CCSP and Me: A Practical Guide To Getting CCSP Certified
In late January this year, I decided to bite the bullet and tackle the illustrious Certified Cloud Security Professional (CCSP) certification. Going into it, I knew this wasn’t going to be a walk in the park, largely due to what most people are saying in places like Reddit (https://www.reddit.com/r/CCSP) and other certification platforms but also from my own experience taking the CISSP certification back in March 2018. It’s true; ISC2 does push you to your limits when taking their certifications.
I often get people messaging me asking for tips on how to prepare for the CCSP exam and what resources I used, etc. So I figured it was about time I put something together and detail my approach to taking down an increasingly popular career-building certification.
For those coming in cold, here are some quick facts about the CCSP exam that became effective as of August 1st this year (2022):
Length of exam: 4 Hours
Number of questions: 150
Type of questions: Multiple Choice
Passing score: 700 points out of 1000
The refreshed exam costs $599 (USD) or around $879 (AUD) at the time of this writing.
Here are the key topics (domains) covered by the exam and their associated weighting:
Domain 1: Cloud concepts, architecture and design (17%)
Domain 2: Cloud data security (20%)
Domain 3: Cloud platform and infrastructure security (17%)
Domain 4: Cloud application security (17%)
Domain 5: Cloud security operations (16%)
Domain 6: Legal, risk and compliance (13%)
Now let’s dive into the resources. Despite the exam being recently refreshed, a lot of the below material can still be used to prepare for the exam effectively. I would, however, highly recommend using one current/up-to-date resource for the main CCSP reading material. Here is the latest publication from Sybex and ISC2 for the CCSP Common Body of Knowledge (CBK), but do make sure to have a look for whatever is most current at the time.
Below is my complete list of study materials that I used in preparing for the CCSP exam.
Books/reading material:
CCSP AIO 2nd Edition
CSA Top Threats - Egregious Eleven
CSA SECaaS Documents (CSA publish a number of other SECaaS documents covering many other security topics - see here for more information).
DLP Guidance
IAM Guidance
Cirrus 8,000ft CCSP
Alukos Notes (https://ccsp.alukos.com/)
CCSP Key Notes
Media/Videos:
Prabh Nair CCSP Series: https://youtu.be/OzzqfFFNxc0
Practice questions:
100 flashcards for CCSP for Dummies
AIO Practice Questions
Sybex CCSP Practice Questions (2020)
CCSP for Dummies Practice Exams ( 2 x 100q)
How I Studied:
In total, I gave myself somewhere between 4 to 5 months to prepare for the CCSP exam. I spent the first three months on passive study, with the next 1-2 months actively studying.
When it comes to certifications, there’s really no one size that fits all; everyone is different, and everyone has their own preferred methods and techniques when it comes to studying or learning in general. Depending on your lifestyle and any related prior experience you may have with working in cloud security, I would say you could take this exam in roughly one to three months if you have the time available.
Passive Study (2-3 months out):
I used this time to get through my main reading material. This was a combination of the AIO 2nd edition, CCSP Dummies, and the CSA v4 guidance. I was reading about 60-70 pages a week, usually knocking out a domain a week or just over. Highlighting/noting the key points/areas within each domain to come back and review one week before taking the exam.
Active Study (1 month out):
After finishing all of my main reading material. I activated my online CCSP practice exam content and began going through the 100 flashcards and two practice exams (2 x 100q) that came with the CCSP for Dummies book. I used this practice material to gauge my level of readiness and see which areas I was lacking. During this time, I also went through Cirrus 8,000ft, CCSP Key Notes, and looked up specific things in the Alukos Notes.
In addition to the above, I was also working my way through all the single-domain practice questions in the Sybex official practice exam book (2nd edition – 2020). This was a tough grind, and by the time I was done with all the practice questions from CCSP for dummies, AIO, and Sybex, I had answered 1,154 questions in total, and my head felt like it was about to explode. No more practice questions at this point. I was done!
Game Day (The Exam)
Taking all of the above into consideration, the number of resources I used to prepare, and the exhaustive number of practice questions I did, the actual exam itself didn’t feel as difficult as I expected.
All the questions I faced were multiple-choice except for 1 question that was a drag-and-drop.
For most of the questions I answered, I was 90% or more confident in the answer.
The language used in all the questions wasn’t tricky or hard to decipher; each question was straightforward and made sense.
The unscored questions were a little obvious, in my opinion, and were a decent level of difficulty.
No time pressure. I was trying to answer the questions in around 1 minute or less. However, a few questions had me thinking through different scenarios for 1-3 minutes.
By the time I clicked “end exam”, I was ~85% sure I had passed.
Exam date: 26/05/2022
Result: Pass
Time taken: 2 hours 20 minutes
What would I do differently?
Honestly, not much. I think my preparation was quite extensive, maybe a little too heavy on the books, but given how I felt during the exam and how the questions I faced during the exam didn’t seem so difficult, it’s hard to say whether I would have done so well had it not been for the extent of my preparation.
I’d probably cap the practice questions to around ~700 or so (including some simulated practice exams with 125-150q), as this amount should be more than enough to give you a good indication of how ready you are while also building up your “exam endurance” to avoid getting mental fatigue after answering 80-90 questions straight.
I hope all of the above information is helpful to anyone looking to prepare for the CCSP exam in the coming weeks/months/years. It’s a great one to have on the resume, and it doesn’t expire in 1-2 years like many other certifications out there (as long as you clock up some CPEs ;)).
Good luck!
