IBM Cloud Security Engineer study plan

Map the shared responsibility model for IBM Cloud IaaS and PaaS offerings into a one-page table that names which controls the customer owns for VPC infrastructure, IBM Cloud Kubernetes Service, and Cloud Object Storage.

Define the core governance primitives (account, resource group, resource group hierarchy, IBM Cloud Identity and Access Management account settings) and write a short note explaining how resource groups bound blast radius and access scope.

Explain the difference between classic infrastructure permissions and IAM policies, and list three scenarios where the legacy entitlement model still matters.

Draft a glossary of 25 IBM Cloud security terms (for example service ID, trusted profile, API key, context-based restriction) with a one-line accurate definition each.

Construct IAM policies that grant least privilege for a specific persona (read-only auditor, deployment pipeline, and database administrator) and justify each role choice against built-in roles versus custom roles.

Distinguish user, service ID, and trusted profile identities, and describe when a compute resource should authenticate with a trusted profile instead of a stored API key.

Configure the logic of context-based restrictions by combining network zones with rule enforcement, and predict whether a given request would be allowed.

Trace an authentication flow from API key exchange to IAM token issuance to authorization decision, and identify where token lifetime and revocation take effect.

Compare IBM Cloud App ID and IAM for application-level identity, stating which problem each solves.

Explain envelope encryption in IBM Cloud: how data encryption keys, root keys in Key Protect or Hyper Protect Crypto Services, and key wrapping relate to each other.

Differentiate Key Protect from Hyper Protect Crypto Services by tenancy, FIPS validation level, and key custody, and state which workloads require the dedicated HSM option.

Describe BYOK and KYOK workflows, including how importing or importing-with-wrap root key material changes the customer's recovery obligations.

List the encryption-at-rest defaults and customer-managed-key options for Cloud Object Storage, block storage, and databases.

Identify where secrets belong (Secrets Manager) versus where configuration belongs, and explain rotation strategy for API keys and service credentials.

Design a VPC with public and private subnets, security groups, and network ACLs, and explain which layer enforces stateful versus stateless filtering.

Explain how VPC security groups differ from classic infrastructure security groups and from gateway and routing constructs.

Describe private connectivity options (VPC peering, transit gateway, Direct Link, private service endpoints) and select the right one for three stated scenarios.

Explain how to keep service-to-service traffic off the public internet using private endpoints and how to verify that traffic path.

Outline DDoS and edge protection responsibilities, distinguishing platform-provided protections from customer-configured controls.

Enable and route platform activity logs and service logs to the required destinations, and explain the difference between platform events and audit events.

Use IBM Cloud Activity Tracker event fields to reconstruct who did what, from where, and when for a suspicious API call.

Describe how to collect VPC flow logs and what they can and cannot prove during an investigation.

Draft an incident response runbook for a leaked API key, covering detection, containment by key deletion, scope assessment, and notification.

Explain how IBM Cloud Security and Compliance Center findings and IBM Cloud Monitoring alerts feed a detection pipeline.

Map the exam's compliance concerns to concrete IBM Cloud capabilities, naming which control families Security and Compliance Center can evaluate automatically.

Explain how to produce evidence for an audit: which logs, configurations, and attestation artifacts to collect and how long to retain them.

Perform a lightweight risk assessment on a three-tier application, ranking risks by likelihood and impact and pairing each with a mitigating control.

Describe data residency and location-based service selection, and explain how to keep regulated data within an approved geography.

Re-derive the least-privilege policy set for the three week-2 personas without consulting notes, then correct and annotate the differences.

Rebuild the week-3 key hierarchy and the week-4 network design from memory in under 30 minutes combined.

Resolve ten mixed scenario questions that combine identity, encryption, and network controls, and write the reasoning for each answer.

Close every gap flagged in weeks 2 through 4 by writing a corrected one-paragraph explanation for each.

Run two full-length timed practice sets weighted evenly across all six domains and record per-domain accuracy.

For every domain scoring below 80 percent, re-teach the weak concept aloud in under two minutes without notes.

Review the incident runbook, risk register, and audit checklist for internal consistency and correct any control mapping errors.

Summarize the top ten facts most likely to be tested, one sentence each, as a final recall sheet.