Cloud Study Notes

The CCSP is billed as "The Industry's Premier Cloud Security Certification." I don't know if that's true or not, but I passed the test and now have that certification. It's an ISC² certification and you can find more information about the credential and exam on their site.

I can't tell you exactly what you will need to do to prepare for this, but I can share my experience. When I decided to take this exam, it took me three weeks to get it. I passed on my first try and did not find this to be all that difficult. Your experience may be different.

One of the things that made this easier was that I already had my CISSP. Granted, I took the exam in 2012, so all the material was not something that was still fresh, but it was fresh enough. I had already learned the main concepts of security and the CCSP material was just an application of those principles to the cloud environment. I spent the last few years working in Risk Management and that helped keep a large part of that material in everyday use for me. If you have recently passed the CISSP, work on the CCSP or C|EH next. There's a lot of overlap between those three credentials.[I took the C|EH right after the CISSP and found that to be somewhat easy because of the CISSP studying.]

The other benefit of taking this after the CISSP is that you have a familiarity with ISC² tests. Testing can be anxiety-provoking for many people and if you're not used to taking exams, it can be unnerving. This test is not administered in all the "usual" places. I normally test at a center about 15 minutes from my house. For this test, I had to go to a specific testing center which was further away. The center was a lot more controlled and regimented than the normal testing sites. Maybe those are the only places they allow ISC² testing. There was a biometric scan, photo and proctor who did nothing but watch people testing. The person busy signing you in escorts you to the testing area. The proctor does not sign you in - they watch the testers. You will want to go to the bathroom before you start the exam. You don't want to waste time with that as the clock is still running on your exam.

I found the test to be very straightforward. Of course I was very prepared and knew the material well. I did not see any "trick" questions and there were no long scenarios or "questions within questions" (testlets). If you know the material, you should have adequate time to read the question fully and select an appropriate answer. If you're stumped by a question, just guess and move on. It may be one of those "experimental" questions that don't count and you don't want to get stuck on it and put yourself under time pressure.

The material I used to study came from ISC². I used the official guide to the CCSP CBK (Common Body of Knowledge), the CCSP Official Study Guide and the CCSP Official Practice Tests. I read all 3 books cover to cover and practiced all the questions. The questions you will see on the actual exam are different from the ones in the book. However, if you are clever - you can use those questions to determine if you really know the material (versus just knowing the answer to that question). If you simply go through the questions, check the answer and look at your score, you're doing yourself a disservice. It takes longer to play with the questions, but look at each one and the material's source. Do you know that topic? How well? Could you answer that question directly without picking between some options? What about the negative of the question? [Example: Question says "which of the following can..." Ask yourself "which of the following cannot …" ] What about the multiple choice answers? Do you know about each one of them?

Here is a sample question from the book:
Which common security tool can aid in the overall BC/DR process?
A. Honeypots
B. DLP
C. SIEM
D. Firewalls

Now it would be tempting to just answer the question and move on. But do you know what tools are used in BC/DR? What is Business Continuity and Disaster Recovery trying to accomplish? Do you know what each one of these items is and how it's used? One of the important things on any exam are the acronyms. DLP is Data Loss Prevention. SIEM is Security Information and Event Management. Honeypots are an obvious distractor (pun intended) - they are used to gather information about attacks/threats or deflect attacks from a legitimate target. A Firewall is a device that monitors and controls network traffic. It's a barrier between a trusted and untrusted network. Armed with that information, the question becomes a lot easier to answer. [The answer is B.]

This is also a good example of not letting your experience add words into the question. If you've worked with DLP systems, normally the focus is on data exfiltration. [Your business sensitive or customer data being sent outside the company where it doesn't belong.] But those are the devices in the data center. DLP itself covers more than just racking and stacking a device. BC/DR is more than just a DR exercise or actually recovering from a disaster. Those two fields/programs also cover the planning and design of resilience. You may be tempted to choose SIEM - because … logs! Logs are not data. Logs are metadata (data about the data). You may be able to use logs to perform forensic analysis after the fact, but they do not help you plan for nor recover from BC/DR events.

When you finish going through the questions, don't just score your practice test. Read each question and then look at the answer. The answers provide more information and may give you an alternate way of looking at the question. For this example: DLP solutions typically have the capability to aid in asset valuation and location, both important facets of the BC/DR process. All the other options are common security tools but don't really serve to enhance BC/DR efforts.

Look at what we did with that one question. We reviewed acronyms and looked at what Honeypots, DLP, SIEM and firewalls do and what BC/DR is trying to accomplish. We just squeezed about 6 potential questions out of that one question and answer. You could probably take the information above and write some sample questions of your own - which could actually be on the test! Remember - these tests are written by other people who simply passed the test before you. As you read the books, look at the material you're reading and ask yourself what kind of question could you write about that? Do you see any similar things that you could write a question about the difference between them? Write those questions down as you read - and you will find that you are much more prepared for the exam.

One last item to note is time management. Everyone knows to keep an eye on the clock when you're taking the test and make sure you're on pace to finish before the clock runs out. But time management during your studies is just as important. Set aside some time that is dedicated to studying. If you say "I'll study when I get some time," you will never have time. Especially if you live with other people - you need to get their "buy-in" and cooperation so you can focus on learning. It's easier if you set a schedule and stick to it as much as possible. That way your family knows that you study from 7-8pm every evening and if you give them attention/tend to their needs promptly at 8, they may be more likely to wait (knowing that it won't be long until they can interact with you). And some of you may have said "every evening?" You could study every evening during the week, or get up an hour earlier and study from 6-7 am - whatever works for your schedule. But it has to be consistent and routine. If you plan to study when you get a 4 hour block of time and that happens every other Saturday, you will be re-reading all the material you already read (over and over).

You need regular blocks of time relatively close together so you can accumulate the knowledge. You want to still remember the concepts in Chapter 3 while you're reading Chapter 6. One way to do this is to reverse-engineer your study. Look at the amount of reading you will need to do - how many pages in all the books combined? And then look at the isolation appetite that you can tolerate. Can your family put up with 6 weeks of you studying or only 4? Expect to be able to read about 20 - 30 pages in an hour. Take notes while you read so you can review them later and refresh your memory on key topics. Once you know how many weeks you have and how much material you have - you can figure out how many hours per week you need to study. Two hours per day M-F will give you 10 hours per week - times 4 weeks = 40 hours. Imagine if you took a 40 hour work week and had the luxury to just study for that entire week. Could you knock this out in that time?

Good luck in your studies and well wishes on the exam if you choose to take it!