ISACA CCAK study plan

Distinguish IaaS, PaaS, SaaS and the four deployment models (public, private, hybrid, community) by writing the exact customer-versus-provider control boundary for compute, storage, network, identity, and data at each layer.

Map the CSA Security Guidance v4 domains to NIST SP 800-145/800-146 definitions so you can cite the correct reference when a scenario names a service model.

Diagram a three-tier cloud workload showing trust boundaries, ingress/egress paths, virtualization and hypervisor layers, and where a CASB or SASE edge sits relative to the workload.

Explain how multi-tenancy, resource pooling, elasticity, and measured service create risks that do not exist in on-premises data centers, and name the control that mitigates each.

Design a cloud identity and access architecture that specifies federation (SAML/OIDC), MFA enforcement points, privileged access management, and least-privilege role design for a named business scenario.

Compare encryption options across data states (at rest, in transit, in use) and key-management custody models (provider-managed, BYOK, HYOK, customer-held HSM) with the residual risk of each.

Differentiate network security controls available in cloud: security groups, NACLs, micro-segmentation, private endpoints, WAF, and DDoS protection, and select the right combination for a regulated workload.

Identify the governance decisions that architecture choices lock in, including vendor lock-in, data residency, portability, and exit costs.

Structure a cloud governance operating model: assign decision rights across board, steering committee, cloud center of excellence, business owners, and service owners, referencing COBIT 2019 and ISO/IEC 38500 as frameworks.

Draft policy hierarchy from enterprise policy to cloud standards to workload baselines, showing how each level is enforced technically or procedurally.

Evaluate a cloud contract and SLA for governance gaps: audit rights, breach notification timelines, data return and deletion, subcontractor (fourth-party) disclosure, service credit remedies, and termination assistance.

Build a vendor lifecycle process covering due diligence, onboarding, ongoing performance review, reassessment triggers, and exit or transition planning.

Apply a repeatable cloud risk assessment method (identify, analyze, evaluate, treat, monitor) to a realistic multi-cloud scenario and record results in a risk register with likelihood, impact, and risk owner.

Translate risk appetite and tolerance statements into measurable cloud key risk indicators such as control-failure rate, mean time to remediate, policy exception count, and third-party assessment currency.

Analyze provider-side and fourth-party concentration risk, including dependency on a single region, single identity provider, or single SaaS vendor, and propose treatment options (accept, mitigate, transfer, avoid).

Map cloud-specific threats to controls using a recognized catalog (CSA Cloud Controls Matrix and NIST RMF steps) so that every registered risk traces to at least one control.

Classify a hypothetical organization's data and match it to applicable obligations across GDPR, PCI DSS, HIPAA, SOX/GLBA, and one regional data-residency law, naming the specific requirement that hits the cloud provider relationship.

Explain the difference between provider certification (ISO/IEC 27001, 27017, 27018, 27701), provider attestation (SOC 2 Type II, ISAE 3402), and self-assessment (CAIQ, CCM), and state when each is acceptable evidence.

Distinguish controls the provider operates, controls the customer inherits, and controls the customer must add (CUECs and CSOCs), and show how they combine into a complete control set.

Build a compliance crosswalk that maps one regulatory requirement to multiple frameworks simultaneously to avoid duplicate control testing.

Plan a cloud audit end to end: define scope and boundaries (which services, regions, accounts, and subservice organizations), objectives, criteria, sampling approach, and evidence requests.

Evaluate a SOC 2 Type II report critically by reading the scope section, testing exceptions, the CUEC list, and the subservice organization carve-out versus inclusive method.

Select audit techniques suited to cloud evidence: configuration exports, API-driven log queries, screenshot-plus-reproduction scripts, and provider portal read-only access, and identify where evidence can be forged or goes stale.

Design audit logging requirements including what must be logged, retention period, immutability, time synchronization, and who can read or delete logs, then audit the design.

Design a continuous assurance program using CAIQ self-assessments, provider API telemetry, and periodic re-testing, and state the cadence and escalation path for each control tier.

Assess control effectiveness across the audit lifecycle by writing findings that state condition, criteria, cause, effect, and recommendation, and by rating severity consistently.

Reconstruct audit conclusions from limited evidence in a scenario where the provider will not grant direct access, and identify the compensating procedures available.

Integrate the five domains by tracing one incident scenario from architecture weakness through governance failure, risk realization, compliance breach, and audit finding.

Consolidate all deliverables into one indexed study binder organized by domain and by framework reference so any concept can be located within 60 seconds.

Re-teach the five weakest concepts identified from practice performance by writing a short explanation and a worked example for each, without referring to notes.

Complete timed practice sets and convert every miss into a one-line rule in a personal error log, distinguishing knowledge gaps from misread-question errors.

Simulate exam conditions with full-length timed practice and confirm pacing leaves at least 15 minutes for flagged-item review.