compromised workload identity can be used for lateral movement and privilege escalation across cloud services.

Explain how identity and entitlement data enrich workload detections, such as flagging a process that assumes an unusual role.

Evaluate the security tradeoffs of secrets managers, workload identity federation, and key rotation schedules.

Break down federation protocols (SAML, OIDC) and describe how trust relationships between identity providers and cloud platforms are established and abused.

Analyze common cloud IAM weaknesses: wildcard policies, privilege escalation paths, unused permissions, and cross-account trust.

Describe how conditional access, MFA enforcement, and session controls reduce credential theft impact.

Explain how identity threat detection correlates sign-in anomalies, impossible travel, and token misuse into a single finding.

Describe how VPC flow logs, DNS logs, and firewall logs differ in what they reveal about east-west and north-south traffic.

Explain microsegmentation and security group design principles that limit lateral movement between workloads.

Identify the visibility limits of encrypted traffic, serverless networking, and private endpoints, and state which compensating controls apply.

Interpret network telemetry to distinguish normal service-to-service traffic from command-and-control beaconing.

Map the incident response lifecycle to cloud-specific constraints such as ephemeral instances, shared logs, and provider cooperation.

Describe how to preserve forensic evidence from cloud workloads and logs without disrupting production.

Explain how detection engineering uses process, identity, and network telemetry together to raise signal quality and reduce false positives.

Outline how automated response actions (isolate host, revoke session, disable key) are scoped and safely tested.

Translate common compliance frameworks (CIS Benchmarks, SOC 2, PCI DSS) into concrete cloud configuration checks.

Explain how continuous compliance monitoring differs from point-in-time audits and how drift is detected.

Describe how CSPM findings are prioritized by severity, exploitability, and business context rather than raw count.

Connect architectural decisions from week 1 to the compliance evidence they generate or undermine.

Synthesize all five domains into an end-to-end attack scenario from initial access through impact, naming the control that would have interrupted each stage.

Revisit the weakest domain from prior weeks and close the specific knowledge gap with targeted review.

Practice explaining tradeoffs between detection coverage, operational cost, and false positive rate to a non-technical stakeholder.

Verify recall of key terminology and architecture concepts under timed conditions.