CCSP Cram Sheet & Last-Minute Review
Updated 16 November 2026 · Adaptive (CAT), 100–150 questions, 3 hours, pass 700/1000 · New outline from 1 Aug 2026
CCSP tests cloud security from the customer’s seat: who is responsible for what in each service model, and how data stays protected across its lifecycle. This sheet follows the outline effective 1 August 2026 and its six domains.
The CCSP mindset
- Read every scenario for the service model first: IaaS, PaaS or SaaS changes who can act.
- The customer always keeps accountability for its data, even when the provider runs the controls.
- Legal and contractual answers often beat technical ones when data crosses borders.
CCSP cram sheet by domain
Ordered by exam weight, so the top of the page is where most of the marks are.
Cloud Data Security
20% of the exam- Data lifecycle: create, store, use, share, archive, destroy
- Encryption at rest and in transit; key management and who holds the keys
- Tokenisation, masking, anonymisation and when each fits
- Data discovery and classification; DLP; data retention and crypto-shredding for deletion
Cloud Concepts, Architecture and Design
17% of the exam- NIST cloud characteristics: on-demand self-service, broad network access, resource pooling, rapid elasticity, measured service
- Service models (IaaS, PaaS, SaaS) and deployment models (public, private, community, hybrid)
- Shared responsibility by model; secure reference architectures
- Cost-benefit and business continuity considerations in cloud design
Cloud Platform and Infrastructure Security
17% of the exam- Securing compute, storage, network and virtualisation layers; hypervisor types
- Identity for infrastructure; segmentation; secure configuration baselines
- Business continuity and disaster recovery in the cloud
Cloud Security Operations
17% of the exam- Operating and monitoring cloud environments; logging and SIEM
- Incident handling and digital forensics with provider cooperation
- Change, configuration and patch management at cloud scale
Cloud Application Security
16% of the exam- Secure SDLC in cloud; threat modelling; API security
- Application identity: federation, SAML, OAuth, OpenID Connect
- Testing: SAST, DAST, software composition analysis
Legal, Risk and Compliance
13% of the exam- Jurisdiction and data residency; privacy laws; eDiscovery
- Audit and assurance: SOC 2 Type I vs Type II, ISO/IEC 27001, 27017, 27018
- Contracts and SLAs; vendor risk management
Formulas and numbers to memorise
| Exam | Adaptive (CAT), 100–150 items, 3 hours, pass 700/1000 |
|---|---|
| SOC 2 Type I vs II | Control design at a point in time / operating effectiveness over a period |
Common CCSP traps
- Assuming the provider can do something the service model reserves for the customer, or the reverse
- Answering with an on-premises fix in a SaaS scenario
- Forgetting that outsourcing to a cloud provider does not transfer accountability
14-day CCSP cram plan
- Days 1–3Diagnostic across all 6 domains; rank them
- Days 4–8Cloud Data Security (20%) and your two weakest domains
- Days 9–10Shared responsibility tables and the data lifecycle until automatic
- Days 11–12Timed practice under adaptive conditions; review every miss
- Days 13–14Miss log, this sheet, then rest
Exam-day tactics
- CAT: no going back, so read every option before committing.
- Identify the service model and the data’s location before you read the options.
CCSP cram FAQ
What changed in the CCSP exam on 1 August 2026?
ISC2 revised the domain weights and subdomains. Cloud Data Security is now the heaviest domain at 20%.
Is CCSP adaptive?
Yes. ISC2 delivers CCSP as a computerized adaptive test of 100–150 items in 3 hours.
Keep going
Get ready while the CCSP bank is built
Start free on another exam today; your account carries over.
Start free