There is no magic formula for passing the Certified Cloud Security Professional (CCSP) certification exam, just as there is no single source that will prepare you sufficiently to pass the actual test. You can, however, prepare yourself for the challenge. This book is all about preparation.
We’ve included more than 1,000 questions related to the CCSP material in this book, which also includes access to the online databank (the same questions but in a point-and-click format). They were created in accordance with the (ISC)2 CCSP Common Body of Knowledge (CBK), the CCSP Training Guide, the Official CCSP Study Guide, Second Edition, and the CCSP Exam Outline, which is also referred to as the CCSP Exam Outline (www.isc2.org/-/media/ISC2/Certifications/Exam-Outlines/ CCSP-Exam-Outline.ashx), which lists all the elements of practice that the candidate is expected to know for the certification.
The questions in this book are not necessarily indicative of what you’ll see on the actual CCSP exam. Instead, these questions are intended for study purposes, to help you review and understand the concepts that you may be tested on when you take the certification exam. Be aware that some of these questions may be easier, and some may be harder, than what you’ll be faced with if you try to become a CCSP.
How This Book Is Organized
The questions have been arranged in the order of the CBK, with varying amounts in proportion to the (ISC)2 published matrix describing how the exam is constructed, as shown in Table I.1.
There are six chapters, one for each of the CBK domains; each chapter contains a fraction of the hundreds of practice questions, reflecting the questions from the respective domain on the exam (for example, Chapter 1 reflects Domain 1 of the CBK and has over 100 questions). There are also two full-length practice exams, 125 questions each, at the end of the book (Chapters 7 and 8).
Who Should Read This Book
This book is intended for CCSP candidates. To earn the CCSP, you are expected to have professional experience in the field of information security/IT security, particularly experience related to cloud computing. Candidates will also need to provide evidence of their professional experience to (ISC)2 in the event of passing the exam.
The author has drawn on his own experience studying for and passing the exam as well as years of teaching the Certified Information Systems Security Professional (CISSP) and CCSP preparation courses for (ISC)2. He also solicited feedback from colleagues and former students who have taken the prep course and the exam. The book should reflect the breadth and depth of question content you are likely to see on the exam. Some of the questions in this book are easier than what you will see on the exam; some of them may be harder. Hopefully, the book will prepare you for what you might encounter when you take the test.
The one thing I chose not to simulate in the book is the “interactive” questions; (ISC)2 has stated that the current tests may go beyond the regular multiple-choice format and could include “matching” questions (a list of multiple answers and multiple terms, where the candidate has to arrange them all in order), drag-and-drop questions (where the candidate uses the mouse to arrange items on the screen), and “hot spot” questions (where the candidate uses the mouse to point at specific areas of the screen to indicate an answer). There will probably not be many of these on the exam you take, but they are weighted more in your score than the multiple-choice questions, so pay attention and be extra careful answering those.
Tools You Will Need
In addition to this book, I recommend the CCSP (ISC)2Certified Cloud Security Professional Official Study Guide, Second Edition, also from Wiley (2019). There is, as stated in this introduction, no magic formula for passing the exam. No single particular book or source with all the answers to the exam exists. If someone claims to be able to provide you with such a product, realize that they are mistaken or, worse, misleading you.
However, you can augment your studying by reviewing a significant portion of the likely sources used by the professionals who created the test. The following is a just a sampling of the possible professional resources the cloud practitioner should be familiar with:
The Uptime Institute’s Tier Standard: Topology and Tier Standard: Operational Sustainability (the linked page includes download options for the documents)
1.2.5 Cloud shared considerations (e.g., interoperability, portability, reversibility, availability, security, privacy, resiliency, performance, governance, maintenance and versioning, service levels and Service Level Agreements (SLA), auditability, regulatory)
1.2.6 Impact of related technologies (e.g., machine learning, artificial intelligence, blockchain, Internet of Things (IoT), containers, quantum computing)
1.3 Understand security concepts relevant to cloud computing
1.3.1 Cryptography and key management
1.3.2 Access control
1.3.3 Data and media sanitization (e.g., overwriting, cryptographic erase)
1.4.5 Security considerations for different cloud categories (e.g., Software as a Service (SaaS), Infrastructure as a Service (IaaS), Platform as a Service (PaaS))
1.5 Evaluate cloud service providers
1.5.1 Verification against criteria (e.g., International Organization for Standardization/International Electrotechnical Commission (ISO/IEC) 27017, Payment Card Industry Data Security Standard (PCI DSS))
1.5.2 System/subsystem product certifications (e.g., Common Criteria (CC), Federal Information Processing Standard (FIPS) 140-2)
Domain 2 Cloud Data Security
2.1 Describe cloud data concepts
2.1.1 Cloud data lifecycle phases
2.1.2 Data dispersion
2.2 Design and implement cloud data storage architectures
2.2.1 Storage types (e.g. long term, ephemeral, raw-disk)
2.2.2 Threats to storage types
2.3 Design and apply data security technologies and strategies
2.3.1 Encryption and key management
2.3.2 Hashing
2.3.3 Masking
2.3.4 Tokenization
2.3.5 Data Loss Prevention (DLP)
2.3.6 Data obfuscation
2.3.7 Data de-identification (e.g., anonymization)
2.4 Implement data discovery
2.4.1 Structured data
2.4.2 Unstructured data
2.5 Implement data classification
2.5.1 Mapping
2.5.2 Labeling
2.5.3 Sensitive data (e.g., Protected Health Information (PHI), Personally Identifiable Information (PII), card holder data)
2.6 Design and implement Information Rights Management (IRM)
2.6.1 Objectives (e.g., data rights, provisioning, access models)
2.6.2 Appropriate tools (e.g., issuing and revocation of certificates)
2.7 Plan and implement data retention, deletion, and archiving policies
2.7.1 Data retention policies
2.7.2 Data deletion procedures and mechanisms
2.7.3 Data archiving procedures and mechanisms
2.7.4 Legal hold
2.8 Design and implement auditability, traceability, and accountability of data events
2.8.1 Definition of event sources and requirement of identity attribution
2.8.2 Logging, storage, and analysis of data events
2.8.3 Chain of custody and non-repudiation
Domain 3 Cloud Platform and Infrastructure Security
4.6.4 Application virtualization and orchestration
4.7 Design appropriate Identity and Access Management (IAM) solutions
4.7.1 Federated identity
4.7.2 Identity providers
4.7.3 Single Sign-On (SSO)
4.7.4 Multi-factor authentication
4.7.5 Cloud Access Security Broker (CASB)
Domain 5 Cloud Security Operations
5.1 Implement and build physical and logical infrastructure for cloud environment
5.1.1 Hardware-specific security configuration requirements (e.g., Basic Input Output System (BIOS) settings for virtualization and Trusted Platform Module (TPM), storage controllers, network controllers)
5.1.2 Installation and configuration of virtualization management tools
5.1.3 Virtual hardware-specific security configuration requirements (e.g., network, storage, memory, Central Processing Unit (CPU))
5.1.4 Installation of guest Operating System (OS) virtualization toolsets
5.2 Operate physical and logical infrastructure for cloud environment
5.2.1 Configure access control for local and remote access (e.g., Secure Keyboard Video Mouse (KVM), Console-based access mechanisms, Remote Desktop Protocol (RDP))
5.2.2 Secure network configuration (e.g., Virtual Local Area Networks (VLAN), Transport Layer Security (TLS), Dynamic Host Configuration Protocol (DHCP), Domain Name System (DNS), Virtual Private Network (VPN))
5.2.3 Operating System (OS) hardening through the application of baselines (e.g., Windows, Linux, VMware)
5.2.4 Availability of stand-alone hosts
5.2.5 Availability of clustered hosts (e.g., Distributed Resource Scheduling (DRS), Dynamic Optimization (DO), storage clusters, maintenance mode, high availability)
5.2.6 Availability of guest Operating System (OS)
5.3 Manage physical and logical infrastructure for cloud environment
5.4 Implement operational controls and standards (e.g., Information Technology Infrastructure Library (ITIL), International Organization for Standardization/International Electrotechnical Commission (ISO/IEC) 20000-1)
5.4.1 Change management
5.4.2 Continuity management
5.4.3 Information security management
5.4.4 Continual service improvement management
5.4.5 Incident management
5.4.6 Problem management
5.4.7 Release management
5.4.8 Deployment management
5.4.9 Configuration management
5.4.10 Service level management
5.4.11 Availability management
5.4.12 Capacity management
5.5 Support digital forensics
5.5.1 Forensic data collection methodologies
5.5.2 Evidence management
5.5.3 Collect, acquire, and preserve digital evidence
5.6 Manage communication with relevant parties
5.6.1 Vendors
5.6.2 Customers
5.6.3 Partners
5.6.4 Regulators
5.6.5 Other stakeholders
5.7 Manage security operations
5.7.1 Security Operations Center (SOC)
5.7.2 Monitoring of security controls (e.g., firewalls, Intrusion Detection Systems (IDS), Intrusion Prevention Systems (IPS), honeypots, vulnerability assessments, network security groups)
5.7.3 Log capture and analysis (e.g., Security Information and Event Management (SIEM), log management)
5.7.4 Incident management
Domain 6 Legal, Risk, and Compliance
6.1 Articulate legal requirements and unique risks within the cloud environment
6.1.1 Conflicting international legislation
6.1.2 Evaluation of legal risks specific to cloud computing
6.1.3 Legal frameworks and guidelines
6.1.4 eDiscovery (e.g., International Organization for Standardization/International Electrotechnical Commission (ISO/IEC) 27050, Cloud Security Alliance (CSA) Guidance)
6.1.5 Forensics requirements
6.2 Understand privacy issues
6.2.1 Difference between contractual and regulated private data (e.g., Protected Health Information (PHI), Personally Identifiable Information (PII))
6.2.2 Country-specific legislation related to private data (e.g., Protected Health Information (PHI), Personally Identifiable Information (PII))
6.2.3 Jurisdictional differences in data privacy
6.2.4 Standard privacy requirements (e.g., International Organization for Standardization/International Electrotechnical Commission (ISO/IEC) 27018, Generally Accepted Privacy Principles (GAPP), General Data Protection Regulation (GDPR))
6.3 Understand audit process, methodologies, and required adaptations for a cloud environment
6.3.1 Internal and external audit controls
6.3.2 Impact of audit requirements
6.3.3 Identify assurance challenges of virtualization and cloud
6.3.4 Types of audit reports (e.g., Statement on Standards for Attestation Engagements (SSAE), Security Operations Center
(SOC), International Standard on Assurance Engagements (ISAE))
6.3.5 Restrictions of audit scope statements (e.g., Statement on Standards for Attestation Engagements (SSAE), International Standard on Assurance Engagements (ISAE))
6.3.6 Gap analysis
6.3.7 Audit planning
6.3.8 Internal Information Security Management System (ISMS)
6.3.9 Internal information security controls system
6.3.11 Identification and involvement of relevant stakeholders
6.3.12 Specialized compliance requirements for highly-regulated industries (e.g., North American Electric Reliability Corporation/Critical Infrastructure Protection (NERC/CIP), Health Insurance Portability and Accountability Act (HIPAA), Payment Card Industry (PCI))
6.3.13 Impact of distributed Information Technology (IT) model (e.g., diverse geographical locations and crossing over legal jurisdictions)
6.4 Understand implications of cloud to enterprise risk management
6.4.7 Assessment of risk environment (e.g., service, vendor, infrastructure)
6.5 Understand outsourcing and cloud contract design
6.5.1 Business requirements (e.g., Service Level Agreement (SLA), Master Service Agreement (MSA), Statement of Work (SOW))
6.5.2 Vendor management
6.5.3 Contract management (e.g., right to audit, metrics, definitions, termination, litigation, assurance, compliance, access to cloud/data, cyber risk insurance)
6.5.4 Supply-chain management (e.g., International Organization for Standardization/International Electrotechnical Commission (ISO/IEC) 27036)
Online Test Bank
To practice in an online testing setting of the same questions, visit www.wiley.com/go/ sybextestprep and register your book to get access to the Sybex Test Platform. Online, you can mix questions from the domain chapters and practice exams, take timed tests, and have your answers scored.
As you go through the questions in this book, please remember the abbreviation RTFQ, which is short for “read the full question.” There is no better advice you can possibly receive than this. Read every word of every question. Read every possible answer before selecting the one you like. The exam is 125 questions over three hours. You have more than enough time to consider each question thoroughly. There is no cause for hurry. Make sure you understand what the question is asking before responding.
Good luck on the exam. I’m hoping this book helps you pass.
