Examworthyexamworthy.comISC2 Certified Cloud Security Professional cheat sheet
ISC2
Free to share. Examworthy is not affiliated with or endorsed by ISC2; CCSP and related marks belong to their respective owners.
At a glance
Format: Multiple choice and advanced item types
Domain weight map
Heaviest first - spend your time hereHow this exam thinks
CCSP rewards the cloud architect's judgement - the best control at the right layer, assigned to the correct party under the shared responsibility model, and proportionate to the stated risk - not a textbook definition, so train on scenarios where several controls look right and only one fits.
Spot the trap
Tempting wrong answers, and why they failTempting but wrong
Format-preserving encryption with a symmetric key stored in the application config is a sound way to keep card layout while allowing reversal.
Why it fails
Format-preserving encryption does keep the layout and is reversible, but storing the key in plaintext application config defeats the protection. That makes it the weaker choice the requirement does not describe, even though the format is preserved.
Cloud Data Security
Tempting but wrong
The provider patches the guest OS in IaaS because it owns the physical hosts and hypervisor beneath the VMs.
Why it fails
The provider does patch the hypervisor and physical layer, but in IaaS the guest operating system sits above the provider's boundary and remains the customer's responsibility.
Cloud Concepts, Architecture and Design
Tempting but wrong
The management plane is the tenant-facing application layer where end users authenticate and consume running workloads.
Why it fails
That describes the application or workload layer that consumers interact with. The management plane sits beneath it and controls the resources rather than serving the application to users, so this confuses the consumption layer with the control layer.
Cloud Platform and Infrastructure Security
Tempting but wrong
An HSM's main job is to measure firmware and boot components at startup so a host can attest to its trusted state.
Why it fails
Boot integrity measurement and attestation describe a trusted platform module (TPM), not an HSM. This confuses two distinct hardware roots of trust; the HSM's core function is protecting keys during generation and use.
Cloud Security Operations
Tempting but wrong
Security controls added late cost the same to implement as those planned early, so timing does not matter.
Why it fails
This reverses a core principle: defects and missing controls are markedly cheaper to address early, so the claim that cost is unchanged is exactly what the emphasis on early requirements refutes.
Cloud Application Security
Tempting but wrong
Data sovereignty just means data is stored and processed within a geographic boundary the customer chooses.
Why it fails
Tempting because it sounds like a location rule, but this describes data residency, which is only about where data physically sits, not which laws govern it. Sovereignty is about which nation's law applies.
Legal, Risk and Compliance
Tempting but wrong
Static data masking that overwrites the middle digits can still be swapped back to the original card number when needed.
Why it fails
Masking is deliberately irreversible for the masked characters. It preserves the display format but cannot be reversed to the original value, so it fails a requirement that the stored values be swappable back to the originals.
Cloud Data Security
Tempting but wrong
One shared instance serving several isolated customers is best described by rapid elasticity.
Why it fails
Rapid elasticity is a genuine essential characteristic, but it describes capacity scaling out and back in to match demand, not the isolation of several customers sharing one logical instance.
Cloud Concepts, Architecture and Design
Key terms
Exam-day rules
- Fix the service model first. Before assigning any responsibility, decide whether the scenario is IaaS, PaaS, or SaaS, because the shared responsibility boundary moves with it and the wrong assignment is the most common distractor.
- Choose the best control, not merely a correct one. Two or three options are often defensible; the wrong ones are the right control at the wrong layer, in the wrong order, or proportionate to a different risk.
- Respect the sequence. Classify data before protecting it, assess risk before selecting a control, and run a business impact analysis before designing recovery - an answer that skips a step that comes first is the distractor.
- Keep the data-protection terms exact. Encryption is reversible with a key, tokenisation removes data from scope, anonymisation is not reversible, masking preserves format, and crypto-shredding is cloud deletion; the exam swaps these deliberately.
- In the cloud, choose the cloud-appropriate control. Physical media destruction and hardware seizure are not available to a tenant, so crypto-shredding and logical, provider-mediated evidence collection are the answers.
Revision schedule
- Week 1Map the six domains and book a date
- Weeks 1 to 2Master the shared responsibility model (Domain 1)
- Weeks 2 to 4Drill the data-protection techniques (Domain 2)
- Weeks 4 to 7Work platform, application, and operations (Domains 3, 4, and 5)
- Weeks 7 to 8Cover legal, risk and compliance (Domain 6)