CloudSec-Pro study plan
CloudSec-Pro · Give each week a clear focus.
8 weeks · About 7 hours per week
Cloud Governance, Risk, and Compliance
Map every CloudSec-Pro Domain 1 objective (governance, risk, compliance) to a one-line self-assessment of what you can already explain without notes
Explain shared responsibility boundaries for IaaS, PaaS, FaaS, and SaaS and state who owns each control layer in a written table
Compare the major compliance frameworks (ISO 27001, SOC 2, PCI DSS, HIPAA, GDPR) on scope, evidence type, and cloud provider inheritance
Describe how cloud provider assurance artifacts (SOC 2 reports, compliance packages, customer responsibility matrices) reduce audit scope
Define a cloud risk register entry with likelihood, impact, treatment, owner, and review cadence
Your checkpoint
A two-page control ownership matrix covering four service models plus a 10-row cloud risk register with named treatments
Cloud Governance, Risk, and Compliance & Cloud Security Architecture and Shared Responsibility
Draft a cloud governance policy set covering acceptable use, data classification, and third-party access
Distinguish policy-as-code guardrails from detective controls and give a concrete example of each in a multi-account landing zone
Explain how organization-level policy inheritance and account structure enforce separation of duties
Trace a single regulatory requirement from law to internal control to technical evidence in the cloud
Evaluate a scenario where a provider's shared responsibility boundary shifts and identify the resulting control gaps
Your checkpoint
A one-page governed landing-zone design note with policy inheritance diagram and a requirement-to-evidence traceability table for three controls
Identity, Access, and Privilege Management in the Cloud
Compare cloud IAM policy evaluation logic across allow, explicit deny, permission boundaries, and session policies
Design a least-privilege role model for a three-tier application with human and machine identities separated
Explain federation patterns (SAML, OIDC, workload identity) and when to prefer short-lived credentials over static keys
Describe privilege escalation paths in cloud IAM and the preventive controls that close them
Configure and interpret an access analyzer finding for an over-permissive resource policy
Your checkpoint
A least-privilege IAM design with policy snippets, an escalation-path list of at least six vectors, and one worked access-analyzer finding
Identity, Access, and Privilege Management in the Cloud & Data Protection, Encryption, and Key Management
Design a key hierarchy from root of trust to data encryption keys and justify envelope encryption choices
Compare provider-managed, customer-managed, and external key management on control, cost, and operational burden
Explain key rotation, key deletion, and crypto-shredding as data lifecycle controls
Apply data classification to storage, backup, and analytics services and select matching encryption and access controls
Describe secrets management patterns that remove long-lived credentials from application code and CI pipelines
Your checkpoint
A key management architecture diagram with rotation schedule, a data classification table mapped to encryption controls, and a secrets migration plan
Data Protection, Encryption, and Key Management & Cloud Network Security and Segmentation
Design network segmentation for a multi-tier cloud workload using subnets, security groups, and network policies
Explain private connectivity options (private endpoints, peering, transit gateways) and when each is appropriate
Compare egress control approaches including NAT, firewalls, and DNS filtering with their bypass risks
Identify data exfiltration paths through storage service endpoints and describe the controls that restrict them
Describe how cross-account and cross-region data flows change the threat model for encryption in transit
Your checkpoint
A segmented network diagram with a flow matrix showing allowed traffic per tier and a list of at least five exfiltration paths with the control that blocks each
Workload and Application Security (Containers, Serverless, IaC)
Harden a container image pipeline from base image selection through registry scanning and admission control
Explain serverless-specific risks including event injection, over-permissive execution roles, and dependency confusion
Identify insecure patterns in infrastructure-as-code such as public storage, open security groups, and hardcoded secrets
Describe how to enforce IaC policy checks in pull requests and block merges on high-severity findings
Compare runtime protection options for containers and functions and state what each detects that static checks miss
Your checkpoint
An IaC security review checklist plus three remediated misconfiguration examples with the blocking policy rule that would have prevented each
Logging, Monitoring, Detection, and Incident Response
Design a centralized logging architecture that captures control-plane, data-plane, and identity audit events
Explain log integrity controls including immutability, separate retention accounts, and tamper evidence
Build detection rules for at least three attack techniques and state the telemetry each requires
Outline a cloud incident response runbook covering containment, credential revocation, and evidence preservation
Describe how to validate detection coverage and measure mean time to detect for a cloud-native environment
Your checkpoint
A detection and response package containing a logging architecture sketch, three detection rules with required telemetry, and a containment runbook for a compromised workload identity
Posture Management, Vulnerability Management, and DevSecOps & Cloud Security Architecture and Shared Responsibility
Design a continuous posture management loop from baseline definition through scoring, triage, and remediation SLAs
Prioritize vulnerabilities in cloud workloads using exploitability, exposure, and business context rather than raw severity
Integrate security gates into a CI/CD pipeline at the right stages without blocking delivery unnecessarily
Explain how to measure and report cloud security posture to both engineering and executive audiences
Run a timed mixed-domain review and close the weakest remaining area with targeted practice
Your checkpoint
A posture management one-pager with remediation SLAs by severity, a pipeline gate diagram, and a scored 60-question practice set with a written gap-closure plan
Milestones
Week 2: Without notes, sketch the shared responsibility split for IaaS, PaaS, and SaaS and name the compliance artifact that evidences each provider-side control; score at least 8 of 10 on a self-made Domain 1 and 7 quiz
Week 4: Explain the full policy evaluation path for a denied request and draw the key hierarchy from root of trust to data key in under 10 minutes each; no unresolved gaps in Domains 1, 2, or 4 notes
Week 6: Given an unfamiliar architecture description, identify at least five security weaknesses spanning network segmentation, data protection, and IaC within 20 minutes
Week 7: Write a detection rule and its required telemetry for a stolen workload credential and state the first three containment actions in order
Week 8: Score 80 percent or higher on a 60-question mixed-domain practice set with no domain below 70 percent, and have a written remediation plan for every missed objective