Free study guide

ISC2 CCSP Study Guide

ISC2 Certified Cloud Security Professional (CCSP)

ISC2 CCSP is the cloud security certification for experienced IT and security professionals who design, manage and secure data, applications and infrastructure in the cloud. It covers six vendor-neutral domains, from cloud architecture and data security to security operations and legal, risk and compliance, and the outline effective 1 August 2026 adds AI and machine learning. The English exam is adaptive, with 100 to 150 items in three hours, and ISC2 requires five years of IT experience, including three in cybersecurity.

  • Exam code CCSP
  • 6 exam domains
  • 100 to 150 questions

This guide is free, with no sign-up. It explains every ISC2 CCSP exam topic in plain English, one chapter at a time. Read them in order or jump straight to the topic you need.

  • 6chapters
  • 35topics
  • 6diagrams and exhibits
  • 2 h 54 minfast track
Start with Cloud Concepts, Architecture and Design
  • Every topic follows the same simple pattern: what it is, how it works, common mistakes
  • Diagrams and real command output where a picture explains it best
  • Exam tips and worked subnetting and IPv6 practice, with answers

How the exam is weighted

Each domain is worth this share of the exam, so spend your study time in proportion. Select a domain to open its chapter.

Chapters

Open a chapter to see its topics and how long each takes.

1Cloud Concepts, Architecture and Design5 topics · 25 min fast trackCloud definitions, roles, reference architecture, security concepts, secure design, provider evaluation and AI in security.
  1. 1Cloud Computing Concepts and Reference Architecture5 min
  2. 2Shared Considerations and Evaluating Cloud Providers5 min
  3. 3Security Concepts for Cloud Computing5 min
  4. 4Design Principles of Secure Cloud Computing5 min
  5. 5AI, ML and Emerging Technologies in the Cloud5 min
Read the chapter overview →
2Cloud Data Security7 topics · 35 min fast trackData lifecycle, storage, encryption, masking and DLP, discovery, classification, IRM, retention, data events and AI data.
  1. 1Cloud Data Concepts and Storage Architectures5 min
  2. 2Encryption, Hashing and Key Management5 min
  3. 3Data Obfuscation, Tokenization and DLP5 min
  4. 4Data Discovery and Classification5 min
  5. 5Information Rights Management5 min
  6. 6Retention, Deletion, Archiving and Data Events5 min
  7. 7Protecting AI and ML Data and Models5 min
Read the chapter overview →
3Cloud Platform and Infrastructure Security5 topics · 25 min fast trackInfrastructure components, secure data center design, infrastructure risk, security controls, and cloud BC and DR planning.
  1. 1Cloud Infrastructure and Platform Components5 min
  2. 2Designing a Secure Data Center5 min
  3. 3Risks to Cloud Infrastructure and Platforms5 min
  4. 4Planning and Implementing Security Controls5 min
  5. 5Cloud Business Continuity and Disaster Recovery5 min
Read the chapter overview →
4Cloud Application Security6 topics · 30 min fast trackAppSec awareness, secure SDLC, threat modeling, testing and assurance, verified software, cloud app architecture and IAM.
  1. 1Training and Awareness for Application Security5 min
  2. 2The Secure SDLC and Threat Modeling5 min
  3. 3Cloud Software Assurance and Validation5 min
  4. 4Using Verified Secure Software5 min
  5. 5Cloud Application Architecture5 min
  6. 6Identity and Access Management Solutions5 min
Read the chapter overview →
5Cloud Security Operations6 topics · 29 min fast trackBuilding and running cloud infrastructure, operational standards, ITIL processes, forensics, communication and the SOC.
  1. 1Building Physical and Logical Cloud Infrastructure5 min
  2. 2Operating Access, Network and Host Security5 min
  3. 3Availability, Monitoring and Backup Operations5 min
  4. 4Operational Controls and Service Management5 min
  5. 5Supporting Digital Forensics in the Cloud5 min
  6. 6Security Operations, Incident Response and Communication4 min
Read the chapter overview →
6Legal, Risk and Compliance6 topics · 30 min fast trackCloud legal risks and eDiscovery, privacy laws and PIAs, cloud audits and SOC reports, enterprise risk, and cloud contracts.
  1. 1Legal Requirements and Unique Cloud Risks5 min
  2. 2Privacy Issues and Requirements5 min
  3. 3Cloud Audit Controls and Audit Reports5 min
  4. 4Audit Planning, ISMS and Specialized Compliance5 min
  5. 5Cloud and Enterprise Risk Management5 min
  6. 6Outsourcing and Cloud Contract Design5 min
Read the chapter overview →

Ready for more practice?

The full ISC2 CCSP question bank has 900 questions, with timed practice exams and an explanation for every answer.

SubscribeTry Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISC2. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.