| Section | Weight | Objectives |
| Cloud Data Security | 20% | - Plan and implement data retention, deletion, and archiving
- Design and implement cloud data storage architectures
- Implement information rights management
- Understand cloud data concepts
- 1. Data lifecycle, data location, data flows
- Design and apply data security technologies and strategies
- 1. Data masking, anonymization
- 2. Encryption, key management, tokenization
- Implement data discovery and classification
|
| Cloud Platform and Infrastructure Security | 17% | - Design and plan security of management plane
- Comprehend cloud infrastructure components
- 1. Physical, network, compute, storage, virtualization
- Manage physical and logical infrastructure security
- Understand virtualization and related security risks
- Plan business continuity and disaster recovery
- Design and secure cloud infrastructure
|
| Cloud Concepts, Architecture and Design | 17% | - Design secure cloud architectures
- Understand design principles of secure cloud computing
- Evaluate cloud service providers
- Understand cloud reference architecture
- Understand security concepts relevant to cloud computing
- Understand cloud computing concepts
- 1. Definitions, roles and responsibilities
- 2. Service models: IaaS, PaaS, SaaS
- 3. Deployment models: public, private, hybrid, community
|
| Cloud Application Security | 17% | - Secure application programming interfaces
- Understand cloud software development lifecycle
- Apply secure software development practices
- Identify and validate cloud software security requirements
- Understand cloud application architecture and risks
- Assess application security
|
| Cloud Security Operations | 16% | - Build and operate security monitoring and logging
- Plan and implement physical and logical access controls
- Manage cloud security compliance
- Manage security operations
- Understand security operations concepts
- Plan, test, and manage incident response
|
| Legal, Risk and Compliance | 13% | - Understand audit process, methodologies, and required standards
- Understand legal and regulatory requirements
- 1. Data protection, privacy, jurisdiction
- Understand cloud contract design and terms
- Understand privacy issues
- Understand supply chain management
- Understand risk management
|