CCSO study guide
CCSO · Work through your exam, one topic at a time.
The Certified Cloud Security Officer (CCSO) is a vendor-neutral credential aimed at security professionals who carry responsibility for protecting cloud estates rather than only administering them. Typical candidates are security managers, cloud security architects, GRC analysts moving into cloud, and senior engineers stepping into a security ownership role. The CCSO study guide has 8 sections and about 2,056 words.
01Cloud Governance, Risk, and Compliance
This domain tests whether you can turn regulatory and business obligations into enforceable cloud controls, then prove they work. Expect questions on governance models, risk assessment, control frameworks, audit evidence, and data residency.
269 words, about 1 min02Cloud Architecture and Shared Responsibility
This domain tests where the provider's responsibility ends and yours begins across IaaS, PaaS, and SaaS, and how that boundary changes secure design. Expect questions on service models, deployment models, inherited controls, and reference architectures.
297 words, about 1 min03Identity, Access, and Privileged Account Management
This domain tests how you prove who can do what in cloud environments, with emphasis on federation, least privilege, and controlling privileged paths. Protect the root or global administrator: hardware MFA, no day-to-day use, a break-glass procedure, and alerting on use.
257 words, about 1 min04Data Protection, Encryption, and Key Management
This domain tests how data is classified, protected in transit and at rest, and how keys are governed across cloud services. Classify data first; controls follow sensitivity, residency, and retention requirements.
250 words, about 1 min05Cloud Network Security and Segmentation
This domain tests whether you can design and verify network isolation in cloud environments, not just describe a firewall. Start with deny-by-default and least exposure.
260 words, about 1 min06Workload, Container, and Application Security
This domain tests protection of compute and application artifacts: VMs, containers, Kubernetes, serverless, and the software supply chain. Build from hardened, minimal images; patch and rescan continuously; prefer immutable infrastructure.
233 words, about 1 min07Logging, Monitoring, and Incident Response
This domain tests whether you can detect, investigate, and respond to cloud incidents using the right telemetry and preserved evidence. Enable control-plane audit logs in all regions (CloudTrail, Azure Activity Log, GCP Audit Logs) and data-plane logs where required.
252 words, about 1 min08Cloud Security Operations, Automation, and DevSecOps
This domain tests secure delivery and operations at scale: infrastructure as code, policy as code, CI/CD controls, and automated response. Shift left: scan IaC, dependencies, containers, and secrets in pull requests; block merges on high-severity findings.
238 words, about 1 min