Study guide
1.1 CCSK v5 Exam Structure, Logistics & Open-Book Strategy
Certificate of Cloud Security Knowledge CCSK v5
Track your progress as you read
Finished sections get a check mark.
1 Chapter 1: CCSK Exam Overview & CSA Security Frameworks
1.1 CCSK v5 Exam Structure, Logistics & Open-Book Strategy 1.2 CCSK v5 Source Hierarchy & CSA Cloud Architecture 1.3 CSA Assurance Tools: CCM v4.1, CAIQ v4.1 & the STAR Registry
2 Chapter 2: Cloud Computing Concepts & Architectures
2.1 Cloud Definition, Essential Characteristics & ISO/IEC Standards 2.2 Cloud Service Models (IaaS, PaaS, SaaS) & Abstraction Layers 2.3 Cloud Deployment Models & Shared Responsibility in Practice
3 Chapter 3: Cloud Governance
3.1 Enterprise Governance, Cloud Strategy & Policy Frameworks 3.2 Contracts, Service Level Agreements (SLAs) & Vendor Due Diligence 3.3 Cloud Governance Operating Models & CCM Control Implementation
4 Chapter 4: Risk, Audit, & Compliance
4.1 Cloud Risk Management, Risk Tolerance & Shared Risk Profiles 4.2 Audit Principles, Assurance Inheritance & Third-Party Reports (SOC & ISO) 4.3 Compliance Assessment, Continuous Auditing & Regulatory Mandates
5 Chapter 5: Organization Management
5.1 Cloud Center of Excellence (CCoE) & Organizational Design 5.2 Cloud Vendor Management, Supply Chain Risk & Multi-Cloud Operations 5.3 Cloud Financial Governance (FinOps), Business Continuity & People 5.4 Provider Organization Hierarchies, Identity Mapping & Shared Services
6 Chapter 6: Identity & Access Management
6.1 Cloud IAM Architecture: Authentication, Authorization & RBAC vs. ABAC 6.2 Identity Federation: SAML 2.0, OpenID Connect, OAuth 2.0 & SCIM 6.3 Privileged Access Management (PAM), CIEM & Cloud Secrets Lifecycle
7 Chapter 7: Security Monitoring
7.1 Cloud Telemetry Architecture, Audit Logging & Control Plane Trails 7.2 Cloud Security Posture Management (CSPM) & Configuration Baselining 7.3 Centralized SIEM/SOAR Integration, Cloud Detection and Response (CDR) 7.4 Cloud Telemetry Sources, Collection Architecture & Retention 7.5 AI for Security Monitoring: Use Cases, Risks & Governance
8 Chapter 8: Infrastructure & Networking
8.1 Virtualization Foundations, Hypervisors & Multi-Tenant Isolation 8.2 Cloud Virtual Networks, Subnetting, Security Groups & Microsegmentation 8.3 Hybrid Connectivity, Software-Defined Perimeters (SDP) & DDoS/WAF Defense 8.4 Infrastructure as Code Security, Policy Gates & Drift Control
9 Chapter 9: Cloud Workload Security
9.1 Virtual Machine (VM) Hardening, Golden Images & Immutable Infrastructure 9.2 Container Security: Image Scanning, Registries & Runtime Defense 9.3 Kubernetes Orchestration Security, Serverless (FaaS) & CWPP/CNAPP 9.4 Cloud Workload Types, Security Boundaries & Control Substitution
10 Chapter 10: Data Security
10.1 Cloud Data Lifecycle (CSU-SAD) & Data Discovery/Classification 10.2 Cloud Cryptography: Data at Rest, In Transit (TLS 1.3) & In Use (Confidential Computing) 10.3 Key Management Systems (KMS), HSMs, BYOK/HYOK & Cloud DLP 10.4 Cloud Storage Models & Object Storage Security 10.5 Data Security Posture Management & AI Data Protection
11 Chapter 11: Application Security
11.1 Secure Software Development Lifecycle (SSDLC) & DevSecOps Pipelines 11.2 Application Security Testing: SAST, DAST, SCA & SBOM 11.3 Cloud API Security: OWASP API Top 10 & API Gateway Protections
12 Chapter 12: Incident Response & Resilience
12.1 Cloud Incident Response Lifecycle, Cloud Challenges & Playbooks 12.2 Cloud Digital Forensics: Ephemeral Workloads, Snapshots & Chain of Custody 12.3 Cloud Resilience, Business Continuity & Disaster Recovery Patterns
13 Chapter 13: Related Technologies & Strategies
13.1 Zero Trust Architecture in Cloud (NIST SP 800-207 Principles & Execution) 13.2 Secure Access Service Edge (SASE) & Cloud Access Security Brokers (CASB) 13.3 Artificial Intelligence & Machine Learning Security (CSA AI Safety & LLM Risks) 13.4 CCSK v5 Synthesis, Cross-Domain Scenarios & Exam-Day Strategy
1.1 CCSK v5 Exam Structure, Logistics & Open-Book Strategy
Key Takeaways Explain This Topic AI
CCSK v5 has 60 multiple-choice questions, a 120-minute limit, and an 80% passing score.
The current $445 exam-and-chatbot purchase includes two attempts that remain valid for two years.
CSA delivers the exam online through CSA Exams; no appointment or testing center is required, and results are available immediately.
The current official exam languages are English, Spanish, and Japanese, and the CCSK certificate does not expire.
The CCSK v5 Study Guide is the exam body of knowledge; the curriculum and other CSA publications are useful supplements.
Last updated: September 2026
1.1 CCSK v5 Exam Structure, Logistics & Open-Book Strategy
Quick Answer: CCSK v5 is an online, open-book examination with 60 multiple-choice questions , 120 minutes , and an 80% passing score . CSA currently sells an exam-and-chatbot purchase for $445 USD ; it includes two attempts , and the attempts remain valid for two years . The exam is available in English, Spanish, and Japanese . CSA does not require a scheduled testing appointment or a test center, provides the result immediately, and states that the certificate does not expire.
The Certificate of Cloud Security Knowledge is the Cloud Security Alliance's vendor-neutral assessment of cloud-security concepts. It tests how service models, shared responsibility, governance, identity, monitoring, infrastructure, workloads, data, applications, incident response, Zero Trust, and artificial intelligence interact. There are no formal education, experience, or training prerequisites. Basic familiarity with security concepts such as firewalls, encryption, secure development, and IAM is helpful, but official training is optional.
Current exam facts
Item Current CSA information What it means for preparation
Questions 60 multiple-choice questions selected from a larger pool Prepare across all 12 domains rather than memorizing a fixed form
- Time 120 minutes The average budget is two minutes per question
- Passing score 80% Mathematically, 48 of 60 equally scored questions is 80%
- Delivery Online and open book No appointment or testing center is required
- Purchase $445 exam-and-chatbot package One purchase includes two attempts
- Attempt validity Two years from purchase Both attempts must be used before the purchase expires
- Retake wait No enforced waiting period A second attempt can be taken when the candidate is ready
- Languages English, Spanish, and Japanese Select the available language that best supports accurate reading
- Credential validity Certificate does not expire CSA does not impose a recertification cycle for CCSK
CSA made the CCSK v5 examination available on July 16, 2024 . Current preparation should therefore use the v5 curriculum and body of knowledge. An older candidate may encounter v4 notes on the web, but dates or transition claims should be accepted only when they appear on a current CSA page.
Know which documents are authoritative
CSA's exams FAQ identifies the CCSK v5 Study Guide as the body of knowledge for the exam. That point matters because several useful CSA resources serve different purposes:
CCSK v5 Study Guide: the primary exam study material and the first place to verify a tested concept.
CCSK v5 Curriculum: the official 12-domain objective outline. Use it as a coverage checklist; CSA does not publish percentage weights for these domains.
CCSK v5 Knowledge Guide and sample questions: preparation aids for review and practice.
Security Guidance v5: a broader cloud-security reference. CSA explicitly describes it as more comprehensive than the exam requires, so it is supplementary rather than a prerequisite for passing.
CCM, CAIQ, and STAR materials: operational assurance resources that help explain controls and provider assessment. They should not displace the Study Guide as the exam body of knowledge.
This document hierarchy prevents a common open-book mistake: searching a very large reference when the tested definition is presented more directly in the Study Guide.
A defensible open-book workflow
Open book does not mean lookup only. The clock permits an average of two minutes per item, including reading the scenario, comparing four choices, and selecting an answer. A candidate who begins a broad search for every question quickly consumes the available time.
Use the following preparation pattern:
Learn the concepts before test day, especially shared-responsibility boundaries and the differences among governance, posture, workload, and data controls.
Keep the current CCSK v5 Study Guide locally searchable and use the curriculum as a compact index.
Build personal bookmarks by domain and by difficult terms. The bookmarks should point to material already studied, not replace study.
Practice timed mixed-domain sets. After each miss, explain why the correct control fits the service model and why each distractor fails.
Confirm the testing environment and the current CSA Exams instructions before launching the attempt.
Suggested three-pass pacing
The following is an ExamFinch recommendation , not a CSA-mandated procedure and not a promise about interface features:
Pass 1: establish coverage
Move through the form at a steady pace. Answer direct definitions and clear shared-responsibility questions. If the interface permits marking items for review, mark uncertain items; otherwise record their numbers separately. Avoid broad document searches.
Pass 2: resolve scenarios
Return to difficult items and identify four things before choosing: the service model, the protected asset, the responsible party, and the control objective. Eliminate answers that require access the customer does not possess or that solve a different layer of the problem.
Pass 3: perform narrow verification
Use remaining time for exact terms, lifecycle order, or a close distinction between two plausible controls. Search the Study Guide first. Consult a supplementary reference only when it is genuinely the clearest source.
Reserve several minutes to verify that every question has an answer. Because CSA selects questions from a larger pool, memorizing answer patterns from a sample set is not a valid strategy; understanding the architecture is.
Common preparation errors
Inventing blueprint weights: CSA's curriculum lists domains and objectives but does not assign percentages. Study breadth, objective count, and personal weakness instead.
Treating provider assurance as customer compliance: a provider report covers a defined provider scope. The customer must still implement and evidence controls in its own responsibility boundary.
Using stale logistics: price, languages, platform behavior, and study materials can change. Recheck CSA before purchase and before the attempt.
Treating a second attempt as disposable: two attempts provide recovery, but each should be supported by deliberate preparation and review.
Searching before reasoning: first identify the security principle. A narrow verification is faster than scanning entire publications for a generic word such as security or encryption.