If you design, secure, or audit cloud environments, the Certified Cloud Security Professional (CCSP)® from ISC2 is one of the most recognized ways to prove it. The exam covers a lot of ground, from cloud architecture and encryption to incident response and international privacy law, so it’s normal to feel a little overwhelmed at first. The good news is that ISC2 publishes exactly what it tests, and a study plan built around that blueprint gives you a clear path to passing on your first try.

In this guide, we’ll walk you through the exam format, the six domains and their weights, official resources, and common questions.

What Is the ISC2 CCSP Exam?

The CCSP is an advanced, vendor-neutral certification for experienced IT and cybersecurity professionals who work with cloud environments. ISC2 introduced it in 2015, and it is accredited under ANSI National Accreditation Board (ANAB) ISO/IEC 17024 and approved under U.S. Department of Defense Manual (DoDM) 8140.03.

Because it’s vendor-neutral, the exam tests whether you can apply security principles across Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS), not how to use one provider’s console.

Many questions are written from the perspective of a cloud security leader or advisor, so the best answer often balances risk, business needs, and contractual responsibilities rather than choosing the most technical fix.

What Is the ISC2 CCSP Exam Format?

Here is the exam at a glance, based on the ISC2 CCSP Certification Exam Outline (effective August 1, 2026) and the ISC2 FAQ:

  • Format: Computerized Adaptive Testing (CAT). The exam adjusts to your performance as you go.
  • Questions: 100 to 150 items, depending on how quickly the exam can make a confident pass/fail decision.
  • Time: Up to 3 hours.
  • Question types: Multiple choice plus advanced item types, such as drag-and-drop and hotspot.
  • Passing score: 700 out of 1,000 (a scaled score).
  • Languages: English, Chinese, German, and Japanese.
  • Delivery: Pearson VUE test centers only. ISC2 does not offer online proctoring for its certification exams.
  • Results: You get a preliminary pass/fail result at the test center. Official results can take up to 72 business hours, followed by an email from ISC2.
  • Fee: U.S. $599 in the Americas, per the ISC2 exam pricing page. Rescheduling costs $50 and canceling costs $100.

One CAT detail catches people off guard: you must answer items in order, with no skipping or returning later.

What Content Outline Does the CCSP Exam Use?

Exams taken on or after August 1, 2026, are based on the ISC2 CCSP Certification Exam Outline effective that date. It keeps the same six domains as the prior outline but adds dedicated Artificial Intelligence (AI) and Machine Learning (ML) objectives, including AI for threat detection and protecting AI data sets and models, plus newer references such as the OWASP Top 10 for Large Language Model Applications.

Here is how the domains are weighted. The approximate item counts assume a 150-item exam; a shorter CAT exam scales down proportionally.

  • Domain 1, Cloud Concepts, Architecture and Design: 17% (about 26 items)
  • Domain 2, Cloud Data Security: 20% (about 30 items)
  • Domain 3, Cloud Platform and Infrastructure Security: 17% (about 26 items)
  • Domain 4, Cloud Application Security: 16% (about 24 items)
  • Domain 5, Cloud Security Operations: 17% (about 26 items)
  • Domain 6, Legal, Risk and Compliance: 13% (about 20 items)

Domain 1: Cloud Concepts, Architecture and Design (17%)

This domain is the vocabulary and mental model for everything else: how cloud services are defined, who is responsible for what, and which design principles keep an architecture secure.

  • Cloud roles (cloud service customer, cloud service provider, partner, broker, regulator) and essential characteristics such as on-demand self-service, resource pooling, rapid elasticity, and measured service.
  • Service categories (IaaS, PaaS, SaaS), deployment models, and shared considerations like portability, interoperability, reversibility, and SLAs.
  • Security concepts: cryptography and key management, identity and access control, data sanitization (including cryptographic erase), network security groups, and virtualization and container security.
  • Design principles: the cloud secure data lifecycle, cloud-based BC/DR, business impact analysis, DevOps security, and design patterns such as well-architected frameworks.
  • Evaluating CSPs (Common Criteria, FIPS 140-2) and a new AI/ML objective covering threat detection, SOAR, and ethics.

Study tip: Know the shared responsibility model cold. Many questions in every domain hinge on whether the customer or the provider owns a control in IaaS versus SaaS.

Domain 2: Cloud Data Security (20%)

The largest domain focuses on protecting data through its entire lifecycle.

  • Cloud data lifecycle phases (create, store, use, share, archive, destroy), data dispersion, and data flows.
  • Storage types (object, volume, ephemeral, raw, long-term) and the threats to each.
  • Encryption and key management, hashing, masking, anonymization, tokenization, and Data Loss Prevention (DLP).
  • Data discovery, classification, Information Rights Management (IRM), retention, legal hold, and chain of custody.
  • Privacy and security of AI/ML data sets and models.

What questions look like: A scenario describes sensitive data in a test environment and asks for the best protection. You’ll need to tell masking, tokenization, and anonymization apart and pick the one that fits the use case.

Domain 3: Cloud Platform and Infrastructure Security (17%)

This domain covers the physical and virtual foundation underneath cloud services and how you protect and recover it.

  • Infrastructure components: physical environment, network, compute, virtualization, storage, and the management plane.
  • Secure data center design: logical (tenant partitioning), physical (location, buy or build), environmental (HVAC, multi-vendor connectivity), and resilience.
  • Risk assessment and treatment for cloud vulnerabilities, threats, and attacks.
  • Security controls, including identification, authentication, and authorization, and audit mechanisms such as log collection, correlation, and packet capture.
  • BC/DR strategy, RTO, RPO, and plan testing.

Study tip: Be sure you can explain why the management plane is the highest-value target in a cloud environment.

Domain 4: Cloud Application Security (16%)

This domain covers building and buying secure cloud software.

  • Training and awareness, including common vulnerabilities from the OWASP Top 10, OWASP API Security Top 10, OWASP Top 10 for LLM Applications, and SANS Top 25.
  • The Secure Software Development Life Cycle (SDLC) and threat modeling methods such as STRIDE, DREAD, ATASM, and PASTA.
  • Testing methodologies: SAST, DAST, IAST, software composition analysis (SCA), and abuse case testing.
  • API security, supply-chain and third-party software management, and validated open-source software.
  • Supplemental components (WAF, database activity monitoring, API gateways), sandboxing, containers and Kubernetes, and IAM solutions such as federation, SSO, MFA, and CASB.

What questions look like: Expect to choose the right testing type for a stage of the pipeline, such as SAST on source code before a build versus DAST against a running app.

Domain 5: Cloud Security Operations (17%)

This domain is about running cloud infrastructure securely day to day.

  • Building and operating physical and logical infrastructure: HSMs and TPMs, secure-by-default configurations, and type 1 and type 2 hypervisors.
  • Access and network controls, including jump boxes, bastion hosts, SSH, VLANs, TLS, DNSSEC, IDS/IPS, and segmentation.
  • Operational standards (NIST, ISO, ITIL, CIS Controls, COBIT, COSO) and ITIL-style management processes, from change to capacity management.
  • Digital forensics, evidence handling, the SOC, SIEM and log analysis, incident response, and communication with vendors, customers, and regulators.

Study tip: Incident management restores service; problem management finds the root cause. Know the difference.

Domain 6: Legal, Risk and Compliance (13%)

The smallest domain is often the least familiar to technical candidates.

  • Conflicting international laws, eDiscovery (ISO/IEC 27050), and forensic standards.
  • Privacy: PII versus PHI, GDPR, HIPAA, PIPEDA, FERPA, India’s Digital Personal Data Protection Act, ISO/IEC 27018, and privacy impact assessments.
  • Audit processes, SOC reports and SSAE/ISAE standards, audit scope restrictions, and gap analysis.
  • Enterprise risk management and risk treatment (avoid, mitigate, transfer, share, accept).
  • Contract design: SLAs, MSAs, SOWs, right to audit, vendor lock-in, escrow, supply-chain management (ISO/IEC 27036), and data roles such as owner, controller, custodian, and processor.

What questions look like: A customer can’t audit a provider’s data center. The best answer usually involves reviewing a SOC 2 Type II report or ISO/IEC 27001 certification.

How Should You Use the CCSP Blueprint to Build a Study Plan?

The weights are fairly balanced, so no domain is safe to skip.

  1. Take a mixed baseline. Answer questions from all six domains before you start reviewing.
  2. Rate every objective. Mark each numbered objective (1.1 through 6.5) as strong, developing, or weak.
  3. Prioritize by weight and weakness. A weak Cloud Data Security (20%) score deserves more time than the same score in Domain 6 (13%).
  4. Map every miss to an objective. Note which objective it tests and why the right answer was better.
  5. Mix it up before exam day. Practice mixed, timed sets where you commit to each answer, just like the CAT exam.

What Official Resources Should You Use?

Commonly used ISC2 CCSP study textbooks:

  • (ISC)2 CCSP Certified Cloud Security Professional Official Study Guide, 3rd Edition (ISBN 978-1119909378)
  • Practical Cloud Security: A Guide for Secure Design and Deployment, 2nd Edition (ISBN 978-1098148171)
  • The Official ISC2 CCSP CBK Reference, 4th Edition (ISBN 978-1119909019)
  • (ISC)2 CCSP Certified Cloud Security Professional Official Study Guide, 4th Edition (ISBN 978-1394316236)

Frequently Asked Questions About the ISC2 CCSP Exam

What is the passing score for the CCSP?
You need a scaled score of 700 out of 1,000. On an adaptive exam, the number of items you see doesn’t tell you whether you passed.

Did the CCSP exam outline change recently?
Yes. A new outline took effect August 1, 2026. The six domains are the same, but the weights shifted slightly, and new AI/ML objectives were added to Domains 1 and 2.

Can I take the CCSP exam before I have five years of experience?
Yes. If you pass without the required experience, you become an Associate of ISC2 and have six years to earn it.

What happens if I fail the CCSP exam?
You can retest 30 days after your first attempt, with longer waits after later attempts. Each attempt requires a new exam fee. See the ISC2 FAQ for current policies.

How do I maintain the CCSP once I earn it?
You earn 90 continuing professional education (CPE) credits every three years and pay a U.S. $135 annual maintenance fee.

Start Preparing for the ISC2 CCSP Exam With Pocket Prep

Pocket Prep’s ISC2 CCSP practice questions include 1,600 questions with detailed explanations for every answer, plus a full-length 150-question mock exam to rehearse for exam day. Start with a mixed Quick 10 to find your baseline, then let the Weakest Subject quiz steer your time toward the domains that need it most. With a consistent study plan, you’ll walk into exam day with confidence.