CCSO study plan

Map each of the five CCSO domains to its exam weight and rank them by study hours so the heaviest domains get the most calendar time

Define cloud governance, risk, and compliance in your own words and list the control objectives each one implies for a cloud environment

Compare the shared responsibility model against a major cloud provider's published documentation and record where customer obligations begin for IaaS, PaaS, and SaaS

Build a control catalog mapping at least 15 common cloud controls (IAM, encryption, logging, network) to governance, risk, and compliance categories

Identify three regulatory or standards frameworks relevant to cloud (for example ISO 27001, SOC 2, PCI DSS) and note what each demands of a cloud customer

Draft a risk register with at least 10 cloud-specific risks, each scored by likelihood and impact with a stated treatment option

Distinguish cloud architecture patterns (multi-account, landing zone, hub-and-spoke) and explain how each changes the compliance boundary

Trace one workload end to end through the shared responsibility split and assign each control to provider, customer, or shared

Evaluate how a cloud provider's audit reports and compliance certifications reduce but never eliminate customer obligations

Write governance policies for tagging, data classification, and exception handling that a cloud team could adopt

Diagram a multi-account or multi-subscription structure with centralized identity, logging, and security accounts and justify each boundary

Explain the difference between authentication, authorization, and federation and where each sits in a cloud identity model

Configure or simulate a federated identity flow using SAML or OIDC and document the trust relationships and token claims

Compare role-based, attribute-based, and policy-based authorization and select the right model for three sample scenarios

Identify the top five identity misconfigurations in cloud (for example over-privileged roles, unused access keys) and the control that prevents each

Design a privileged access management workflow covering just-in-time elevation, approval, session recording, and automatic revocation

Enumerate the controls that protect the root or super-admin account and write the checklist an operator would follow

Implement or simulate least-privilege policy for a sample role and show the before-and-after permission diff

Document a credential lifecycle from creation through rotation to revocation, including secrets storage and break-glass procedures

Explain how conditional access, MFA, and device posture signals combine to gate privileged sessions

Classify data by sensitivity and map each class to encryption at rest, in transit, and in use requirements

Compare customer-managed keys, provider-managed keys, and external key stores and state the tradeoffs in control, cost, and operational burden

Describe envelope encryption and key rotation and explain what rotation does and does not protect against

Design a key management hierarchy with separation of duties between key administrators and data users

List the top data protection failures (public storage, missing encryption, exposed secrets in code) and the preventive control for each

Design a segmented network with public, private, and management tiers and justify each security group or firewall rule

Explain how private connectivity options (private endpoints, VPC peering, transit gateways) change the attack surface compared with public exposure

Harden a container image and its runtime by removing unnecessary privileges, pinning base images, and scanning for vulnerabilities

Describe the CI/CD pipeline controls that gate deployment, including secrets handling, artifact signing, and policy checks

Compare host-based, container-based, and serverless workload protections and note where each leaves gaps

Define the log sources required for detection across identity, network, data, and workload layers and specify retention for each

Build a detection use case for a realistic cloud attack chain and identify the telemetry each step would produce

Draft an incident response plan with roles, escalation paths, containment steps, and evidence preservation for a cloud breach

Explain how automation (SOAR, auto-remediation) shortens response time and where human approval must remain

Practice writing a post-incident review that separates root cause from contributing factors

Express at least five security controls as policy-as-code and explain how they gate a deployment pipeline

Design a DevSecOps workflow that shifts scanning left while keeping runtime protection in place

Revisit the week 1 control catalog and mark each control as automated, manual, or hybrid with a justification

Complete two timed practice sets across all domains and analyze every missed question by domain and root cause

Summarize the three weakest areas from practice results and write a targeted review plan for the final days