Certified Cloud Security Analyst study plan

Define the core cloud security principles (least privilege, defense in depth, separation of duties, secure by design) and map each to at least one real cloud control.

Compare the major cloud governance frameworks (NIST CSF, ISO/IEC 27017, CSA CCM) and identify which controls are shared across them.

Draft a one-page cloud security policy outline covering data classification, access control, and logging retention.

Explain the difference between cloud security posture management and cloud workload protection in your own words.

Diagram the shared responsibility model for IaaS, PaaS, and SaaS, labeling who owns each layer (data, identity, application, OS, network, physical).

Identify three common customer-side misconfigurations that arise from shared responsibility confusion and describe the corresponding control.

Compare public, private, hybrid, and multi-cloud deployment models on security trade-offs and governance complexity.

Explain how the shared responsibility model changes when using serverless and container services.

Implement least-privilege access using role-based and attribute-based policies in a cloud environment, and validate with an access review.

Configure multi-factor authentication and conditional access for a test tenant, then document the policy logic.

Describe encryption at rest and in transit, including key management options (customer-managed vs. provider-managed keys) and their trade-offs.

Classify data by sensitivity and apply a matching protection profile (encryption, tokenization, access logging).

Harden a cloud network baseline: security groups, network ACLs, private endpoints, and egress filtering, and document the rationale for each rule.

Deploy a workload with secure configuration (no public storage, patched image, logging enabled) and capture the before/after configuration.

Explain how infrastructure-as-code scanning and container image scanning fit into a secure SDLC.

Identify the top five OWASP cloud-native application risks and one mitigation for each.

Configure centralized logging and metric alerts for at least three security-relevant events (privilege escalation, public bucket creation, failed MFA).

Build a simple incident response runbook for a suspected compromised access key, including containment, eradication, and recovery steps.

Differentiate between CSPM, CWPP, and SIEM findings and describe how each feeds an incident workflow.

Practice triaging a simulated alert and record the timeline and decisions.

Conduct a threat model for a simple three-tier cloud application using STRIDE and list at least six threats with controls.

Explain how vulnerability management, patch management, and configuration drift detection work together in cloud operations.

Describe the role of cloud access security brokers and secure web gateways in protecting SaaS usage.

Draft a post-incident review template that captures root cause, impact, and corrective actions.

Map the organization's cloud controls to at least three compliance frameworks (e.g., SOC 2, ISO 27001, GDPR) and identify gaps.

Evaluate a cloud vendor's security posture using a questionnaire and a shared responsibility assessment.

Describe the risk management process for cloud: risk identification, assessment, treatment, and acceptance.

Explain data residency, data sovereignty, and cross-border transfer considerations for cloud workloads.

Review all domain notes and condense them into a one-page cheat sheet per domain.

Complete a timed 60-question practice set and score at least 80% overall with no domain below 70%.

Revisit the three weakest objectives identified by practice results and write a short correction note for each.

Explain the shared responsibility model and least privilege to a non-technical stakeholder in under five minutes.