Certified Cloud Security Analyst study guide
Certified Cloud Security Analyst · Work through your exam, one topic at a time.
The Certified Cloud Security Analyst (CCSA) is a cloud computing certification offered by the Global Association for Quality Management (GAQM), a certification body whose portfolio spans project management, software testing, information systems security, data centre and cloud computing tracks. CCSA sits in GAQM's cloud computing family and is aimed at practitioners who need to reason about cloud risk rather than only operate cloud consoles: security analysts, cloud administrators moving into security roles, auditors and compliance staff who review cloud environments, and IT generalists preparing to specialise. The Certified Cloud Security Analyst study guide has 6 sections and about 1,966 words.
01Cloud Security Fundamentals and Governance
This domain tests whether you can define cloud computing precisely and show how governance converts those definitions into enforceable, auditable decisions. The exam leans on NIST SP 800-145 vocabulary, so quote definitions accurately rather than loosely.
351 words, about 2 min02Cloud Architecture, Models and Shared Responsibility
This domain tests your ability to place each control on the correct side of the shared responsibility line and to design tenancy and segmentation that limit blast radius. The provider is always responsible for security of the cloud: facilities, hardware, and the hypervisor.
340 words, about 2 min03Cloud Identity, Access and Data Protection
This domain tests identity as the primary control plane in cloud environments, and the data-protection controls that follow from classification. Federation via SAML 2.0 or OIDC keeps the enterprise identity provider as the source of truth; SSO reduces credential sprawl, and MFA enrollment is mandatory for privileged roles.
358 words, about 2 min04Cloud Infrastructure and Application Security
This domain tests the build-to-run path: hardened images, infrastructure as code, workload configuration, and pipeline integrity. Preventive controls act before deployment: approved base images, IaC scanning with policy-as-code for public buckets, open security groups, and unencrypted volumes, least-privilege pipeline identities, and signed artefacts.
268 words, about 1 min05Cloud Security Operations, Monitoring and Incident Response
This domain tests detection, evidence handling, and response in environments where hosts are disposable and the control plane is itself a target. Collect control-plane audit logs (who changed IAM, security groups, keys), data-plane access logs, VPC flow logs, DNS logs, WAF and load-balancer logs, and application logs.
327 words, about 2 min06Cloud Compliance, Risk and Vendor Management
This domain tests how you consume a vendor's assurance evidence, translate it into your own risk position, and keep it current. A certification is issued by an accredited body (ISO/IEC 27001, 27017, 27018).
322 words, about 2 min