Passed Official CCSP Exam: Certified Cloud Security Professional By @ISC2

I am pleased and honored to be interviewed by PSYND to share my experience in preparing for and passing the official CCSP Exam — Certified Cloud Security Professional by (ISC)². Check the video to learn more.

Updated – 18/08/2023 – The International Information System Security Certification Consortium (ISC)² becomes ISC2. This is more than a logo change, read the announcement (Cybersecurity Is Evolving. So Are We.)

Companies continue to rapidly migrate workloads from data centers to the cloud, utilizing new technologies such as serverless, containers, and machine learning to benefit from increased efficiency, better scalability, and faster deployments from cloud computing. Cloud security concerns remain high as the adoption of public cloud computing continues to surge, especially in the wake of the 2020 COVID crisis and the resulting accelerated shift to remote work environments. For more information about cloud security concerns, I highly encourage you to read the latest Cloud Security Report published by Cybersecurity Insiders, and the Impact of COVID-19 on Enterprise IT Security Teams Report sponsored by (ISC)².

In this article, we will share with you how to prepare and pass the Certified Cloud Security Professional (CCSP) exam by (ISC)² successfully.

Introduction

Information Security (IS) is currently making a profound contribution to business development by ensuring not only reliable operations but also new opportunities for qualitative differentiation. It is increasingly seen as a value creator or facilitator of operations in new business models.

As the cloud comes into the picture, this raises new questions for the board of directors, is our data secure up there? do we have control? I heard that if we move to the cloud we are secure, is that true? What about privacy, compliance, and data regulation? Cloud security is a shared responsibility, what does that mean? the list of questions goes on and on… For this reason, it is imperative that before adopting cloud computing, organizations must first understand the security considerations that the cloud computing model inherits. These considerations must be revised before starting — ideally during the planning process.

Security in the realm of information technology has been fascinating to me for a long time. After passing the Swiss federal exam as an ICT Security Expert with an academic diploma, I decided to gain more experience with Cloud Security.

Starting this journey, I decided to go with neutral vendor certifications for Cloud Security which are the Certificate of Cloud Security Knowledge (CCSK) by Cloud Security Alliance (CSA), and the Certified Cloud Security Professional (CCSP) certification by the International Information System Security Certification Consortium (ISC)². I believe in vendor-neutral certifications, and I don’t trust marketing. The good news is, that the knowledge that you acquire by attaining any of these certifications will help you to apply and secure your cloud workloads whether they’re running on Microsoft Azure, Google GCP, or Amazon AWS.

After 6 months of intense preparation, I am so happy and grateful now that I passed the CCSP exam on the first attempt. In this article, I will share with you how to prepare and pass the Certified Cloud Security Professional (CCSP) exam by (ISC)² successfully.

About the CCSP Certification

The CCSP is the premier cloud security certification from (ISC)². This vendor-neutral certification validates IT and information security professionals’ knowledge and competency to apply best practices to cloud security architecture, design, operations, and service orchestration. It shows you are at the forefront of cloud security.

(ISC)² is a global nonprofit organization that maintains the Common Body of Knowledge (CBK) for information security professionals. The CCSP certification was first released back in 2015 and requires 5 years of experience in IT. CCSP is harder compared to CCSK, so if you want to follow this path, I recommend you to start first with CCSK and then with CCSP because by attaining the CCSK certification, you can request a one-year experience waiver by submitting documentation of your Cloud Security Alliance CCSK certificate to (ISC)² towards earning your CCSP certification. If you are interested to learn more about the CCSK and how to prepare and pass the exam, I highly encourage you to check my previous guide here.

The big difference between both certifications is the following: CCSK does not require collecting continuing professional education (CPE) points to keep your certification active, and you don’t have to pay renewal/membership fees as required for CCSP ($125/year, 90 CPE/3 years). If you are interested to have more details about both CCSK and CCSP, then I highly recommend checking the comparison article details here.

The Payment of Membership Fees ($125) for CCSP/CISSP is required at the beginning of each year of your 3 years certification cycle. The certification cycle is 3 years. The certification cycle does not run on a calendar year from January to December. It is based on when you earned your first certification. For example, if you got certified for CCSP on 15/03/2018, you will have a 3 years certification cycle that runs like this:

• Year 1) April 01, 2018, to March 31, 2019
• Year 2) April 01, 2019, to March 31, 2020
• Year 3) April 01, 2020, to March 31, 2021

Required Experience

The experience required for the CCSP credential is summarized below:

> Associate of (ISC)² – If you do not yet possess the professional experience required for certification, you can request to be an Associate of (ISC)². You are only required to pass the credential examination.

> CCSP – A minimum of five years of cumulative work experience in information technology, of which three years must be in information security and one year must be in one of the six (6) domains of the (ISC)² CCSP CBK®. Alternatively as mentioned above, a Cloud Security Alliance CCSK certificate may be substituted for one year of experience, or having the CISSP credential may be substituted for the entire CCSP experience requirement.

• Part-time experience cannot be less than 20 hours a week and no more than 34 hours a week.
• 1040 hours of part-time = 6 months of full-time experience
• 2080 hours of part-time = 12 months of full-time experience
• Internship: Paid or unpaid internship is acceptable. You will need documentation on company/organization letterhead confirming the applicant’s position as an intern. If they are interning at a school, the document can be on the registrar’s stationery. Interns may be gaining valuable experience without monetary compensation.

CCSP exam overview

In this exam, you will receive 125 multiple-choice questions, and the total time for this exam is 180 minutes (3 hours), so you might think that you have enough time to finish it. However, this is not the case, the exam is very tough! I finished the exam in 2h.50min to go quietly over all the 125 questions. The minimum passing score for this exam is 700 out of 1,000, so you should answer at least 88 questions right to pass it.

Updated – 02/01/2023 – The new CCSP exam pattern has 150 multiple-choice questions and the duration of the exam is 4 hours.

The exam price cost is €555, equivalent to $599, or 600 Swiss francs. If you don’t pass the exam on your first attempt, you may retest after 30 test-free days. If you don’t pass the exam on your second attempt, you may retest after 60 test-free days from your most recent exam attempt. If you don’t pass the exam on your third attempt and for all subsequent retakes, you may retest after 90 test-free days from your most recent exam attempt.

Updated – 13/04/2023 – (ISC)² is changing how you register for any (ISC)² exam. Instead of registering on the Pearson Vue website, you now start the registration on the (ISC)² website and once your profile is created, then you are redirected to Pearson Vue.

(ISC)² is also offering another round of their “Exam Peace of mind” protection, which you can retake if you fail your exam for a reduced fee (you pay before the 1st try).

• Pay for the exam + the retake before April 30th, take the first exam before May 15th, 2023, and retake before July 15th, 2023 if you fail the first try.
• You need to pay $199 extra for any other (ISC)² exam except the SSCP which is $79.
• The CC – Certified in Cybersecurity is not part of the offer.

I highly recommend preparing very well before taking the real exam!!!

Exam Objectives

After completing the CCSP preparation and passing the exam, you will be able to:

• Understand the legal frameworks and guidelines that affect cloud services.
• Recognize the fundamentals of data privacy regulatory/legislative mandates.
• Assess risks, vulnerabilities, threats, and attacks in the cloud environment.
• Evaluate the design and plan for cloud infrastructure security controls.
• Evaluate what is necessary to manage security operations.
• Understand what operational controls and standards to implement.
• Describe the types of cloud deployment models in the types of “as a service” cloud models currently available today.
• Identify key terminology and associated definitions related to cloud technology. Be able to establish a common terminology for use within your team or workgroup.
• Build a business case for cloud adoption and be able to determine with business units the benefits of the cloud and cloud migration strategies.

Skills measured on this exam

This exam measures your ability to know and understand the 6 domains listed below based on the latest updates from the (ISC)² CCSP, Common Body of Knowledge (4th Edition).

Below is the information that how I received the examination questions across these domains, but of course, this may vary slightly case by case. The questions do pretty much match the list of domains and skills measured below with their weights:

DOMAIN 1: Cloud Concepts, Architecture, and Design (17%)

• Understand Cloud Computing Concepts
• Describe Cloud Reference Architecture
• Understand Security Concepts Relevant to Cloud Computing
• Understand the Design Principles of Secure Cloud Computing
• Evaluate Cloud Service Providers

DOMAIN 2: Cloud Governance – Legal, Risk, and Compliance (13%)

• Articulate Legal Requirements and Unique Risks Within the Cloud Environment
• Support Digital Forensics
• Understand Privacy Issues
• Understand Audit Processes, Methodologies, and Required Adaptations for a Cloud Environment
• Understand the Implications of Cloud to Enterprise Risk Management
• Understand Outsourcing and Cloud Contract Design

DOMAIN 3: Cloud Data Security (19%)

• Cloud Data Security Concepts
• Design and Implement Cloud Data Storage Architectures
• Design and Apply Data Security Technologies and Strategies
• Cryptography
• Understand and Implement Data Discovery and Classification Technologies
• Design and Implement Information Rights Management (IRM)
• Plan and Implement Data Retention, Deletion, and Archival Policies
• Design and Implement Auditability, Traceability, and Accountability of Data Events

DOMAIN 4: Cloud Platform and Infrastructure Security (17%)

• Comprehend Cloud Infrastructure Components
• Secure Cloud Data Center Design
• Analyze Risks Associated with Cloud Infrastructure
• Design and Plan Security Controls for Physical and Logical Cloud Infrastructure
• Design Appropriate Identity and Access Management (IAM) Solutions
• Plan Disaster Recovery (DR) and Business Continuity (BC)

DOMAIN 5: Cloud Application Security (17%)

• Discuss Training and Awareness for Application Security
• Describe the Secure Software Development Lifecycle (SDLC) Process
• Apply the Secure Software Development Lifecycle (SDLC)
• Apply Cloud Software Assurance and Validation
• Use Verified Secure Software
• Explain the Specifics of a Cloud Application Architecture

DOMAIN 6: Cloud Security Operations (17%)

• Operate and Manage Physical and Logical Infrastructure for Cloud Environment
• Implement Operational Controls and Standards
• Manage Communication with Relevant Parties
• Manage Security Operations

Exam Target Audience

The CCSP is intended for experienced cloud security professionals looking to validate their knowledge and background. As you can see from the domains listed above, there are technical and non-technical elements that are examined. CCSP is considered a top-tier certification by most in the industry, so it will usually attract security engineers and architects, as well as security managers and security officers.

Lessons Learned and Exam Preparation

To prepare and pass this exam successfully on the first attempt, I highly recommend the following approach based on my experience in passing this exam.

Instructor-led training

The first choice that I highly recommend is to get instructor-led training if possible, you can find the list of all (ISC)² partners here.

If you are based in Switzerland, then I highly recommend getting in contact with PSYND here, the only (ISC)² official academy in Switzerland. They prepare the experts of tomorrow to achieve their CISSP and CCSP certifications.

I started by taking the instructor-led training with PSYND and then worked over the self-study resources noted below to complement my knowledge.

Self-Paced training

If you prefer self-study training, then you can choose one of the premium quality resources listed in the section below:

CCSP on Cybrary

Cybrary Learning offers the following complete CCSP preparation course over 12 hours:

• Certified Cloud Security Professional (CCSP)

CCSP on LinkedIn Learning

LinkedIn Learning offers the following complete CCSP certification preparation course over 14 hours:

• CCSP Cert Prep 1: Cloud Concepts Architecture and Design
• CCSP Cert Prep 2: Cloud Data Security
• CCSP Cert Prep 3: Cloud Platform and Infrastructure Security
• CCSP Cert Prep 4: Cloud Application Security
• CCSP Cert Prep 5: Cloud Security Operations
• CCSP Cert Prep 6: Legal Risk and Compliance

CCSP on Pluralsight

Pluralsight offers the following complete CCSP certification preparation course:

• CCSP: Cloud Architecture and Concepts
• CCSP: Cloud Data and Security Lifecycle
• CCSP: Cloud Platform Security
• CCSP: Cloud Application and Security Components
• CCSP: Cloud Security Operations Controls
• CCSP: Cloud Risk and Compliance
• CCSP: Cloud Governance, Data Privacy, and Audit
• CCSP: Cloud Infrastructure Security
• CCSP: Cloud Physical and Logical Infrastructure

CCSP on (ISC)²

(ISC)² offers online self-paced training which is a great companion to prepare you for the CCSP exam.

• Official (ISC)² CCSP Self-Paced Training (180 days access).
• Official CCSP Flash Cards.

Tools you will need

In addition to all the resources and the preparation that I mentioned above, you also need some additional materials you want to be familiar with. There is no magic formula for passing this exam, and no single particular book or source with all the answers to the exam exists. I recommend the following professional resources that you should be familiar with while preparing for this exam. You can download them for free:

• The Cloud Security Alliance’s Notorious Nine.
• The OWASP’s Top 10 – 2017.
• The OWASP’s XSS (Cross-Site Scripting) Prevention Cheat Sheet.
• The OWASP’s Testing Guide (v4.1).
• The OWASP Top 10 Proactive Controls v3.0.
• NIST SP 500-292, NIST Cloud Computing Reference Architecture.
• The CSA’s Security Guidance v4.0.
• ENISA’s Cloud Computing Risk Assessment.
• The Uptime Institute’s Tier Standard: Tier Standard and Topology – Operational Sustainability. The link page includes download options for the documents.
• The ultimate guide to the CCSP. Be a leader in the field of Cloud Security.

Books

I highly recommend getting the following books to supplement your knowledge and help you prepare for this exam:

• CCSP Certified Cloud Security Professional All-in-One Exam Guide, Third Edition.
• (ISC)² CCSP Certified Cloud Security Professional Official Practice Tests, 2nd Edition.
• (ISC)² CCSP Certified Cloud Security Professional Official Practice Tests, 3rd Edition. This is for the new CCSP exam objectives practice test effective from 2022-2025.
• (ISC)² CCSP Certified Cloud Security Professional Official Study Guide, 2nd Edition.
• (ISC)² CCSP Certified Cloud Security Professional Official Study Guide, 3rd Edition. This is for the new CCSP exam objectives study guide effective from 2022-2025.
• (ISC)² CCSP Common Body of Knowledge (CBK), 3rd Edition.
• (ISC)² CCSP Common Body of Knowledge (CBK), 4th Edition. The Official (ISC)² CCSP CBK Reference effective from 2022-2025, 4th Edition is the authoritative, vendor-neutral common body of knowledge for cloud security professionals.
• CCSP for Dummies with Online Practice.

Practice Test

I highly recommend practicing a large number of questions to get a sense of how the questions might show up during the actual exam. I practiced more than 2,000 questions. Here is the list of exam practice resources that I used to prepare for this exam:

• Official CCSP Study App. This study app is based on the Official CCSP Study Guide and includes flashcards, study questions, and practice tests – covering all of the domains in the CCSP CBK.
• (ISC)² CCSP Certified Cloud Security Professional Official Practice Tests, 3rd Edition. With over 1,000 practice questions, this book allows you to test your level of understanding and gauge your readiness for the Certified Cloud Security Professional (CCSP) exam long before the big day.

Certificate

As soon as you submit your exam and pass it, you will receive provisional examination results with the following message:

Congratulations! We are pleased to inform you that you have provisionally passed the Certified Cloud Security Professional (CCSP®) examination. By passing this examination, you have completed the first of two steps toward earning your CCSP credential!

The next step is to complete the endorsement process, which you should do within nine (9) months of your passing exam date. If you currently possess the number of years of experience you need, you are ready to submit your online endorsement application here.

Once the endorsement process is complete, you will earn your CCSP certification. You will get notified and receive via mail your membership package which will contain your credential certificate, member ID card, welcome letter, and CCSP lapel pin.

Please note that the endorsement process may take up to four (4) to six (6) weeks to complete.

Once your endorsement application has been approved by (ISC)². You’re now one step closer to certification. You will receive an email with the instructions to pay your first Annual Maintenance Fees (AMFs) of $125 to complete your membership. AMFs are used by (ISC)² to support the costs of maintaining the (ISC)² certifications and related support systems. Certified members and Associates of (ISC)² also gain access to a wide array of valuable, rewarding professional development opportunities and member benefits that deliver a robust return on this annual investment. Please check the official page to learn more about AMFs.

Once you have paid the Annual Maintenance Fee (AMF), you will receive a welcome email to (ISC)².

Dear member,

Congratulations! Based on your examination results, application review and acceptance of your endorsement, the (ISC)² Board of Directors has awarded you the CCSP certification.

Your welcome kit (ID card and certificate) will be shipped to your address within 8 – 12 weeks.

You will also receive your Acclaim Badge link to your primary email address within 2 weeks of full membership. Read more about (ISC)² digital badges from Acclaim here.

Next Steps

Certification is just the beginning… To maintain your certification, you should continue your professional education (CPE).

These CPE activities must be completed during your certification cycle which starts on the first day of the month after you receive the welcome email. For example, if you receive the welcome email on April 15th, your certification cycle start date will be May 1st. You may not claim CPE credits for activities that occurred before your certification cycle start date.

If you want to learn more about Continuing Professional Education (CPE), then I highly recommend you to download and read the (ISC)² Continuing Professional Education (CPE) Handbook here, as well as download the complete guide to Continuing Professional Education (CPE) from here.

Continue your professional growth

As an (ISC)² member, you have access to a growing array of enriching CPE opportunities from the Professional Development Institute. If you are already an (ISC)² member, I highly encourage you to check the Professional Development Institute (PDI).

The Professional Development Institute (PDI) is your go-to resource for timely and relevant continuing education opportunities to help keep your skills sharp and your curiosity piqued. Each course is designed with input from leading industry experts and based on proven learning techniques. And best of all, these courses are free to members and count for CPE credits.

Last but not least, I highly encourage you to connect with cybersecurity professionals in your community by joining a local (ISC)² Chapter. If you are based in Switzerland, then you might be interested to join the (ISC)² local chapter here. You can Network with peers and experts in the industry while learning about hot topics and earning valuable CPEs. Locate an (ISC)² Chapter near you by visiting the (ISC)² Chapter Directory or start a chapter if none exists in your area.

CCSP Exam Update 2022

On August 1, 2022, several changes will be made to the CCSP exam as announced by (ISC)² in early May 2022.

The CCSP exam will be available in four more languages. Currently, the CCSP exam is available in English and Japanese. They will also be offering the CCSP exam in Chinese, Korean, German, and Spanish beginning in August 2022.

In addition to these new languages, they will be updating the length of the CCSP exam. As they announced earlier this year for the CISSP exam, 25 pretests (unscored) items will be added to the exams in all languages. These items do not impact the pass/fail result of a candidate’s exam, but they are indistinguishable from operational (scored) items, so if you’re taking the exam, you should consider each item carefully and select the best possible answer. To allow candidates sufficient time to answer all items, the time limit for the CCSP exam is increased from three to four hours.

Lastly, as announced in late December 2021, the CCSP exam content will be refreshed on August 1st, 2022. Specifically, Domain 2: Cloud Data Security will increase from 19% to 20%, and Domain 5: Cloud Security Operations will decrease from 17% to 16%.

You can find the August 1, 2022 version of the CCSP Exam Outline here (Certification Exam Outline effective August 1, 2022) with additional languages coming soon to the CCSP Exam.

Summary

The CCSP credential has emerged as an industry standard for advanced cloud security practitioners looking to validate their skills and enhance their careers. Please note that this is NOT a beginner’s certification. You must demonstrate 5 years of experience and a deep understanding of the domains presented in the Common Body of Knowledge (CBK). If this sounds like something that could elevate your career, then this may be the credential that you want to pursue.

If you are planning to take the CCSP exam… I wish you all the best and Happy Studying!!!

__
Thank you for reading my blog.

If you have any questions or feedback, please leave a comment.

-Charbel Nemnom-