CCSK v5 Study Guide: Domains, Exam Format and a 6-Week Plan
· Updated · cloud security certification
The Certificate of Cloud Security Knowledge (CCSK) from the Cloud Security Alliance (CSA) is a vendor-neutral certificate covering how to secure workloads, data, and identities in any cloud. Version 5 reorganised the content into 12 domains and added AI, Zero Trust, DevSecOps, and cloud telemetry. This guide covers the exam format, what each domain expects you to understand, how to use the open-book format well, and a realistic six-week plan.
CCSK exam at a glance
| Item | Detail (per CSA's CCSK page) |
|---|---|
| Format | Online, open book |
| Questions | 60 multiple-choice, randomly selected from a larger pool |
| Time limit | 120 minutes |
| Passing score | 80% minimum |
| Price | USD 445 for the exam, including two attempts to be used within two years |
| Prerequisites | None required. Basic knowledge of firewalls, encryption, secure development, and IAM is recommended |
| Source material | CSA Security Guidance v5 and the free CCSK v5 Prep Kit |
Always confirm the current format, price, and attempt rules on the official CSA CCSK page before you buy, because CSA can update them.
What changed in CCSK v5
- 12 domains instead of 14, with related topics grouped more tightly.
- More workload and application depth: serverless/FaaS, CI/CD, DevSecOps, and automation.
- New material: AI and generative AI, Zero Trust across the domains, data lakes, and cloud telemetry.
- Removed or reduced: detailed laws and regulations coverage, and Security as a Service as a separate topic.
If you are using older v4 notes or courses, re-check them against v5. Questions about Security as a Service or IoT/mobile as a standalone domain come from the old syllabus.
The 12 CCSK v5 domains and what to master
1. Cloud Computing Concepts and Architectures
Know the NIST essential characteristics, service models (IaaS, PaaS, SaaS), and deployment models. Above all, know how the shared responsibility model shifts between them. Learn CSA's logical model: infrastructure, metastructure (the management plane), applistructure, and infostructure. Many questions test whether a control belongs to the provider or the customer.
2. Cloud Governance
Governance sets policy and accountability; security controls implement it. Understand how contracts, provider assessments, and frameworks such as the CSA Cloud Controls Matrix (CCM) and the CAIQ questionnaire support governance, and how the CSA STAR registry is used for provider transparency.
3. Risk, Audit and Compliance
Compliance is not automatically inherited. A provider's SOC 2 or ISO 27001 attestation covers the provider's scope, not your configuration. Know how pass-through audits, artifacts, and continuous compliance work, and how jurisdiction and data location affect risk.
4. Organization Management
Account, subscription, and project hierarchies, landing zones, and organisation-wide guardrails such as policy-based restrictions. Expect scenarios about separating environments and limiting blast radius with a multi-account structure.
5. Identity and Access Management
Federation and SSO (SAML, OIDC, OAuth), MFA, least privilege, RBAC compared with ABAC, entitlement management, privileged access, and machine/workload identities. In cloud, identity is the main security perimeter, and compromised management-plane credentials are among the highest-impact risks.
6. Security Monitoring
Cloud telemetry sources (management-plane or API logs, service logs, flow logs), centralised logging, posture management, and detection. Know why management-plane logging must be enabled and protected first.
7. Infrastructure and Networking
Software-defined networking, virtual networks, security groups compared with network ACLs, microsegmentation, software-defined perimeter and Zero Trust network access, and securing infrastructure as code.
8. Cloud Workload Security
Virtual machines, containers, and serverless/FaaS. Image hardening, immutable workloads, runtime protection, and how responsibility shifts as you move from VMs to functions.
9. Data Security
Classification, encryption at rest and in transit, key management options (provider-managed keys, customer-managed keys, and bring-your-own-key), tokenisation, data loss prevention, and securing data lakes. Encryption only protects data if key access is controlled separately.
10. Application Security
Secure SDLC, DevSecOps, CI/CD pipeline security, SAST/DAST/SCA testing, secrets management, and how cloud-native design changes threat modelling.
11. Incident Response and Resilience
The incident response lifecycle adapted for cloud: preparation with provider contacts and logging, forensics constraints when you cannot access physical hardware, automated containment, and designing for resilience and recovery.
12. Related Technologies and Strategies
AI and generative AI security considerations, Zero Trust as a strategy, and other emerging topics that span the earlier domains.
How to use the open-book format well
Sixty questions in 120 minutes is about two minutes per question. Candidates who plan to search for every answer usually run out of time. Use the open-book allowance as a safety net, not a strategy:
- Study as if it were closed book. You should answer most questions from understanding.
- Prepare a one-page domain index listing each domain's key concepts and where they appear in the Security Guidance, so a lookup takes seconds.
- Triage on exam day. Answer what you know, mark uncertain questions, and use lookups only on the marked set in a second pass.
- Read for scope words such as "customer", "provider", "always", or "first". Many wrong answers are true statements that do not answer the question asked.
Six-week CCSK study plan
| Week | Focus | Output |
|---|---|---|
| 1 | Domains 1–3: architecture, shared responsibility, governance, compliance | Shared responsibility table for IaaS, PaaS, and SaaS |
| 2 | Domains 4–6: organisation management, IAM, monitoring | Sketch of an account hierarchy with guardrails and a logging plan |
| 3 | Domains 7–8: networking, workloads, containers, serverless | Control checklist for VM, container, and function workloads |
| 4 | Domains 9–10: data security, key management, AppSec, DevSecOps | Key management decision tree and a pipeline security checklist |
| 5 | Domains 11–12: incident response, resilience, AI, Zero Trust | Cloud IR runbook outline; first full timed practice set |
| 6 | Timed mixed practice and weak-domain review | Two consecutive practice scores above 85%, then book the exam |
Common CCSK traps
- Assuming the provider secures everything in SaaS. The customer still owns identities, data classification, and access configuration.
- Treating a provider attestation as proof that your deployment is compliant.
- Choosing a network control when the question is about identity or management-plane access.
- Believing encryption alone solves data security without considering who controls the keys.
- Answering from one hyperscaler's product names. The CCSK is vendor-neutral, so think in concepts.
CCSK vs CCSP: which first?
The CCSK is a knowledge certificate with no experience requirement, which makes it a strong starting point. The ISC2 CCSP is a professional certification that requires five years of cumulative IT experience, including three years in information security and one year in a CCSP domain. ISC2 accepts the CCSK as a substitute for one year of the CCSP domain-experience requirement. A common path is CCSK first, then CCSP once you meet the experience requirement.
Practice on PrepKloud
- Free CCSK v5 Cloud Security Field Guide (PDF): a 45-page ebook covering all 12 domains, with 30 explained questions.
- CCSK practice test: 50 original questions in two parts.
- CCSK flashcards: 40 cards for spaced review of key distinctions.
- CCSK hands-on projects: three labs built on synthetic data, covering objective-to-implementation mapping, operational readiness and governance, and resilience.
- CCSK roadmap: phase-by-phase preparation sequence.
Use only official material and original practice. Never use recalled or leaked exam content: it is often wrong or outdated and breaks CSA's exam rules.
Official references
- CSA: Certificate of Cloud Security Knowledge (CCSK)
- CSA: free CCSK v5 Prep Kit
- CSA: Security Guidance for Critical Areas of Focus in Cloud Computing
- ISC2: CCSP certification and experience requirements
FAQ
Is the CCSK exam open book?
Yes. CSA describes the CCSK as an open-book online exam. That does not make it easy: 60 questions in 120 minutes is about two minutes per question, so you need to know the concepts well enough to answer most questions without looking them up.
How many questions are on the CCSK and what is the passing score?
According to the CSA CCSK page, the exam has 60 multiple-choice questions drawn at random from a larger pool, a 120-minute time limit, and an 80% minimum passing score. Confirm the current details when you buy the exam.
How much does the CCSK cost?
CSA lists the exam at USD 445, including two attempts to be used within two years. Prices and bundles can change, so check the CSA exam page before buying.
What does the CCSK v5 exam cover?
CCSK v5 covers 12 domains: cloud concepts and architectures; governance; risk, audit and compliance; organisation management; IAM; security monitoring; infrastructure and networking; cloud workload security; data security; application security; incident response and resilience; and related technologies and strategies such as AI and Zero Trust.
Do I need experience before taking the CCSK?
No. CSA sets no required work experience or prior qualification. It recommends basic security knowledge such as firewalls, secure development, encryption, and identity and access management.
Should I take CCSK or CCSP first?
For most people, CCSK comes first. It has no experience requirement and gives a broad vendor-neutral foundation. ISC2 CCSP requires five years of IT experience, and ISC2 accepts the CCSK as a substitute for one year of the CCSP experience requirement.
How long does it take to prepare for the CCSK?
Many working professionals plan four to eight weeks of part-time study. If you already work in cloud security, two to three focused weeks of guidance reading and timed practice may be enough. Book the exam when your timed practice scores are consistently high, not when a set number of weeks has passed.
Start Practice · Open Roadmap · Review Flashcards · Live 1:1 CCSK Training · Free CCSK eBook