Chapter 4 of 6 · ISC2 CCSP
Cloud Application Security
AppSec awareness, secure SDLC, threat modeling, testing and assurance, verified software, cloud app architecture and IAM.
- 6topics
- 30 minfast track
- 16%of the exam
Topics in this chapter
Take them in order, or jump to the one you need.
- 1Training and Awareness for Application SecurityCCSP AppSec awareness: cloud development basics, common pitfalls, and the OWASP Top 10, ASVS, API Security Top 10, LLM Top 10 and…5 min
- 2The Secure SDLC and Threat ModelingCCSP secure SDLC: business requirements, phases, waterfall vs agile, cloud risks, STRIDE, DREAD, ATASM and PASTA, secure coding…5 min
- 3Cloud Software Assurance and ValidationCCSP software assurance: functional and non-functional testing in CI/CD, black box and white box, SAST, DAST, IAST and SCA, QA…5 min
- 4Using Verified Secure SoftwareCCSP verified software: securing REST and SOAP APIs, supply-chain management for integrity, authenticity and licensing…5 min
- 5Cloud Application ArchitectureCCSP cloud app architecture: WAF, DAM, XML firewalls, API gateways and load balancers, cryptography, sandboxing, microservices…5 min
- 6Identity and Access Management SolutionsCCSP cloud IAM: federated identity with SAML, OAuth and OIDC, identity providers, SSO, MFA, CASB modes, and secrets, key and…5 min
About this chapter
What this chapter covers
Cloud Application Security is 16% of the ISC2 CCSP exam. It covers how applications built for or moved to the cloud are designed, coded, tested, assembled from third-party parts and protected in production, and how users and services prove who they are.
The domain covers training and awareness for application security, including the OWASP and SANS lists (4.1), the secure software development life cycle process (4.2) and how to apply it with threat modeling and secure coding (4.3), software assurance and validation testing (4.4), using verified secure software, APIs and supply chains (4.5), the specifics of cloud application architecture (4.6), and identity and access management solutions (4.7).
Questions favour the earliest, most systemic fix. Expect to choose the BEST phase to address a flaw, the RIGHT testing method for a situation, or the component that should handle a stated job.
How the topics fit together
Trained developers build security into each SDLC phase, testing proves it, and verified components keep the supply chain trustworthy. Architecture components and IAM protect the application once it runs in the cloud.
On application security questions, the best answer usually moves security earlier. Fixing a flaw in requirements or design is cheaper and more complete than catching it in testing, and far better than patching it in production.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with tables and examples.
- What to remember for the exam: the facts to memorise and how questions are phrased.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
Ready for more practice?
The full ISC2 CCSP question bank has 900 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISC2. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.