ISC2 CCSP · Free audio course · Updated 2026 companion books
Combine the existing free, ad-free 100-lesson CCSP audio course with the newly revised CCSP for Busy People Second Edition study guide and a separate, updated Kindle flashcards eBook. Read for understanding, listen for reinforcement, and practice the decisions that matter in cloud security.
Updated 2026 Companion Books
The illustrated study guide is available in paperback and Kindle formats. The separately sold flashcards companion is a Kindle-only eBook with 1,075 active-recall questions.
Study Guide
A 40-chapter illustrated guide to current CCSP objectives, responsibility boundaries, architecture, data protection, applications, operations, and legal and risk decisions. Includes 149 instructional figures.
Flashcards Book
Reinforce all six domains with 1,000 Core questions and 75 Additional practice questions. Four choices, the correct answer, an explanation, and study-guide references turn reading into active recall. Kindle only.
ISC2 and CCSP are trademarks of ISC2. Bare Metal Cyber's study guide, flashcards, audio course, and practice questions are independent educational resources and are not affiliated with or endorsed by ISC2. Purchase of the print or Kindle study guide does not include the separately sold Kindle flashcards.
PUT IT INTO PRACTICE
Try 50 original BMC questions, review every explanation, and return to the lessons behind the answer. No login is required. Earn Challenge achievements and share your progress as you go.
Independent BMC learning practice—not official exam items, a full mock exam, or an exam-readiness score.
Updated 2026 companion books
CCSP for Busy People has been revised for the ISC2 exam outline effective August 1, 2026. The Second Edition covers all six domains, modern cloud responsibility and risk decisions, AI and machine-learning topics, protection of datasets and models, and application security involving APIs and large language models. Exam-strategy guidance also reflects computerized adaptive testing. The guide includes 149 instructional figures across 40 chapters. The separately available Kindle flashcards provide 1,000 Core cards plus 75 Additional practice cards, with correct answers and explanations.
Weight in the August 2026 exam outline
Weight in the August 2026 exam outline
Weight in the August 2026 exam outline
Weight in the August 2026 exam outline
Weight in the August 2026 exam outline
Weight in the August 2026 exam outline
Complete Lesson Directory
Search by topic or narrow the directory by exam domain. Courses with multiple editions are organized below so every season remains easy to find. Each lesson includes its own audio player, full description, transcript when available, and previous-or-next navigation.
100 lessons available
Getting Started
This opening episode introduces the Certified Cloud Security Professional (CCSP) certification and explains why it has become the global benchmark for cloud security expertise.…
Getting Started
In this episode, we explore how to make the most of an audio-first learning format. Traditional textbooks and classroom prep can feel rigid, but audio lets you build knowledge while commuting, exercising, or working.…
Getting Started
Understanding the structure of the exam is critical before sitting for it. This episode breaks down the types of questions you’ll face, how scoring works, and what passing really requires.…
Getting Started
Preparation without structure often leads to burnout or gaps in coverage. In this episode, we present an 8-week study plan that balances domain review, practice questions, and rest.…
Getting Started
Cloud security concepts are complex, and memorization alone won’t cut it. This episode introduces evidence-based study techniques such as active recall, spaced repetition, and structured note-taking.…
Getting Started
Practice questions are the most effective way to transform study into exam readiness. In this episode, we look at how to use question banks strategically, focusing not only on correct answers but on understanding why distractors are wrong.…
Getting Started
Exam day comes with its own challenges, from nerves to logistics. In this episode, we walk through strategies to maintain calm, manage energy levels, and handle the test center environment.…
Getting Started
Success on the CCSP exam requires fluency with terminology. In this first glossary deep dive, we unpack the essential terms tied to cloud concepts and architecture.…
Getting Started
This glossary episode explores the vocabulary of data security and cloud platforms. We define and contextualize terms such as tokenization, encryption models, key management, and platform hardening.…
Getting Started
The third glossary session focuses on application security, operational practices, and legal considerations in cloud environments. Terms like DevSecOps, runtime protection, audit logging, and compliance frameworks are explained with clarity and exam relevance.…
Domain 1 · Cloud Concepts, Architecture and Design
Domain 1 of the CCSP exam sets the stage by covering the core principles of cloud concepts, architecture, and design. In this episode, we introduce the high-level topics within the domain, from service and deployment models to reference architectures and shared responsibilities.…
Domain 1 · Cloud Concepts, Architecture and Design
The shared responsibility model is one of the most tested and misunderstood concepts on the CCSP exam. In this episode, we break down how responsibilities are divided between cloud service providers and customers across IaaS, PaaS, and SaaS.…
Domain 1 · Cloud Concepts, Architecture and Design
Different service models shift the balance of control, risk, and required expertise. This episode explores Infrastructure-as-a-Service, Platform-as-a-Service, and Software-as-a-Service from a security perspective.…
Domain 1 · Cloud Concepts, Architecture and Design
Deployment models define the context in which cloud services operate. In this episode, we explain the differences between public, private, hybrid, and community models and the security implications of each.…
Domain 1 · Cloud Concepts, Architecture and Design
Cloud computing offers unique features that drive both value and new security challenges. This episode examines elasticity, on-demand self-service, measured usage, and especially multi-tenancy—the core traits that differentiate cloud from traditional IT.…
Domain 1 · Cloud Concepts, Architecture and Design
Clear roles and responsibilities are the backbone of secure cloud adoption. In this episode, we explore the four major players—cloud providers, consumers, auditors, and brokers—and how each contributes to security outcomes.…
Domain 1 · Cloud Concepts, Architecture and Design
Cloud reference architectures provide the blueprints for building secure systems at scale. In this episode, we explain how reference models capture best practices, ensure consistency, and align to recognized frameworks.…
Domain 1 · Cloud Concepts, Architecture and Design
Trust boundaries define where control shifts between users, systems, and services. This episode unpacks how boundaries are drawn in cloud designs, from network segmentation to workload isolation.…
Domain 1 · Cloud Concepts, Architecture and Design
Virtualization is a key enabler of cloud computing, but it introduces unique security concerns. In this episode, we examine the role of hypervisors, the difference between Type 1 and Type 2 models, and the importance of strong guest isolation.…
Domain 1 · Cloud Concepts, Architecture and Design
Cloud computing offers multiple layers of abstraction, each with its own strengths and risks. In this episode, we compare virtual machines, containers, and serverless computing, showing how they differ in architecture, performance, and security responsibilities.…
Domain 1 · Cloud Concepts, Architecture and Design
Cloud storage comes in several forms, each optimized for different use cases and each carrying unique security considerations. This episode explores the distinctions among object, block, and file storage, clarifying how they function, how access is controlled, and where risks arise.…
Domain 1 · Cloud Concepts, Architecture and Design
Networking is at the heart of cloud security, and understanding its architecture is essential for success. This episode walks through how cloud platforms implement virtual networks, how peering connects environments, and how segmentation helps reduce attack surfaces.…
Domain 1 · Cloud Concepts, Architecture and Design
Cloud computing makes resilience both easier to achieve and more complex to manage. This episode focuses on designing for availability, fault tolerance, and disaster recovery from the start.…
Domain 1 · Cloud Concepts, Architecture and Design
Threat modeling is a proactive practice for identifying risks before they become incidents. In this episode, we introduce cloud-specific approaches to threat modeling, including how to adapt methods like STRIDE and attack trees for distributed and multitenant systems.…
Domain 1 · Cloud Concepts, Architecture and Design
Effective governance ensures that cloud adoption aligns with both security and business goals. This episode explores how policies, standards, and design guardrails are codified into the cloud environment, often through automation and Infrastructure as Code.…
Domain 2 · Cloud Data Security
Domain 2 focuses on protecting data throughout its lifecycle. In this episode, we provide an overview of what the exam expects in this domain, from classification and labeling to encryption, key management, and data retention.…
Domain 2 · Cloud Data Security
Understanding the data lifecycle is fundamental to managing information securely in the cloud. This episode walks through each stage—creation, storage, usage, sharing, archival, and destruction—explaining the security measures that apply at every step.…
Domain 2 · Cloud Data Security
Data discovery is a critical step in understanding what information you hold and where it resides. In this episode, we discuss how discovery tools and catalogs are used to map data across complex cloud environments.…
Domain 2 · Cloud Data Security
Classification assigns value and handling requirements to data, and it’s central to both exam content and real-world practice.…
Domain 2 · Cloud Data Security
Encryption is one of the strongest defenses in the cloud, and the CCSP exam devotes significant focus to it. In this episode, we explore encryption at rest and in transit, explaining how different algorithms, key lengths, and protocols protect data across contexts.…
Domain 2 · Cloud Data Security
Encryption isn’t only about data at rest or in transit—today’s cloud technologies also secure data while it is being processed.…
Domain 2 · Cloud Data Security
Effective key management is critical to making encryption usable and trustworthy. In this episode, we dive into concepts such as Key Management Systems (KMS), Hardware Security Modules (HSMs), Bring Your Own Key (BYOK), and Hold Your Own Key (HYOK).…
Domain 2 · Cloud Data Security
Controlling access to data is as important as protecting it. This episode introduces Attribute-Based Access Control (ABAC), Role-Based Access Control (RBAC), and the principle of least privilege as applied in cloud contexts.…
Domain 2 · Cloud Data Security
Tokenization and masking are techniques for reducing risk by substituting sensitive values with safe alternatives. This episode explains how tokenization preserves format for data such as credit card numbers, while masking ensures only partial information is visible.…
Domain 2 · Cloud Data Security
Data Loss Prevention (DLP) systems help prevent sensitive information from leaving controlled environments. In this episode, we describe how DLP works through pattern recognition, policy enforcement, and user education.…
Domain 2 · Cloud Data Security
Retention policies dictate how long data must be preserved and in what form. This episode covers how cloud platforms implement backup, archival storage, and versioning features to meet these requirements.…
Domain 2 · Cloud Data Security
Secure deletion is essential to prevent residual data exposure when storage is repurposed or decommissioned. This episode explains sanitization methods, from overwriting and degaussing to crypto-erase, where encryption keys are destroyed to render data unreadable.…
Domain 2 · Cloud Data Security
Where data resides can be just as important as how it is secured. This episode explores sovereignty issues, including residency requirements, localization mandates, and cross-border transfer controls.…
Domain 2 · Cloud Data Security
Privacy by design integrates data protection principles into every stage of system development. This episode covers key practices such as data minimization, consent management, and Data Protection Impact Assessments (DPIAs).…
Domain 2 · Cloud Data Security
E-Discovery and legal holds present unique challenges in the cloud, where data may be distributed across services and regions. This episode explains how organizations must preserve, collect, and produce digital evidence when faced with litigation or investigation.…
Domain 3 · Cloud Platform and Infrastructure Security
Domain 3 of the CCSP exam takes us into the technical backbone of the cloud: platforms and infrastructure. In this episode, we establish the scope of the domain, including compute, storage, networking, virtualization, and the critical controls that protect them.…
Domain 3 · Cloud Platform and Infrastructure Security
Virtualization is the foundation of cloud computing, and understanding its stack is essential for both exam readiness and real-world practice.…
Domain 3 · Cloud Platform and Infrastructure Security
When deploying workloads in the cloud, consistency and control are vital. This episode examines the use of security baselines, patch management, and golden images as techniques for building strong compute environments.…
Domain 3 · Cloud Platform and Infrastructure Security
Containers have transformed application delivery by making software portable and efficient, but they introduce unique risks.…
Domain 3 · Cloud Platform and Infrastructure Security
Serverless computing abstracts away servers, but it does not remove security responsibilities.…
Domain 3 · Cloud Platform and Infrastructure Security
Cloud networks are virtual, but the principles of segmentation remain as important as ever. In this episode, we cover traditional controls such as firewalls alongside modern practices like microsegmentation, which allow for granular isolation between workloads.…
Domain 3 · Cloud Platform and Infrastructure Security
Identity is the new perimeter in cloud, and integrating it correctly is critical. This episode explores federated identity, single sign-on, and the use of identity providers to manage access to cloud control planes.…
Domain 3 · Cloud Platform and Infrastructure Security
Secrets such as passwords, tokens, and keys are among the most sensitive assets in cloud infrastructure. This episode examines best practices for managing secrets, including vaulting solutions, automated rotation, and strict access controls.…
Domain 3 · Cloud Platform and Infrastructure Security
Infrastructure as Code (IaC) makes cloud environments reproducible and scalable, but insecure templates can replicate vulnerabilities at speed. This episode explains how to secure IaC through validated templates, automated scans, and embedded guardrails.…
Domain 3 · Cloud Platform and Infrastructure Security
Supply chain security has become one of the most urgent issues in cloud and IT. This episode explores how software provenance, Software Bills of Materials (SBOMs), and code-signing ensure integrity in what organizations deploy.…
Domain 3 · Cloud Platform and Infrastructure Security
Logging is one of the most critical enablers of visibility in the cloud, yet it is often misunderstood or underutilized.…
Domain 3 · Cloud Platform and Infrastructure Security
Vulnerability management remains a cornerstone of security, but in the cloud, it requires specialized tools and approaches. This episode examines how vulnerability scanning applies to cloud-native hosts, including virtual machines, containers, and managed services.…
Domain 3 · Cloud Platform and Infrastructure Security
Resilience is more than availability; it is about designing systems that anticipate failure and adapt automatically.…
Domain 3 · Cloud Platform and Infrastructure Security
Backup and recovery strategies have evolved dramatically in the cloud, where snapshots, replication, and disaster recovery services are built into most platforms.…
Domain 3 · Cloud Platform and Infrastructure Security
Cloud adoption rarely happens in isolation—most organizations operate hybrid models that bridge on-premises infrastructure with cloud services. In this episode, we explore the role of edge gateways, VPNs, and dedicated links in connecting these environments.…
Domain 4 · Cloud Application Security
Domain 4 shifts focus to application security, addressing how cloud-hosted and cloud-native applications are designed, built, and secured.…
Domain 4 · Cloud Application Security
The Secure Software Development Lifecycle (SDLC) provides the structure for building applications that remain resilient under attack. In this episode, we explore how secure requirements, design practices, and verification steps are applied in cloud contexts.…
Domain 4 · Cloud Application Security
Applications today are increasingly built on microservices and APIs, and each component introduces potential vulnerabilities. This episode focuses on threat modeling at the application level, showing how to identify and address risks across distributed architectures.…
Domain 4 · Cloud Application Security
APIs are the glue of modern cloud applications, and their security is a top priority. In this episode, we explore how authentication and authorization work for APIs, highlighting practices such as OAuth 2.0, API gateways, and fine-grained permissions.…
Domain 4 · Cloud Application Security
Application identity is critical to securing interactions between services, users, and cloud providers. This episode covers OAuth 2.0 as the leading framework for delegated authorization, OpenID Connect as an identity layer, and the mechanics of token issuance and validation.…
Domain 4 · Cloud Application Security
Embedding secrets directly in code is one of the most common and dangerous mistakes developers make.…
Domain 4 · Cloud Application Security
Modern applications rely heavily on open-source libraries and frameworks, which can accelerate innovation but also expand the attack surface.…
Domain 4 · Cloud Application Security
Static Application Security Testing (SAST) analyzes source code or binaries to identify vulnerabilities before software is deployed.…
Domain 4 · Cloud Application Security
Dynamic Application Security Testing (DAST) examines applications while they are running, simulating external attacks to uncover vulnerabilities that may not appear in source code.…
Domain 4 · Cloud Application Security
Even well-tested applications face threats once deployed, making runtime protection essential.…
Domain 4 · Cloud Application Security
Serverless applications offer scalability and efficiency but bring unique risks. In this episode, we explore how event-driven models introduce vulnerabilities such as event injection, where malformed inputs can manipulate logic or trigger unintended behavior.…
Domain 4 · Cloud Application Security
Containers bundle applications and dependencies, but their security depends on careful control across the lifecycle. This episode examines how images are built, stored in registries, and deployed in runtime environments.…
Domain 4 · Cloud Application Security
Configuration management ensures that applications run consistently and securely across environments. In this episode, we explore how feature flags, environment variables, and default settings play critical roles in security posture.…
Domain 4 · Cloud Application Security
DevSecOps integrates security into every stage of the development and delivery process. This episode explains how pipelines enforce security gates, how automated policies validate code and infrastructure, and how feedback loops accelerate remediation.…
Domain 4 · Cloud Application Security
Delivery strategies determine how applications are released into production, and security must be considered at every step.…
Domain 5 · Cloud Security Operations
Domain 5 introduces the operational side of cloud security, where the focus shifts from architecture and design to the day-to-day activities that ensure systems remain secure, resilient, and compliant.…
Domain 5 · Cloud Security Operations
Effective monitoring is at the heart of cloud security operations, providing the visibility required to detect, analyze, and respond to threats.…
Domain 5 · Cloud Security Operations
Security Information and Event Management (SIEM) systems remain a cornerstone of security operations, but in the cloud, they must adapt to ingest vast amounts of telemetry from distributed sources.…
Domain 5 · Cloud Security Operations
Cloud Security Posture Management (CSPM) addresses one of the leading causes of breaches: misconfiguration. In this episode, we explore how CSPM tools automatically detect weaknesses, enforce baselines, and identify drift from secure configurations.…
Domain 5 · Cloud Security Operations
Security Orchestration, Automation, and Response (SOAR) platforms transform operations by codifying response actions into playbooks. This episode explains how triggers from SIEMs or monitoring systems activate playbooks that execute repeatable, automated workflows.…
Domain 5 · Cloud Security Operations
Incident response in the cloud requires adapting traditional processes to dynamic, distributed environments. This episode covers how cloud-specific triage differs from on-premises, emphasizing challenges like volatile workloads, shared infrastructure, and rapid scaling.…
Domain 5 · Cloud Security Operations
Forensics in the cloud is complicated by lack of physical access, but it remains essential for investigations. This episode examines how evidence is acquired from cloud platforms, how chain of custody is maintained, and which tools support forensic readiness.…
Domain 5 · Cloud Security Operations
Change management ensures that updates to cloud environments are controlled, predictable, and secure. In this episode, we explore how guardrails, approval workflows, and documented exceptions keep systems stable while still allowing agility.…
Domain 5 · Cloud Security Operations
Configuration management goes hand in hand with posture and change management, ensuring systems remain aligned with secure baselines.…
Domain 5 · Cloud Security Operations
Vulnerability operations extend beyond scanning, focusing on how findings are prioritized, tracked, and remediated across thousands of resources.…
Domain 5 · Cloud Security Operations
Keys and secrets are not static assets; they must be actively managed to maintain security. In this episode, we explore operational practices such as regular rotation, enforced expiry, and escrow arrangements that ensure continuity in case of emergencies.…
Domain 5 · Cloud Security Operations
Access control is only effective if it remains accurate over time. This episode explains how access reviews confirm that permissions align with roles and responsibilities, ensuring least privilege is preserved.…
Domain 5 · Cloud Security Operations
Business continuity in the cloud goes beyond disaster recovery; it ensures that critical services remain available under any condition.…
Domain 5 · Cloud Security Operations
Cloud introduces new financial dimensions to security. This episode explores how cost optimization intersects with security, showing how excessive privileges or poorly controlled resources can drive unexpected expenses and risks.…
Domain 5 · Cloud Security Operations
A service catalog provides pre-approved templates and builds that standardize cloud deployment. In this episode, we discuss how catalogs simplify operations, reduce risk, and accelerate adoption by giving users secure, vetted options.…
Domain 6 · Legal, Risk and Compliance
The sixth domain of the CCSP exam shifts attention from technical controls to the legal, risk, and compliance frameworks that govern cloud operations.…
Domain 6 · Legal, Risk and Compliance
Contracts and service-level agreements (SLAs) form the legal foundation of cloud relationships. This episode explores how security, privacy, and audit clauses define accountability between providers and customers.…
Domain 6 · Legal, Risk and Compliance
Governance provides the structure for aligning cloud security with business strategy. This episode explains how enterprise risk management (ERM) frameworks define risk appetite, set tolerance levels, and establish policies that guide cloud decisions.…
Domain 6 · Legal, Risk and Compliance
Compliance frameworks provide benchmarks for cloud providers and customers alike. In this episode, we cover widely adopted standards such as ISO 27001, SOC 2, and cloud-specific programs like CSA STAR.…
Domain 6 · Legal, Risk and Compliance
Privacy regulations impose strict rules on how personal data is handled, especially in the cloud where cross-border transfers are routine.…
Domain 6 · Legal, Risk and Compliance
E-Discovery obligations do not disappear in the cloud; in fact, they often become more complex. This episode explains how organizations must preserve relevant data during litigation, ensuring it cannot be altered or deleted once a legal hold is in place.…
Domain 6 · Legal, Risk and Compliance
For evidence to be admissible in legal or regulatory contexts, it must be accurate, verifiable, and properly maintained. This episode explores how digital evidence is collected in cloud environments, focusing on logging, time synchronization, and data integrity.…
Domain 6 · Legal, Risk and Compliance
Cloud adoption almost always involves third parties, and their risk becomes your risk. This episode explains how due diligence, contract clauses, and continuous monitoring are used to manage vendor relationships.…
Domain 6 · Legal, Risk and Compliance
Audits test whether organizations can prove compliance with standards and contractual obligations. In this episode, we discuss audit readiness in the cloud, focusing on evidence generation, control mapping, and continuous assurance.…
Domain 6 · Legal, Risk and Compliance
Cyber insurance has expanded into cloud-specific policies, offering organizations financial protection against breaches, outages, and other incidents.…
Domain 6 · Legal, Risk and Compliance
Professionalism in cloud security goes beyond technical competence—it includes ethical conduct and adherence to codes of practice.…
Domain 6 · Legal, Risk and Compliance
Business continuity and disaster recovery are not just technical exercises—they also carry legal obligations.…
Domain 6 · Legal, Risk and Compliance
Intellectual property concerns arise frequently in the cloud, where software, data, and designs may involve multiple stakeholders. This episode explores licensing models, use of open-source software (OSS), and patent issues that affect cloud adoption.…
Domain 6 · Legal, Risk and Compliance
Records management defines how information is retained, archived, and ultimately disposed of. In this episode, we cover how cloud systems enforce retention schedules, integrate with compliance requirements, and apply defensible disposition when data is no longer required.…
Domain 6 · Legal, Risk and Compliance
The cloud landscape is constantly evolving, and regulations are racing to keep pace. This final episode explores emerging rules governing artificial intelligence, digital sovereignty, and sector-specific requirements in areas like healthcare, finance, and critical infrastructure.…
Try another term or clear one of the filters.
A Practical Study Routine
Use the free audio course during a commute, walk, workout, or focused study session.
Work through the Second Edition guide’s explanations, figures, and decision models, then return to the audio for reinforcement.
Use the separately purchased Kindle flashcards for active recall, then revisit weak concepts in the guide or audio.
Related Magazine Features
Related Cyber Wiki
AI audit hallucination controls prevent unsupported generated statements from being treated as evidence, criteria, citations, calculations, or conclusions.
AI auditAI audit overreliance safeguards keep auditors responsible for scoping, evidence evaluation, judgment, challenge, and conclusions even when AI performs analysis or drafting.
AI engineering assuranceAI configuration reproducibility means an authorized team can recreate the relevant model build or runtime behavior from recorded code, data references, parameters, dependencies, prompts, and infrastructure settings.
AI controlsAI control monitoring observes whether preventive, detective, and corrective controls remain active, correctly configured, sufficiently covered, and effective as systems change.
AI data securityAI data lifecycle security protects information during collection, labeling, storage, use, sharing, retention, and deletion.
AI resilienceAI deactivation and contingency controls let an organization pause, limit, localize, roll back, or replace an AI capability when risk exceeds tolerance.
