CrowdStrike CCSA study plan

Map the four exam domains against your current knowledge and score each domain 1-5 to identify the two weakest areas

Describe how the Falcon platform is deployed and managed: sensor installation, cloud-registration of accounts, and the role of the CrowdStrike cloud in telemetry flow

Explain the difference between the Falcon agent-based sensor and agentless cloud assessment, and state which cloud providers and services each supports

Draw the data path from a cloud workload event to detection, threat graph correlation, and console alerting

Set up a personal lab plan: one free-tier cloud account, one test workload, and a note-taking system for the next eight weeks

Compare IaaS, PaaS, and serverless service models and identify which security controls shift to the provider in each

Explain how cloud identity (users, roles, service principals, instance profiles) differs from traditional on-premises accounts

Describe how cloud networking constructs such as VPCs, subnets, security groups, and load balancers affect sensor deployment and traffic visibility

Identify the API-driven and elastic characteristics of cloud that change incident response assumptions

Summarize how the Falcon platform consumes cloud audit logs and configuration data to build asset inventory

State the shared responsibility model for each major cloud provider and identify where the boundary sits for compute, data, identity, and network

Explain why misconfiguration remains the leading cloud risk and how it differs from a vulnerability in application code

Describe the main cloud threat categories: exposed storage, over-permissive identities, credential leakage, cryptomining, and lateral movement

Explain how compliance frameworks and cloud security posture expectations map to technical controls

Map each threat category to the type of Falcon Cloud Security finding that would surface it

Explain the purpose and mechanics of cloud security posture management, including how benchmarks and policies are evaluated against cloud configuration

Describe how agentless workload scanning inventories running workloads and detects vulnerabilities and exposed secrets without an installed agent

Distinguish infrastructure-as-code scanning from runtime configuration assessment and state when each is useful

Identify the difference between a misconfiguration finding, a vulnerability finding, and a runtime detection, and give one example of each

Configure a small set of custom policies in a lab cloud account and observe how findings are generated

Navigate the console to filter cloud assets by provider, account, region, and resource type and export an inventory

Prioritize findings using severity, exploitability, internet exposure, and asset criticality rather than severity alone

Explain how attack path analysis links a misconfiguration to a sensitive asset and why that changes prioritization

Describe how identity-based findings such as excessive permissions are detected and reported

Interpret a vulnerability finding for a container image, including how the base image and package layers affect the result

Explain how the Falcon sensor protects cloud workloads at runtime, including prevention policies and the difference between blocking and monitoring modes

Describe container and Kubernetes protection concepts: image assessment before deployment, runtime detection in pods, and drift from expected configuration

Explain how indicators of attack differ from indicators of compromise and why IOAs matter more in elastic cloud environments

Describe how detection data from cloud workloads is correlated with identity and configuration data to raise a single incident

Practice reading a detection summary and identifying the affected host, process tree, and cloud metadata

Describe the standard response workflow for a compromised cloud workload: isolate, snapshot for forensics, revoke credentials, and rebuild from a known-good image

Explain how network containment works on a cloud host and what it does and does not block

Describe real-time response capabilities such as running commands and pulling files from a host, and the permissions required

Explain why rotating credentials and revoking sessions is often more urgent than terminating the instance

Outline how to scope a cryptomining incident using process, network, and billing signals

Review your weakest two domains from the week 1 self-assessment and close the specific gaps you listed

Re-explain each of the four domains aloud in under five minutes without notes to test recall

Work through scenario questions that combine configuration findings with runtime detections and response decisions

Revisit every item you flagged as uncertain during weeks 1-7 and confirm or correct your understanding

Build a one-page reference sheet of key terms, distinctions, and workflow steps for final review