Certified Cloud Security Professional (CCSP)

Montag – Kick-off + Domain 1: Cloud Concepts, Architecture & Design

• Begrüßung, Ziele, Kursstruktur, Lerntechnik (CCSP-Denkweise, Exam-Format, CBK-Überblick)
• Exam-Überblick: Fragetypen, Zeitmanagement, Shared-Responsibility-Modell, Cloud-Kategorien (IaaS/PaaS/SaaS) und Deployment-Modelle (Public/Private/Hybrid/Community)
• Domain 1 – Cloud Concepts, Architecture & Design (Teil 1): Cloud Computing Definitions & Characteristics, Cloud Service Models, Deployment Models, Cloud Reference Architecture (ISO/IEC 17788), Cloud Roles & Responsibilities
• Domain 1 (Teil 2): Key Cloud Enabling Technologies (Virtualization, Storage, Networking, Databases), Cloud Computing Security Challenges, Design Principles of Secure Cloud Computing, Cloud Secure Data Lifecycle
• Domain 1 (Teil 3): Business Continuity & Disaster Recovery in the Cloud, Cloud Security Alliance (CSA) Frameworks, Cost-Benefit-Analyse, Cloud Governance
• Fragenblock: 20–25 Fragen (ca. 30–35 Min) inkl. ca. 20% Szenariofragen + Kurzreview

Dienstag – Domain 2: Cloud Data Security

• Domain 2 – Cloud Data Security (Teil 1): Cloud Data Lifecycle (Erstellen, Speichern, Nutzen, Weitergeben, Archivieren, Vernichten), Cloud Storage Architectures, Data Security Strategies
• Domain 2 (Teil 2): Datenverschlüsselung & Key Management (CSP vs. Customer Keys), IRM/DRM, DLP, Data Discovery & Classification Technologies
• Domain 2 (Teil 3): Cloud Data Retention, Deletion & Archiving Policies, Privacy (GDPR/DSGVO-Bezug), Auditability of Cloud Data, Jurisdiktionsfragen bei Datenspeicherung
• Domain 2 (Teil 4): Data Events in Cloud Environments, Cloud Storage Security (Object/Block/File), Datenbankabsicherung in der Cloud, Backup & Recovery
• Fragenblock: 20–25 Fragen (ca. 30–35 Min) inkl. ca. 20% Szenariofragen + Kurzreview

Mittwoch – Domain 3: Cloud Platform & Infrastructure Security

• Domain 3 – Cloud Platform & Infrastructure Security (Teil 1): Cloud Infrastructure Components (Physical, Network, Compute, Storage), Datacenter Design & Security, Supply-Chain-Risiken
• Domain 3 (Teil 2): Virtualization Security (Hypervisor, Container, Serverless), Cloud Network Security (SDN, Mikro-Segmentierung, Firewalls), Secure Baseline & Hardening
• Domain 3 (Teil 3): Management Plane Security, Business Continuity & DR in Cloud Infrastructure, Disaster Recovery Planning für Cloud Workloads, Backup-Strategien
• Domain 3 (Teil 4): Risk Assessment für Cloud Infrastructure, Vulnerability Management, Penetration Testing im Cloud-Kontext (Erlaubnisrahmen CSP), Physical & Environmental Security des CSP
• Fragenblock: 20–25 Fragen (ca. 30–35 Min) inkl. ca. 20% Szenariofragen + Kurzreview

Donnerstag – Domain 4: Cloud Application Security

• Domain 4 – Cloud Application Security (Teil 1): Advocate Training and Awareness for Application Security, Cloud Software Assurance & Validation, Verified Secure Software (OWASP Top 10 Cloud-Kontext)
• Domain 4 (Teil 2): SDLC in der Cloud (Secure Design, Requirements, Code Review, Testing), Threat Modeling (STRIDE/DREAD – CCSP-Ebene), Software Composition Analysis & SBOM
• Domain 4 (Teil 3): Identity & Access Management in Cloud Applications (Federation, SAML/OIDC), API Security, Supplemental Security Devices (WAF, CASB, SASE)
• Domain 4 (Teil 4): Cloud-native Security Controls, DevSecOps im Cloud-Kontext, Supply Chain Security, Cryptography für Cloud Applications
• Fragenblock: Mini-Mock 30–40 Fragen (50 Min) inkl. Auswertung (Top-Fehler & Begründungen)

Freitag – Domain 5 & 6 + Gesamtwiederholung

• Domain 5 – Cloud Security Operations (Teil 1): Implement & Build Physical Infrastructure for Cloud (Hardware Config, Installation), Operate Physical Infrastructure, Managed Cloud Infrastructure Service, Incident Management
• Domain 5 (Teil 2): Manage Logical Infrastructure (Provisioning, Monitoring, Patch & Change Management), Digital Forensics in der Cloud (Herausforderungen, Beweissicherung), Kommunikation mit Behörden
• Domain 6 – Legal, Risk & Compliance (Teil 1): Legal Requirements & Unique Risks, Jurisdiktionen, eDiscovery & Forensics, Cloud-Vertragsrecht (SLA, Haftung)
• Domain 6 (Teil 2): Privacy (GDPR/DSGVO, CCPA), Compliance Frameworks für Cloud (ISO 27017/27018, SOC 2, FedRAMP, CSA STAR), Audit-Management, Vendor Risk Assessment
• Fragenblock: 40 gemischte Fragen (45 Min) inkl. ca. 20% Szenariofragen Auswertung + High-Yield-Fallen + Prüfungsstrategie (Best Answer, Prioritäten, Zeitmanagement, CCSP-spezifische Denkweise: Verantwortung des Cloud Security Architects)

Hinweis: Der Richtplan kann je nach Gruppe (Vorkenntnisse/Tempo) angepasst werden. Die Gewichtung orientiert sich an der offiziellen ISC² CCSP Exam Outline: Domain 1 (17%), Domain 2 (20%), Domain 3 (17%), Domain 4 (17%), Domain 5 (16%), Domain 6 (13%).