CCSP quick review

Memory hook: Reduce exposure; separate trust; inspect the right layer.

Must remember

Security responsibility changes across IaaS, PaaS and SaaS. Customers retain responsibilities for their data, identities and configuration even when infrastructure is managed. Virtual machines share a hypervisor; containers normally share the host kernel. Isolation, patching and image provenance remain important.

Segment systems by sensitivity and function: user networks, guests, servers, management, IoT and operational technology. A screened subnet/DMZ hosts externally reachable services while restricting movement inward. Air gaps and logical isolation differ; removable media and maintenance paths can still introduce risk. Industrial systems prioritize safety and availability, so patching may require controlled maintenance and compensating safeguards.

Choose fail-open versus fail-closed behavior according to safety and availability requirements. A load balancer improves distribution/availability; it is not a substitute for authentication. Secure management interfaces separately from application traffic, prefer encrypted protocols and restrict administrative access.

Wireless protection includes WPA3 or appropriate enterprise authentication, secure onboarding, guest isolation and removal of legacy protocols. An evil twin imitates a legitimate network; validate the authentication server certificate in enterprise Wi-Fi rather than accepting any certificate prompt.

IaC makes configuration repeatable but also makes a bad template repeatable. Review plans, scan configurations, protect state and control deployment credentials.

Choose under exam pressure

Traps

• A VPN does not make the endpoint trustworthy.
• Containers are not equivalent to separate hardware trust boundaries.

Practise this topic

Memory hook: Protect the right property with the right kind of control.

Must remember

Confidentiality prevents unauthorized disclosure; integrity protects against unauthorized alteration; availability keeps a service usable. Authenticity establishes that something is genuine. Non-repudiation supplies evidence of origin or action, subject to trustworthy keys, identities and records.

Authentication establishes an identity, authorization decides permitted actions and accounting records activity. Identify which stage failed: a valid login with excessive database privileges is an authorization problem.

One control can have several classifications. A camera detects; a visible camera may also deter. A compensating control addresses the original control's intent when the normal implementation is not feasible; it does not simply mean a cheaper control.

Zero trust evaluates access using identity, device state, resource sensitivity and context rather than trusting network location. A policy engine decides, a policy administrator arranges the session and an enforcement point permits or blocks it. Least privilege and segmentation reduce blast radius; continuous evaluation handles changing conditions.

Honeypots, honeynets, honeyfiles and honeytokens are deception tools. Access to a decoy can be a high-value detection signal, but a decoy needs containment and monitoring.

Choose under exam pressure

Traps

• Encryption alone does not make a service available.
• Zero trust is an architecture and decision process, not one appliance.

Practise this topic

Memory hook: Encrypt for secrecy; sign for origin; hash for comparison.

Must remember

Symmetric encryption uses a shared secret and is efficient for bulk data. Asymmetric cryptography uses a key pair for operations such as signatures or key establishment. TLS combines authenticated negotiation with efficient symmetric protection; it does not encrypt with a certificate as though the certificate were a secret key.

Hashing produces a digest without a decryption operation. Password storage needs a suitable salted password-hashing/key-derivation function with work cost; a fast unsalted hash is unsuitable. A salt is unique nonsecret input preventing identical passwords from sharing the same stored result. An HMAC uses a secret key to authenticate a message; a plain hash alone does not prove origin.

Digital signatures use a private signing key and public verification key. Encryption for a recipient and signing as a sender are different operations. PKI binds public keys to identities through certificates and trusted issuers. Validate chain, hostname/SAN, dates, intended use and revocation information such as CRLs/OCSP. A CSR requests issuance; a CA signs the certificate.

Key management includes generation, distribution, storage, access, rotation, revocation, backup and destruction. HSMs protect key operations; TPMs support device-bound measurements and key protection. Losing an encryption key without recovery can make intact backups unusable.

Tokenization replaces sensitive values with references, often using a protected mapping service. Masking obscures displayed data. Steganography hides the existence of a message; encryption hides meaning. Blockchain links records using cryptography and consensus but does not guarantee that input data was true.

Protect data in transit, at rest and in use with controls suited to each state. Cryptographic erase depends on effective key destruction and the absence of surviving usable key copies.

Choose under exam pressure

Traps

• Base64 is encoding, not encryption.
• A valid certificate does not prove the business behind a site is honest.

Practise this topic

Memory hook: Know the owner, keep only what you need, test restoration.

Must remember

Classify data by business impact and obligations, then label and protect it consistently. Owners decide use/classification; custodians implement handling. Controllers determine processing purposes while processors act under applicable instructions; exact legal duties depend on jurisdiction and contract.

The lifecycle runs through collection/creation, use, sharing, storage, retention and disposal. Minimize collection, restrict purpose and access, discover misplaced sensitive data and track copies. Data residency describes where data is stored; sovereignty/jurisdiction concerns which laws may apply. Encryption does not automatically resolve every cross-border obligation.

Choose disposal by medium and sensitivity: clear, purge or physically destroy using an approved sanitization method. A quick format or ordinary file deletion may leave recoverable data. Track disposal and verify sanitization; retain evidence when required. Legal holds can override routine deletion.

RPO measures tolerable lost data in time; RTO measures target restoration time. A business impact analysis prioritizes services and dependencies. High availability handles component failures; backups recover prior data; disaster recovery restores technology; business continuity sustains critical business operations.

Full backups simplify restoration but copy more data. Incremental backups copy changes since the preceding backup and may require a chain; differential backups copy changes since the full backup. Offline/isolated or suitably immutable copies resist attacks on live systems. Replication can also replicate corruption and deletion.

Hot, warm and cold recovery sites trade readiness for cost. Test restoration, application consistency, key availability, access, DNS and dependent services. Redundant power, UPS/generators, geographic diversity and people/process continuity address different failure modes.

Choose under exam pressure

Traps

• Replication is not a substitute for independent recovery history.
• A backup without usable decryption keys may be worthless.

Practise this topic

Memory hook: Inventory, prioritize, fix, verify.

Must remember

You cannot secure unknown assets. Maintain ownership, location, purpose, classification, versions and support status. Apply secure baselines: remove unused software/services, disable default accounts, restrict administration, patch, configure logging and enforce appropriate endpoint protection.

Mobile management can enforce encryption, screen lock, application policy and remote wipe. BYOD raises ownership/privacy boundaries; choose whole-device management versus application/container controls deliberately. Rooted/jailbroken devices weaken assumptions. Wireless, browser, email and document settings can expose different attack surfaces.

Vulnerability scanning identifies potential weaknesses; penetration testing attempts to demonstrate exploitability within authorization and rules of engagement. Credentialed scans can inspect more internal configuration. SAST examines code without running the application; DAST tests running behavior; software composition analysis identifies dependencies and known component issues.

Prioritize using exploitability, exposure, asset value, business impact and active exploitation, not severity alone. CVE identifies a known vulnerability; CVSS scores technical severity; threat intelligence adds context. A low-scoring flaw on a critical exposed identity system can deserve urgent action.

Remediation may mean patching, reconfiguration, removing a component or applying an approved compensating control. Exceptions need owners, expiration and risk acceptance. Test compatibility, maintain a rollback plan, deploy in controlled stages and rescan to verify the issue is resolved. Suppressing an alert is not remediation.

False positive: a reported issue that is not actually present. False negative: an existing issue missed by the test. Confirm with evidence before tuning detection. Sandboxing isolates suspicious code for analysis; a safe analysis environment should not have production access or usable production credentials.

Choose under exam pressure

Traps

• CVSS alone is not business risk.
• An uncredentialed scan may miss issues visible from inside the system.

Practise this topic

Memory hook: Who are you, what may you do, and for how long?

Must remember

Factors are something you know, have or are. Two passwords are not MFA. Hardware-backed phishing-resistant authentication reduces risks that a phishable one-time code does not fully address. Biometrics need fallback and privacy controls; false acceptance and false rejection trade off against each other.

SSO reduces repeated sign-ins; federation lets one identity provider assert identity to another service. SAML carries assertions commonly used in enterprise federation. OAuth delegates authorization; OpenID Connect adds an identity layer. Kerberos uses tickets and depends on appropriate time synchronization. LDAP is a directory-access protocol, not encryption by itself.

RBAC grants access through roles; ABAC evaluates attributes and context; discretionary access lets owners delegate; mandatory access enforces centrally controlled labels. Least privilege restricts permissions; separation of duties prevents one person completing a sensitive workflow alone. Need-to-know narrows access even among sufficiently cleared users.

Provisioning must cover joiners, movers and leavers. Reconcile access after role changes and promptly revoke accounts, sessions, keys and tokens when required. Periodic access reviews find accumulated privilege and dormant accounts. Service accounts need ownership, scoped permissions and credential lifecycle controls too.

PAM manages privileged access with vaulting, approval, session recording and just-in-time elevation. Just-enough access narrows the permitted actions. A break-glass account needs controlled storage, monitoring and periodic tests; it should not become a daily shared login.

RADIUS commonly centralizes network access authentication; TACACS+ is often used for network-device administration with separable AAA functions. Certificates and device posture can supplement user identity. An authenticated user can still be compromised or unauthorized for the requested object.

Choose under exam pressure

Traps

• SSO without careful controls can concentrate compromise risk.
• Authentication success does not establish authorization for every resource.

Practise this topic

Memory hook: Actor explains intent; evidence identifies the technique.

Must remember

Actors differ in funding, access and motivation: nation-state espionage, organized financial crime, hacktivism, malicious or careless insiders and opportunistic attackers. Shadow IT is unapproved technology that creates unmanaged exposure; it is not necessarily malicious.

Phishing targets messages; spear phishing targets a person/group; whaling targets senior staff. Smishing uses text messages and vishing voice calls. Pretexting invents a credible story, business email compromise abuses trusted payment workflows, and tailgating exploits physical access. Verify unusual requests through an independent channel, especially when voice or video could be synthesized.

Ransomware denies access or extorts using stolen data; a worm self-propagates; a Trojan disguises malicious behavior; rootkits hide privileged persistence; spyware captures information. Fileless activity can use legitimate interpreters and memory rather than a conspicuous executable.

Race conditions exploit timing (including time-of-check/time-of-use); buffer overflows corrupt memory; insecure direct object references expose missing object-level authorization. Supply-chain compromise can enter through dependencies, build systems or updates. Downgrade attacks seek weaker protocols; replay reuses captured valid messages without breaking the cipher.

Treat a single indicator as a hypothesis. Correlate identity, endpoint, network and application evidence before concluding cause.

Choose under exam pressure

Traps

• A strong password does not prevent phishing of a live session.
• A vulnerability is a weakness; an exploit is a method of using it.

Practise this topic

Memory hook: Contain harm while preserving what explains it.

Must remember

Preparation establishes contacts, authority, playbooks, logging, tools and exercises. Detection and analysis distinguish an event from an incident and establish scope. Containment limits damage; eradication removes the cause/persistence; recovery restores trustworthy service; lessons learned improve the system. These activities can overlap and repeat.

Use the scenario's authority and safety requirements. Isolate a compromised endpoint when appropriate, but do not automatically power it off: volatile evidence may matter. Human safety and urgent containment can outweigh evidence collection when the situation requires it. Engage legal, privacy and communications owners for reporting obligations and external statements.

Chain of custody records who collected, handled, transferred and stored evidence. Integrity hashes help demonstrate that a copy has not changed; they do not independently establish who collected it or whether collection was lawful. Preserve originals and work on validated copies where practical.

Volatile sources include running processes, memory and active network connections; disks and archived logs are generally less volatile. Collection order depends on the system and investigative purpose. Record synchronized timestamps, time zones, commands and methods. A legal hold suspends normal deletion for relevant material.

Threat hunting starts with a hypothesis and seeks evidence beyond existing alerts. Root-cause analysis asks why the incident was possible, not only which host was infected. Tabletop exercises test decisions and communication; simulations and technical exercises test execution.

Backups used for recovery must be known good, accessible and protected from the same compromise. Rebuilding without revoking stolen credentials or closing the original entry point invites recurrence.

Choose under exam pressure

Traps

• Reimaging first can destroy the explanation of a broader breach.
• An incident is not closed merely because alerts stop.

Practise this topic

Memory hook: Correlate signals; constrain automated actions.

Must remember

Collect evidence from identity providers, endpoints, applications, DNS, proxies, firewalls, databases and cloud control planes. Normalize timestamps and retain enough context to connect a user, device, request and resource. Central collection improves correlation but needs access control, integrity protection and retention limits.

SIEM aggregates and correlates security events. SOAR orchestrates response workflows and integrations. EDR supplies endpoint evidence and response; XDR combines multiple detection domains. A dashboard without useful detections or responders is not an effective control.

Encrypted traffic can still reveal timing, volume and endpoints while hiding application content. Packet capture location and collection permissions matter. Baselines distinguish ordinary patterns from meaningful deviations; tune rules with feedback instead of disabling noisy detection broadly.

Automation can enrich indicators, create tickets, quarantine endpoints, revoke sessions or enforce configurations. Give automation minimal permissions, bounded targets, tested rollback and human approval for actions with substantial impact. Protect integration credentials and validate untrusted input before passing it to scripts.

Track mean time to detect/respond, coverage, false positives and repeat incidents with clear definitions. A falling alert count can mean better security, broken collection or weaker rules; investigate the reason.

Choose under exam pressure

Traps

• Logs can contain credentials or personal data.
• Automating a flawed decision makes the mistake faster and broader.

Practise this topic

Memory hook: Business owns risk; controls reduce it; evidence checks it.

Must remember

Policy states management intent; standards set mandatory requirements; procedures describe steps; guidelines advise. Assign data/system owners and accountable decision makers. Security should enable business objectives within legal and risk constraints.

Threats can exploit vulnerabilities and cause impact. Inherent risk exists before controls; residual risk remains afterward. Appetite is the broad willingness to take risk; tolerance defines acceptable variation/bounds. Treat risk by avoiding, mitigating, transferring/sharing or formally accepting it. Insurance transfers some financial consequences, not accountability or every impact.

Quantitative example: an asset worth $100,000 with 20% expected loss per event has SLE = $20,000. At 0.5 events/year, ALE = $10,000/year. Estimates are uncertain; qualitative matrices express relative likelihood/impact without pretending to precise currency.

Change control records purpose, impact, dependencies, approvals, testing, maintenance window, rollback and validation. Emergency changes still need defined authority and retrospective documentation. Version control supports traceability; it does not approve a change by itself.

Supplier assessment covers security evidence, subcontractors, data location, access, continuity, breach notification and exit/deletion terms. SLAs define service commitments; NDAs protect shared confidential information; rules of engagement constrain testing. Review suppliers throughout the relationship.

Audits compare evidence against criteria; assessments evaluate controls; attestation is a formal assertion/report; penetration tests validate selected attack paths. Compliance is a baseline tied to scope, not proof of complete security. Awareness programs need role-specific training, usable reporting channels and measured outcomes, not only annual attendance.

Choose under exam pressure

Traps

• A technical administrator does not unilaterally accept business risk.
• A supplier certification applies to its stated scope and period.

Practise this topic

Memory hook: Outsource the operation; retain the accountable decision.

Must remember

Map responsibilities for each service, not just the provider's brand. In IaaS the customer normally manages guest operating systems and applications; PaaS shifts more runtime work to the provider; SaaS shifts application operation too. Identity, data use, tenant settings and legal accountability remain relevant in all models.

Cloud characteristics include self-service, broad access, pooled resources, elasticity and measured consumption. Public, private, hybrid, community and multicloud describe deployment/ownership arrangements, not automatic security levels. A broker may coordinate services while a regulator imposes obligations; neither replaces the customer/provider responsibility matrix.

Assess the control plane separately from workloads. An API credential that changes IAM, logging or encryption settings may bypass application defenses. Use strong authentication, scoped roles, separation of duties, immutable deployment patterns and protected audit trails. Multitenancy requires isolation of compute, networking, storage and operational access.

Evaluate provider evidence against the exact service, region, control scope and review period. Common Criteria evaluates a defined product/security target; FIPS validation addresses a cryptographic module boundary; neither certifies the customer's whole deployment. Provider audit reports often specify customer controls that must still be implemented.

Portability moves data/workloads; interoperability makes systems work together; reversibility supports exit from a service. Plan export formats, egress cost, key ownership, identity transition, backups and deletion evidence before lock-in becomes an emergency.

Continuity must include provider outages, account compromise, inaccessible keys and regional dependencies. Test RPO/RTO against the whole service chain. Confidential computing can protect selected data-in-use scenarios; it does not eliminate malicious application logic or poor authorization.

Choose under exam pressure

Traps

• Provider compliance does not automatically make the tenant compliant.
• A private cloud can still have weak controls and shared failure points.

Practise this topic

Memory hook: Follow the data into every copy, model and tool.

Must remember

Object storage, block volumes, database records and ephemeral storage have different access and deletion behavior. Discover structured, semistructured and unstructured data, classify it, map flows and apply policy at every destination. Replicas, caches, logs, backups and model-training datasets can preserve sensitive copies after a primary record is deleted.

Choose encryption and key ownership according to separation, recovery and legal requirements. Customer-managed keys provide control but also create availability duties. External key control can add another dependency. Tokenization, masking, rights management and DLP solve different problems: rights management can restrict permitted use of protected documents; DLP observes/enforces data movement where it has visibility.

Application security requires a secure lifecycle, threat modeling, dependency controls, test coverage and API authorization. Gateways provide centralized policy, but backends still need object-level authorization. WAFs, database activity monitoring and sandboxing supplement correct application design. Container orchestration needs control-plane, image, workload-identity and network protections.

For AI/ML, validate dataset origin, permissions and integrity. Minimize sensitive training data; consider memorization, inference and model-extraction risks. Protect model artifacts and evaluation data as assets. Prompt injection can arrive through retrieved documents and tool outputs, not only the user prompt. Grounding/RAG improves access to information but must enforce document permissions at retrieval time.

Constrain agent tools to specific allowed actions, use short-lived identities, require approvals where appropriate and log actions without exposing secrets. Evaluate both task quality and safety under adversarial inputs. Automated threat detection can produce false positives and drift; retain accountable human review and measurable performance.

Choose under exam pressure

Traps

• A retrieval filter is only effective if it cannot be bypassed by another query path.
• Encryption does not remove obligations for copies and derived datasets.

Practise this topic

Memory hook: Preserve evidence before an ephemeral system disappears.

Must remember

Cloud resources can be short-lived while their effects persist. Centralize appropriate control-plane, data-access, identity and workload logs before an incident. Record tenant/account, actor, action, resource, time and result. Protect logs from the identity being investigated and define retention/cost controls deliberately.

Forensics may depend on provider APIs, snapshots and contractual assistance rather than physical disk seizure. Establish collection rights, available timestamps, chain of custody and isolation procedures in advance. A snapshot can be crash-consistent rather than application-consistent; preserve enough context to interpret it. Do not assume a provider exposes hypervisor or another tenant's evidence.

Operational controls cover configuration baselines, patches, vulnerability assessment, administrative access, capacity, availability and backup/restoration. Monitor the host and guest responsibilities that actually belong to your service model. Quotas, regional capacity and identity dependencies can cause outages even when CPU metrics look healthy.

Distinguish service-management activities: incident management restores service, problem management seeks underlying causes, change management controls modifications, release management organizes deliverable versions and deployment installs them. Configuration management tracks relevant items and relationships; service-level management reviews commitments and evidence.

Use tested maintenance/rollback procedures and communicate with customers, providers, partners and regulators through assigned owners. A security operations center needs clear escalation, intelligence, response authority and continuous tuning. Outsourced monitoring does not remove the need for an internal decision maker.

Exercise a compromised cloud administrator, a deleted data store and an inaccessible region. Confirm that clean identities, keys, logs and recovery copies remain available outside the failed trust boundary.

Choose under exam pressure

Traps

• A VM snapshot is not automatically a forensic image of every relevant system layer.
• Availability monitoring alone will not detect excessive permissions.

Practise this topic

Memory hook: Scope the promise, verify the evidence, plan the exit.

Must remember

Cloud data can cross storage, processing, support and backup jurisdictions. Identify applicable obligations with legal/privacy specialists; do not assume the selected storage region settles every issue. Distinguish ownership, controller, processor, custodian and stewardship responsibilities. A privacy impact assessment considers purpose, necessity, affected people and mitigation.

Contracts should define service boundaries, data use/ownership, security controls, subcontractors, breach notification, audit rights, service levels, evidence access, recovery, return/deletion and termination. An MSA supplies overarching terms; a statement of work defines specific delivery; an SLA defines measurable service commitments and remedies. A credit for downtime may be far smaller than business loss.

Evaluate SOC report type and scope. SOC 1 concerns controls relevant to financial reporting; SOC 2 addresses applicable trust-services criteria; a Type I report considers design at a point in time, whereas Type II includes operating effectiveness over a period. Read exceptions, subservice-organization treatment and complementary customer controls. Do not treat a logo as the report.

Legal holds and discovery requirements may override routine deletion. Negotiate preservation, export formats, access and chain-of-custody assistance before a dispute. Data sanitization in multitenant systems may rely on provider processes and cryptographic techniques; verify contractual assurance rather than demanding physical destruction of shared media indiscriminately.

Risk assessment includes provider viability, concentration, lock-in, supply chains and the organization's ability to operate securely. Insurance, escrow and alternate-provider plans address different consequences and have limitations. Assess an exit plan through tested exports and restoration, not only a termination clause.

Regulatory names are cues to scope, not interchangeable labels. Payment, health, financial and regional privacy obligations differ; certification questions test selecting an appropriate governance process rather than inventing a universal legal rule.

Choose under exam pressure

Traps

• An SLA remedy is not necessarily compensation for all damage.
• A contract cannot simply waive a law that applies to the organization.

Practise this topic