ISC2 CCSP
ISC2 CCSP is the vendor-neutral cloud security specialization, pairing naturally with CISSP for architects working across multi-cloud programs. Six domains: Cloud Concepts, Architecture and Design (17%), Cloud Data Security (20%), Cloud Platform and Infrastructure Security (17%), Cloud Application Security (16%), Cloud Security Operations (17%), Legal, Risk and Compliance (13%). ISC2 moved CCSP onto Computerized Adaptive Testing: 100-150 adaptive questions, 3 hours, passing score 700 on a scaled 100-1000 scale.
Offered in: English, Chinese, Japanese, German.
Owner: ISC2 · Read: · Source: CCSP Certification Exam Outline
Exam fee at last check: $599, per the vendor. The official objectives are at www.isc2.org/certifications/ccsp/ccsp-certification-exam-outline. Verified 2026-09-26.
New CCSP exam outline effective 2026-08-01.
- ISC2's revised CCSP outline is in force from 2026-08-01.1
- New domain weights: Cloud Concepts 17%, Cloud Data Security 20%, Cloud Platform and Infrastructure 17%, Cloud Application Security 16%, Cloud Security Operations 17%, Legal, Risk and Compliance 13%.1
The practice questions on this page were written before the 2026-08-01 outline. Use the weights above to plan your study time.
Sources, checked 2026-10-04
Get an email if the ISC2 CCSP exam changes
Common questions about the exam change
- When does the new ISC2 CCSP exam start?
- New CCSP outline takes effect: 2026-08-01. Source: ISC2: CCSP exam outline revised, checked 2026-10-04.
- What changed in the ISC2 CCSP exam?
- ISC2's revised CCSP outline is in force from 2026-08-01. New domain weights: Cloud Concepts 17%, Cloud Data Security 20%, Cloud Platform and Infrastructure 17%, Cloud Application Security 16%, Cloud Security Operations 17%, Legal, Risk and Compliance 13%. Source: ISC2: CCSP exam outline revised, checked 2026-10-04.
- Which version of the ISC2 CCSP exam do the practice questions follow?
- The practice questions on this page were written before the 2026-08-01 outline. Use the weights above to plan your study time.
- Starts New CCSP outline takes effect
- Cloud Concepts17%
- Cloud Data Security20%
- Cloud Platform and Infrastructure17%
- Cloud Application Security16%
- Cloud Security Operations17%
- Legal, Risk and Compliance13%
Source: ISC2: CCSP exam outline revised. Checked 2026-10-04. Bar length is relative to the heaviest domain; the figure beside each name is the published weight.
Practice is free. The full analysis adds the right answer, the explanation and the source for every question, readiness by domain and a study plan, for one payment.
What's on the exam
Cloud Concepts, Architecture and Design 17%
Service models (IaaS/PaaS/SaaS), deployment models, the shared responsibility model, and resilient architecture.
- IaaS vs PaaS vs SaaS and the shared responsibility split at each layer
- Private vs public vs community cloud deployment models
- Multi-zone/multi-region high availability design
Primary sources: NIST SP 800-145, The NIST Definition of Cloud Computing
Cloud Data Security 20%
The largest domain. Encryption key management, data-in-use protection, secure destruction, and classification.
- Customer managed keys vs provider managed keys
- Confidential computing / trusted execution environments for data in use
- Cryptographic erasure (crypto-shredding) for cloud-appropriate secure destruction
- Automated data discovery and classification tooling
Primary sources: NIST SP 800-57 Part 1 Rev. 5, Recommendation for Key Management, NIST SP 800-88 Rev. 1, Guidelines for Media Sanitization
Cloud Platform and Infrastructure Security 17%
Misconfiguration risk, Infrastructure as Code, and multi-tenancy isolation.
- Cloud misconfiguration as a leading real-world exposure cause
- Infrastructure as Code for repeatable, auditable provisioning
- VM escape / hypervisor breakout as a multi-tenancy isolation risk
Primary sources: NIST SP 800-125, Guide to Security for Full Virtualization Technologies
Cloud Application Security 16%
Secure SDLC, microservices attack surface, and secrets management for cloud-native applications.
- Shifting security left in CI/CD
- Microservices' expanded API/trust-boundary attack surface vs a monolith
- Cloud secrets managers vs credentials embedded in code or config
Primary sources: NIST SP 800-218, Secure Software Development Framework, NIST SP 800-204, Security Strategies for Microservices-based Application Systems
Cloud Security Operations 17%
Continuous posture monitoring, cloud incident containment, and centralized audit logging.
- Cloud Security Posture Management (CSPM) for continuous drift detection
- Network-layer isolation of a compromised instance while preserving forensic state
- Centralized, tamper-evident audit logging across cloud accounts
Primary sources: NIST SP 800-61 Rev. 2, Computer Security Incident Handling Guide, NIST SP 800-92, Guide to Computer Security Log Management
Legal, Risk and Compliance 13%
Regulatory territorial scope, independent assurance reporting, and risk treatment options.
- GDPR territorial scope: applies by data subject residency, not company or data-center location
- SOC 2 as independent, standardized provider control assurance
- Risk treatment: accept, mitigate, transfer, avoid
Primary sources: GDPR Article 3, territorial scope, NIST SP 800-37 Rev. 2, Risk Management Framework
Exam-day strategy
CCSP now uses Computerized Adaptive Testing, the same technology as CISSP: exam length (100-150 questions) and difficulty adjust based on your performance, and you cannot skip and return to earlier questions.
Domain 2 (Cloud Data Security) is the largest at 20%. Know the difference between data at rest, in transit, and in use, and which technology protects each.
Watch for shared-responsibility distractors that misassign a control to the wrong party for the specific service model (IaaS vs PaaS vs SaaS) in the scenario.
Do not confuse cryptographic erasure (destroying the key) with simple file deletion (which often leaves data recoverable); this is a frequently tested distinction.
CCSP is vendor-neutral: when a scenario doesn't name AWS/Azure/GCP specifically, answer from the general cloud-security principle, not a provider-specific service name.
How to prepare for ISC2 CCSP
- EVIDENCE-BACKEDPractice in the same format as the exam. How well practice matches the final test shapes how much it helps. (Yang et al., 2021)
- EVIDENCE-BACKEDStart practice questions in week one, even on topics you have not studied. Failed attempts before seeing the answer still helped learning. (Kornell et al., 2009 and others)
- EVIDENCE-BACKEDSpace your reviews over weeks instead of cramming the week before. (Cepeda et al., 2006 and others)
- PLAUSIBLEDivide the minutes by the questions before you start, and keep a margin for a second pass if the exam allows one. (Sound arithmetic; no study compared time budgets on a licensing exam.)
Why this works
EVIDENCE-BACKED At least one peer-reviewed study or official source found the effect or states the fact. A study can be small.
PLAUSIBLE Reasonable and partly studied, but not tested on exams, or the results are mixed.
Practice that matches the final test format works better than practice that does not.
Failed attempts before seeing the answer still improved later learning of the material asked about; the benefit for material not asked about was virtually nil.
Spacing beat massing across hundreds of experiments and beat cramming with flashcards; combined with retrieval it raised scores on a real high-stakes exam.
Sound arithmetic; no study compared time budgets on a licensing exam.
Sources
- Yang, C., Luo, L., Vadillo, M. A., Yu, R., & Shanks, D. R. (2021). Testing (quizzing) boosts classroom learning: A systematic and meta-analytic review. Psychological Bulletin, 147(4), 399-435. doi.org/10.1037/bul0000309
- Kornell, N., Hays, M. J., & Bjork, R. A. (2009). Unsuccessful retrieval attempts enhance subsequent learning. Journal of Experimental Psychology: Learning, Memory, and Cognition, 35(4), 989-998. doi.org/10.1037/a0015729
- Richland, L. E., Kornell, N., & Kao, L. S. (2009). The pretesting effect: Do unsuccessful retrieval attempts enhance learning? Journal of Experimental Psychology: Applied, 15(3), 243-257. doi.org/10.1037/a0016496
- St. Hilaire, K. J., Chan, J. C. K., & Ahn, D. (2024). Guessing as a learning intervention: A meta-analytic review of the prequestion effect. Psychonomic Bulletin & Review, 31(2), 411-441. doi.org/10.3758/s13423-023-02353-8
- Cepeda, N. J., Pashler, H., Vul, E., Wixted, J. T., & Rohrer, D. (2006). Distributed practice in verbal recall tasks: A review and quantitative synthesis. Psychological Bulletin, 132(3), 354-380. doi.org/10.1037/0033-2909.132.3.354
- Kornell, N. (2009). Optimising learning using flashcards: Spacing is more effective than cramming. Applied Cognitive Psychology, 23(9), 1297-1317. doi.org/10.1002/acp.1537
- Kang, S. H. K. (2016). Spaced repetition promotes efficient and effective learning: Policy implications for instruction. Policy Insights from the Behavioral and Brain Sciences, 3(1), 12-19. doi.org/10.1177/2372732215624708
- Janes, J. L., Dunlosky, J., Rawson, K. A., & Jasnow, A. (2020). Successive relearning improves performance on a high-stakes exam in a difficult biopsychology course. Applied Cognitive Psychology, 34(5), 1118-1132. doi.org/10.1002/acp.3699
Additional resources
Explore Related Cybersecurity Resources
DecipherU is independent of ISC2. CCSP is a trademark of ISC2. DecipherU is not endorsed by, sponsored by, or affiliated with any certifying body.