CCSK (Certificate of Cloud Security Knowledge) Training Course Outline
Course Overview
This 28-hour live instructor-led online training is a comprehensive preparation for the Certificate of Cloud Security Knowledge (CCSK) certification. It is structured similar to a CEH course, with well-defined modules including learning objectives, key topics, and hands-on labs. The course assumes no prior cloud security experience, making it suitable for students and professionals alike. Practical AWS Labs are integrated throughout, emphasizing real-world cloud security applications on Amazon Web Services. By the end of the course, participants will have a solid grasp of cloud security fundamentals and be well-prepared for the CCSK exam.
Target Audience: IT professionals, security staff, developers, IT operations teams, audit/compliance personnel, and anyone interested in cloud security. (No prior cloud experience required.)
Prerequisites: None required. A basic understanding of general IT security (firewalls, encryption, IAM, etc.) is helpful but not mandatory.
Delivery Mode: Live online (instructor-led) with interactive lectures, discussions, and guided labs.
Focus: Primarily AWS cloud services for hands-on practice (AWS account setup, IAM, monitoring, networking, etc.), while remaining vendor-neutral in core concepts (per CCSK exam domains).
Course Objectives: By completion, you will be able to explain core cloud computing concepts and architectures, implement cloud governance and risk management strategies, secure cloud infrastructure and data, manage cloud identities and access, monitor cloud environments, apply secure DevOps practices, and respond to cloud incidents – all aligning with CCSK exam domains.
GET A FREE DEMO CLASS
Course Curriculum
-
Module 1: Cloud Computing Concepts & Architectures (2 Hours)
Learning Objectives: Establish a foundation in cloud computing terminology and models. Identify essential cloud characteristics, service models, and deployment architectures. Understand the shared responsibility model between cloud providers and customers for security. Prepare a base for AWS-specific discussions by exploring how AWS exemplifies these concepts.
Key Topics:
-
Defining Cloud Computing – On-demand self-service, broad network access, resource pooling, elasticity, measured service.
-
Cloud Service Models – IaaS, PaaS, SaaS definitions and examples (e.g., AWS EC2 as IaaS, AWS Elastic Beanstalk or Lambda as PaaS, SaaS offerings).
-
Cloud Deployment Models – Public, Private, Hybrid, Community clouds and real-world use cases.
-
CSA Cloud Architecture – Introduction to the CSA Enterprise Architecture model and how it maps to cloud security controls.
-
Shared Security Responsibility – Overview of what cloud providers vs. customers secure (with AWS as primary example).
Hands-On Lab: Setting up a new AWS account securely. In the first lab, you will configure fundamental security settings in AWS: enable multi-factor authentication (MFA) on the root account, review AWS Identity and Access Management (IAM) default roles, and explore the AWS console to identify core services (compute, storage, network). This lab reinforces cloud service models and basic security baseline in the first minutes of using AWS .
Assessment: End-of-module quiz covering cloud definitions, service/deployment models, and responsibility demarcation.
-
-
Module 2: Cloud Governance (1.5 Hours)
Learning Objectives: Understand organizational governance in the cloud. Learn how policies, frameworks, and governance structures are applied in cloud environments to ensure compliance and strategic alignment. Recognize how cloud governance frameworks and standards influence AWS cloud management and security configurations.
Key Topics:
-
Cloud Governance Fundamentals – Defining governance and its importance in cloud strategy.
-
Governance Hierarchy – Linking business objectives to cloud policies and controls (from corporate policy down to technical guidelines).
-
Cloud Security Frameworks – Overview of industry frameworks (e.g., CSA Cloud Controls Matrix, NIST, ISO 27017) and how they map to cloud controls.
-
Policy Management – Developing cloud security policies and standards (acceptable use, data management, etc.).
-
AWS Governance Tools – Introduction to AWS Organizations for multi-account management and AWS Config for policy as code.
Hands-On Lab: Governance in Action. Use AWS Organizations to create a multi-account structure and apply a Service Control Policy (SCP) to enforce a governance rule (for example, restrict certain regions or services). Explore AWS Config to set up a cloud configuration rule (e.g., ensure S3 buckets have logging enabled) and see compliance results. This lab demonstrates implementing governance controls in AWS.
Assessment: Case-study discussion – Given a scenario, students identify governance requirements and choose appropriate cloud controls.
-
-
Module 3: Risk Management, Audit & Compliance (3 Hours)
Learning Objectives: Learn to assess and manage cloud-specific risks. Understand compliance obligations in the cloud and how to prepare for audits. Develop skills in evaluating cloud service providers (with a focus on AWS compliance programs) and maintaining a cloud risk register for your organization.
Key Topics:
-
Cloud Risk Management – Identifying unique cloud risks (multi-tenancy, data residency, etc.) and applying risk assessment methodologies.
-
Cloud Risk Register – How to compile and maintain a register of cloud risks and mitigation measures (tie to CSA guidance).
-
Compliance in the Cloud – Overview of regulations and standards (GDPR, PCI-DSS, HIPAA, etc.) relevant to cloud deployments.
-
Compliance Inheritance – Understanding how cloud customers can leverage provider certifications (e.g., AWS’s compliance programs).
-
Cloud Audit Processes – Preparing for and conducting audits of cloud environments (AWS audit reports, AWS Artifact tool).
-
Artifacts of Compliance – Cloud provider documentation and controls mappings (AWS Artifact, CSA STAR registry).
Hands-On Lab: Cloud Compliance Check. In this lab, you will use AWS tools to assess compliance: enable AWS CloudTrail and AWS Config, then run AWS Config’s built-in conformance packs (which map to standards like CIS or PCI). You will analyze the output to identify compliance gaps. This gives practical experience in auditing an AWS environment for security best practices. (Note: No sensitive data is used; this is a controlled exercise.)
Assessment: Interactive quiz with sample scenarios – e.g., choosing responses to a cloud security incident vs. compliance violation, mapping cloud controls to risk categories.
-
-
Module 4: Cloud Organizational Management (1.5 Hours)
Learning Objectives: Understand how cloud providers structure accounts and services for large organizations. Learn best practices for AWS organization and account structuring, role segregation, and managing hybrid/multi-cloud setups.
Key Topics:
-
Organization Hierarchies – How cloud providers (especially AWS) allow hierarchical account management (master/member accounts, organizational units).
-
Roles and Responsibilities – Mapping enterprise roles to cloud roles (e.g., Cloud Architect, Cloud Security Engineer, etc.) and setting up role-based access across accounts.
-
Common Shared Services – Identifying services typically centralized (e.g., identity, logging, networking) in multi-account AWS environments.
-
Hybrid & Multi-Cloud Considerations – Strategies for consistent security across hybrid deployments and multiple cloud providers. (E.g., using AWS Outposts or Azure Arc in hybrid scenarios.)
-
SaaS Organizational Management – Challenges when using third-party SaaS and how to extend identity/governance controls to them.
Hands-On Lab: AWS Multi-Account Setup. Students will simulate a small enterprise by creating multiple AWS accounts (or using provided sandboxes) under an AWS Organization. They will practice setting up an AWS Single Sign-On (AWS IAM Identity Center) to centrally manage user access to multiple accounts, demonstrating centralized identity and organization-wide security baseline.
Assessment: Class discussion on designing a cloud organization for a hypothetical company, ensuring isolation of dev/test/prod and centralized security services.
-
-
Module 5: Identity & Access Management (2 Hours)
Learning Objectives: Master cloud Identity and Access Management principles with an emphasis on AWS IAM. Learn how to manage users, groups, roles, and federated identities in a cloud context. Understand modern authentication, authorization, and privilege management techniques to enforce least privilege across cloud resources.
Key Topics:
-
IAM Fundamentals – Identity vs. account vs. role; authentication vs. authorization in cloud.
-
Federation & SSO – How federated identity works (SAML/OAuth/OIDC integration) to allow enterprise logins in AWS. Common standards and implementing SSO with AWS SSO.
-
Strong Authentication – Multi-factor authentication (MFA) options in AWS, password policies, and the role of certificates/keys.
-
Access Management in AWS – IAM policies (JSON policy structure), permission boundaries, attribute-based access control (ABAC) and tag-based permissions.
-
Privileged User Management – Managing administrative accounts, using roles for elevated access (AWS IAM roles and AWS Security Token Service), and just-in-time access concepts.
-
Secrets Management – Overview of managing secrets/keys in cloud (AWS Secrets Manager, AWS KMS for key management).
Hands-On Lab: Building on previous labs, this lab dives into AWS IAM: you will create IAM users and groups with custom policies, set up an IAM role for cross-account access, and test federated login using an external Identity Provider (simulated via AWS IAM Identity Center). You will also implement an attribute-based access control scenario (e.g., allowing developers to access only resources tagged with their project). This hands-on experience solidifies understanding of cloud IAM controls.
Assessment: Practical assignment – Students must interpret a given AWS IAM policy and identify what access it grants/denies. Short quiz on IAM concepts (e.g., federation vs. delegation, analyzing sample trust policies).
-
-
Module 6: Cloud Security Monitoring & Threat Detection (2 Hours)
Learning Objectives: Learn how to monitor cloud environments and detect security issues in real-time. Gain familiarity with cloud logging, monitoring services, and automated threat detection tools (AWS CloudWatch, CloudTrail, GuardDuty, Security Hub). Understand how cloud telemetry differs from on-premise and how AI/ML is enhancing cloud monitoring.
Key Topics:
-
Cloud Monitoring Overview – The types of cloud logs and events to monitor (management plane logs, data plane logs, network logs, etc.).
-
AWS Logging Services – AWS CloudTrail for API activity logs, AWS CloudWatch for metrics and alarms, VPC Flow Logs, and AWS Config for configuration change tracking.
-
Cloud Telemetry Sources – Gathering data from management plane (AWS CloudTrail events), service/application logs (e.g., S3 access logs), resource logs (e.g., OS logs on EC2).
-
Security Monitoring Tools – AWS GuardDuty for threat detection, Amazon Inspector for vulnerability scanning, AWS Security Hub for centralized alerting and posture management.
-
Posture Management – Introduction to Cloud Security Posture Management (CSPM) tools that go “beyond logs” to continuously assess configurations.
-
AI for Monitoring – How AI/ML can help identify anomalies and advanced threats (e.g., Amazon Macie for data loss detection, behavioral analytics).
Hands-On Lab: Threat Detection Exercise. Students will enable AWS GuardDuty in a test environment and simulate suspicious activity (such as an SSH login brute force on an EC2 instance using provided scripts or triggering a GuardDuty sample finding). They will then use AWS CloudWatch and CloudTrail consoles to trace the activity and see how alerts are generated. This lab helps connect log data to security alarms in AWS.
Assessment: Students answer questions on which AWS service to use for given monitoring tasks (e.g., “Which service would you use to get alerted on unusual DNS requests from EC2 instances?”). Review of sample log excerpts to identify potential security issues.
-
-
Module 7: Cloud Infrastructure & Network Security (3.5 Hours)
Learning Objectives: Deep dive into securing cloud infrastructure and networks, with a focus on AWS networking constructs. Learn to design secure cloud networks (VPCs, subnets) and apply both preventive and detective controls to cloud infrastructure. Understand how Infrastructure as Code (IaC) and concepts like Zero Trust apply to cloud deployments.
Key Topics:
-
Virtual Networking (AWS VPC) – Cloud network fundamentals (software-defined networking). Setting up VPCs, subnets, route tables, Internet Gateways, NAT, etc., and how these isolate and route traffic.
-
Network Security Controls – Using security groups and network ACLs for traffic filtering, AWS Web Application Firewall (WAF) for application-layer protection. Design of DMZs and bastion hosts in cloud.
-
Preventive vs. Detective Measures – Preventive (security groups, encryption in transit, network segmentation) vs. detective (VPC Flow Logs, GuardDuty) measures for network security.
-
Infrastructure Security – Hardening AWS EC2 instances (OS security, patching, AWS Systems Manager), securing container infrastructure (if self-managed Kubernetes on EC2). Cloud provider’s infrastructure responsibilities vs. customer (shared model).
-
Resilience & Availability – Designing high availability (multi-AZ, multi-region strategies), DDoS protection (AWS Shield), and backup/recovery strategies for infrastructure.
-
Infrastructure as Code (IaC) – Introduction to using IaC tools (CloudFormation or Terraform) to codify security (e.g., automated deployment of secure configurations).
-
Zero Trust Networks – Applying zero-trust principles in cloud networks (microsegmentation, identity-aware access, concepts like AWS PrivateLink and Software-Defined Perimeters).
-
Secure Access Service Edge (SASE) – Overview of SASE architecture and its relevance for cloud network security.
Hands-On Lab: Secure Network Setup. In this extended lab, students will design and deploy a secure VPC in AWS: create isolated subnets (public and private), launch a web server in a public subnet and a database in a private subnet, and configure security groups so that the web server can communicate with the database but the database isn’t publicly accessible. They will also enable VPC Flow Logs and inspect them for traffic records. Bonus: Use AWS Firewall Manager or Security Hub to assess the network configuration against best practices.
Assessment: Students will diagram a proposed secure cloud network for a given scenario (such as a 2-tier web application) and identify misconfigurations or improvements. Also includes a short quiz on cloud networking concepts.
-
-
Module 8: Cloud Workload Security (4 Hours)
Learning Objectives: Explore how to secure different types of cloud workloads: virtual machines, containers, and serverless functions. Gain hands-on understanding of securing AWS EC2 instances, Amazon ECS/EKS containers, and AWS Lambda. Learn the unique security considerations and best practices for each workload type, including image security, orchestration, and runtime protection.
Key Topics:
-
Workload Types & Challenges – Overview of various cloud workloads (VMs, containers, serverless, and emerging AI workloads) and how cloud changes their security requirements.
-
Securing Virtual Machines – Best practices for AWS EC2 instance security: hardened base images (AMI security), patch management, instance profiles for limiting access, using AWS VM Import for trusted images. Snapshot and image security (avoiding public exposure of AMIs).
-
Container Security – Understanding containerization (Docker/ECS) and Kubernetes (Amazon EKS) basics. Securing container images (image scanning for vulnerabilities), container registry security, AWS ECR scanning, enforcing least privilege in containers. Network policies and isolation for containers. Orchestration security (EKS cluster best practices, etc.). Runtime security tools for containers (monitoring syscalls, using AWS partner tools).
-
Serverless Security – Key risks with Function-as-a-Service (AWS Lambda): function permissions (least privilege IAM roles for Lambda), handling environment variables and secrets (AWS Lambda env encryption, AWS Secrets Manager integration), and mitigating injection or event-data risks. Monitoring and logging in serverless (AWS CloudWatch Logs for Lambda, AWS X-Ray for tracing).
-
Emerging Workloads – Brief on securing AI/ML workloads (if using AWS SageMaker or similar): data protection and model security considerations. (Note: AI security is also revisited in Module 12.)
-
Workload Security Tools – Cloud Workload Protection Platforms (CWPP) and container security services (e.g., AWS GuardDuty EKS Protection, AWS App2Container) to automate workload security.
Hands-On Lab: Multi-Workload Security. This lab is divided into parts: (a) EC2 Hardening – Launch an EC2 instance and use AWS Systems Manager to apply updates and harden configuration; enable an endpoint protection agent (if provided) and verify OS-level logs. (b) Container Security – Deploy a simple Docker container in AWS (using AWS Fargate or EKS) and test image vulnerability scanning using Amazon ECR. Implement a network policy in EKS to restrict pod communication. (c) Serverless Challenge – Create a sample AWS Lambda function that interacts with an S3 bucket; configure its IAM role with least privilege and demonstrate how an overly broad role could be exploited versus a locked-down role. These hands-on exercises cover the gamut of workload security in AWS.
Assessment: Reflection quiz on choosing appropriate security controls for each workload type. For example, given a scenario, students decide whether to use container isolation, VM antivirus, or function-level policies.
-
-
Module 9: Data Security & Encryption (2.5 Hours)
Learning Objectives: Understand how to protect data in cloud environments throughout its lifecycle. Learn about cloud data storage models (block, object, database) and corresponding security mechanisms in AWS (encryption, IAM policies, backup). Be able to implement encryption and key management using AWS services and maintain data compliance (data classification, DLP strategies).
Key Topics:
-
Cloud Data Storage Types – Overview of storage options: block storage (e.g., Amazon EBS), object storage (Amazon S3), database storage (Amazon RDS/NoSQL DynamoDB), and how security approaches differ for each.
-
Data Security Principles – Confidentiality, integrity, availability as applied to cloud data. Data classification in the cloud (public, internal, sensitive, regulated data categories.
-
Access Controls for Data – Using IAM and bucket policies to restrict data access (S3 bucket policies, pre-signed URLs, etc.). Monitoring data access patterns (CloudTrail data events for S3).
-
Encryption at Rest and In Transit – Techniques and best practices for encrypting cloud data. AWS Key Management Service (KMS) for managing encryption keys, customer-managed vs. AWS-managed keys. Encrypting EBS volumes, S3 buckets (SSE-S3, SSE-KMS), and database encryption (RDS Transparent Data Encryption). Ensuring TLS for data in transit.
-
Key Management Strategies – Key rotation policies, key hierarchy, and using Hardware Security Modules (AWS CloudHSM) for high-security keys.
-
Data Loss Prevention (DLP) in Cloud – Approaches to detect and prevent data exfiltration (AWS Macie for sensitive data discovery, Amazon GuardDuty findings for data exfiltration).
-
Data Security Posture Management – Concepts of automating data security checks (ensuring no public S3 buckets with sensitive data, etc.). Object storage security hardening (blocking public access, versioning for integrity).
-
Backup and Recovery – Implementing backups (AWS Backup service) and disaster recovery plans for cloud data; ensuring data resilience.
Hands-On Lab: Encrypting and Protecting Data. Students will perform a series of tasks in AWS: enable default encryption on an S3 bucket and upload data to see it encrypted; create a customer-managed KMS key and use it to encrypt an EBS volume attached to an EC2 instance; use AWS Macie (if available in sandbox) or a simulated tool to scan an S3 bucket for sensitive data. They will also configure an S3 bucket policy to only allow encrypted uploads and test the behavior. This lab demonstrates practical data protection techniques on AWS.
Assessment: Matching exercise – match data security concepts to AWS services (e.g., data encryption – KMS, DLP – Macie, database encryption – RDS settings, etc.). Short quiz questions on cloud data scenarios (e.g., how to prevent an S3 bucket from being publicly accessible).
-
-
Module 10: Application Security and DevSecOps (2 Hours)
Learning Objectives: Examine how application security practices adapt in cloud environments. Learn about secure software development life cycle (SDLC) in the cloud, cloud-native application design considerations, and integrating security into DevOps (DevSecOps). Understand how AWS services can be used to enforce application security (from code to deployment) and manage secrets and configurations for applications.
Key Topics:
-
Secure Cloud SDLC – Integrating security at each stage of development for cloud apps. Threat modeling for cloud apps (consider cloud services and APIs in attack surface). Security testing pre-deployment (static code analysis, dependency scanning) and post-deployment (dynamic testing in cloud, vulnerability scanning).
-
Cloud Architecture & App Security – How cloud architecture impacts security: e.g., microservices vs monolith, use of APIs (AWS API Gateway security features), designing for failure (resilience). Architectural patterns that enhance security (tiered architecture, use of managed services).
-
Identity & App Security – Handling identity in applications using AWS Cognito or federated identity providers, implementing fine-grained authorization in app code vs using cloud-managed services. Secrets Management for applications (storing API keys, DB passwords in AWS Secrets Manager or Parameter Store).
-
DevSecOps Practices – Overview of CI/CD with security: using tools like AWS CodePipeline with integrated security scans, infrastructure as code scanning (template analysis), container image pipelines with scan steps. Automated compliance as code (AWS Config rules in pipeline).
-
Cloud App Vulnerabilities – Common issues like misconfigured storage (e.g., public S3), improper use of tokens/credentials in code, and how to mitigate them. OWASP Top 10 in context of cloud applications (e.g., SSRF in cloud metadata service).
-
AWS Application Security Services – Using AWS WAF to protect web applications, AWS Shield for DDoS protection, Amazon Cognito for secure user authentication, and AWS CodeGuru for code security reviews (AI-powered code analysis).
Hands-On Lab: CI/CD Security Integration. Students will use an AWS Cloud9 environment (or local) to simulate a CI/CD pipeline: they will create a simple code repository and use AWS CodePipeline or GitHub Actions to run a build that includes a security scan (for example, using open-source static analysis on code or infrastructure templates). Additionally, they will deploy a small web application on AWS (e.g., on AWS Amplify or EC2) and configure AWS WAF with a basic rule to protect it. This lab gives insight into embedding security in deployment and leveraging cloud-native app security features.
Assessment: Review a sample cloud architecture diagram for a web application and identify at least 3 security improvements. Quiz on DevSecOps terminology and tools (e.g., “What AWS service can store application secrets securely?”).
-
-
Module 11: Cloud Incident Response & Resilience (2.5 Hours)
Learning Objectives: Learn how incident response (IR) processes change in cloud environments and how to plan for cloud-specific scenarios. Develop skills to use cloud tools for forensic analysis and containment (with a focus on AWS services). Understand building resilient architectures that minimize incident impact and speed up recovery.
Key Topics:
-
Incident Response in the Cloud – The incident response lifecycle (Preparation, Detection & Analysis, Containment, Eradication, Recovery, Post-Incident) and how each stage is affected by cloud.
-
Preparation – Cloud-focused IR policies and runbooks, AWS incident response plans, training teams for cloud incidents. Pre-deploying tools like AWS CloudTrail, AWS Config for evidence collection.
-
Detection & Analysis – Using cloud monitoring (GuardDuty findings, CloudWatch alarms) to detect incidents. Cloud forensics basics: collecting instance snapshots, flow logs, AWS CloudTrail logs for analysis. Differences in investigating AWS vs on-prem (e.g., API logging, ephemeral instances).
-
Containment & Eradication – Techniques in AWS: isolating compromised resources (quarantining an EC2 instance by security group), revoking credentials, snapshotting volumes for later analysis. Using AWS Systems Manager to remediate at scale.
-
Recovery – Restoring services (e.g., redeploy workloads from clean AMIs or containers), ensuring vulnerabilities are patched. Cloud backup/restore strategies (using AWS Backup, cross-region replication for quick recovery).
-
Post-Incident – Cloud-focused post-mortems, updating IAM policies or network rules to prevent recurrence, and leveraging cloud provider support during incidents.
-
Resilience Engineering – Designing with incidents in mind: immutable infrastructure (replace rather than patch servers), chaos engineering basics to test recovery, multi-region active-active setups.
-
AWS Fault Tolerance – Implementing AWS tools like Auto Scaling and Elastic Load Balancing to self-heal applications, thus reducing the impact of incidents.
Hands-On Lab: Cloud Incident Simulation. In this lab, the class will work through a simulated security incident in AWS. For example, an “instance compromise” scenario: an EC2 instance is flagged by GuardDuty for suspicious activity. Students will practice responding by isolating the instance (change security group), analyzing CloudTrail and OS logs to determine scope, and executing a pre-scripted AWS Systems Manager document to snapshot the instance and remove it. They will then discuss how to recover (launch a new instance from a known-good image) and what post-incident actions to take (rotate keys, update security groups). This exercise ties together many prior topics (monitoring, IAM, networking, etc.) in an IR context.
Assessment: Group debrief on the incident simulation – what went well, what could be improved in an IR plan. A short quiz on cloud incident response concepts (e.g., identifying correct AWS service to use in a given IR step).
-
-
Module 12: Emerging Cloud Technologies & Security Strategies (1.5 Hours)
Learning Objectives: Look ahead at emerging technologies and strategies in cloud security. Focus on Zero Trust in cloud environments and the impact of Artificial Intelligence (AI) on cloud security. Understand how CCSK v5 has incorporated these modern topics and what that means for practical security design, especially in AWS contexts (like applying zero trust principles using AWS services).
Key Topics:
-
Zero Trust Strategy – Core principles of Zero Trust security (never trust, always verify, least privilege) and how to implement them in cloud. Zero Trust pillars (identity, device, network, application, data) and maturity models for organizations.
-
Zero Trust & Cloud – Practical steps for zero trust on AWS: using Identity-Centric controls (strict IAM policies, AWS Cognito for app identity), network microsegmentation (security groups/NACLs per microservice), continuous verification (logging and monitoring). How Software-Defined Perimeter and SDP solutions (like Zscaler, etc.) integrate with cloud.
-
AI in Cloud Security – The role of AI and machine learning in enhancing cloud security (automating threat detection, anomaly spotting). Overview of how AI is now a key part of CCSK curriculum.
-
Securing AI Workloads – Unique challenges of AI/ML in cloud (protecting training data, model bias, adversarial ML). Mention how AWS offers tools for ML security (Amazon Sagemaker security features, model monitoring).
-
Data Lakes and Big Data – Brief mention of new additions like data lake security considerations (as per CCSK v5 updates).
-
Future of Cloud Security – Trends like serverless adoption, infrastructure as code security, and automation. Encouragement for continuous learning beyond CCSK.
Key Topics in CCSK v5 Updates: Note: CCSK v5 consolidated domains to 12 (from 14) and increased focus on cloud workload security, application security, CI/CD, DevSecOps, AI, and Zero Trust. Legal specifics were reduced, and SecaaS topics integrated across domains. This module ensures students are aware of these trends as they head into the exam and real-world practice.
Hands-On (Discussion/Demo): Rather than a full lab, this module may include an interactive demo or case study. For example, the instructor might demonstrate an AI-based security tool (like AWS GuardDuty’s ML-driven findings or Amazon Macie detecting sensitive data) to show AI in action. A case study on implementing zero trust in a sample AWS environment will be discussed, tying together identity, network, and monitoring strategies.
Assessment: No formal quiz; instead an open discussion. Students reflect on how they would apply zero trust in their organizations and what AI tools might assist them. This solidifies conceptual understanding of these cutting-edge topics
-
Certification Exam Preparation & Guidance (0.5 Hour)
Learning Objectives: Ensure students are ready to take the CCSK certification exam. Review exam structure, domain weightings, and question styles. Provide study tips and resources for final preparation (including the official CSA CCSK prep kit and practice questions).
CCSK Exam Structure
The CCSK v5 exam is an online, open-book test with 60 multiple-choice questions in 120 minutes (passing score 80%). We will discuss time management and how to utilize the open-book format effectively (using the CCSK Body of Knowledge PDF or notes during the exam).
Domains Review
Quick recap of all 12 domains – highlighting key facts or commonly tricky concepts in each. Students can ask final questions about any domain topic.
Study Resources
Guidance on further self-study: the CSA CCSK Prep Kit (free resource from CSA) which includes the official study guide and practice questions, and using the CCSK official study guide and Security Guidance v4 document. Recommend taking additional practice exams if available.
Exam Tips
-
Encourage careful reading of questions (some are scenario-based), elimination of wrong answers, and referring to CSA’s provided materials. Emphasize understanding over memorization due to the open-book nature.
Certification Success
Outline the steps to schedule and take the exam. Remind that purchase of the exam includes two attempts and access to the CSA CCSK digital badge upon passing. Also mention that this course’s blend of theory and hands-on practice provides a strong foundation not only to pass the exam but also to apply cloud security knowledge in real jobs
Conclusiong
The course concludes with a Q&A session and final advice. Participants are encouraged to continue exploring cloud security in their daily work and to leverage the skills learned in securing AWS environments. Post-training support is available (forums or instructor follow-up) to help with any lingering questions as students prepare for the certification. Good luck on your journey to becoming a CCSK-certified cloud security professional!
