Chapter 2 of 6 · ISC2 CCSP
Cloud Data Security
Data lifecycle, storage, encryption, masking and DLP, discovery, classification, IRM, retention, data events and AI data.
- 7topics
- 35 minfast track
- 2diagrams and exhibits
- 20%of the exam
Topics in this chapter
Take them in order, or jump to the one you need.
- 1Cloud Data Concepts and Storage ArchitecturesCCSP cloud data lifecycle phases, data dispersion and flows, and storage types: long-term, ephemeral, raw, object and volume…Diagram5 min
- 2Encryption, Hashing and Key ManagementCCSP data protection with encryption, envelope keys, hashing for integrity, digital signatures for non-repudiation, and keys…5 min
- 3Data Obfuscation, Tokenization and DLPCCSP data obfuscation: static and dynamic masking, anonymization and pseudonymization, tokenization with a vault, and cloud DLP…5 min
- 4Data Discovery and ClassificationCCSP data discovery of structured, unstructured and semi-structured data and its location, plus classification policies, data…5 min
- 5Information Rights ManagementCCSP information rights management: persistent data rights, provisioning, access models, certificate issuing and revocation, and…Diagram5 min
- 6Retention, Deletion, Archiving and Data EventsCCSP data retention, deletion, archiving and legal hold, plus data event sources, event attributes, log analysis, chain of…5 min
- 7Protecting AI and ML Data and ModelsCCSP protection of AI and ML data: data set and model privacy, inference and extraction risks, poisoning, and validating and…5 min
About this chapter
What this chapter covers
Cloud Data Security is 20% of the ISC2 CCSP exam, the largest domain. It is about protecting the asset the customer never stops being accountable for: its data, wherever the provider stores, copies or processes it.
The domain covers cloud data concepts such as lifecycle, dispersion and flows (2.1), storage architectures and their threats (2.2), data security technologies such as encryption, hashing, masking, tokenization and DLP (2.3), data discovery (2.4), classification (2.5), information rights management (2.6), retention, deletion and archiving with legal hold (2.7), auditability of data events (2.8) and protection of AI and ML data sets and models (2.9).
Questions usually describe a data type and a requirement, then ask for the BEST control. Many hinge on choosing between similar tools: tokenization or encryption, masking or anonymization, DLP or IRM.
How the topics fit together
You cannot protect data you have not found, and you cannot choose controls until you know how sensitive it is. Protection follows the classification, monitoring proves it works, and retention rules decide how long the data lives and how it is destroyed.
When two answers both protect the data, prefer the one that keeps working wherever the data goes. Encryption with customer controlled keys and IRM travel with the data; a perimeter control does not.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with tables and examples.
- What to remember for the exam: the facts to memorise and how questions are phrased.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
Ready for more practice?
The full ISC2 CCSP question bank has 900 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISC2. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.