You think Domain 1 is just memorizing IaaS, PaaS, and SaaS. Fine. In a hybrid cloud using a PaaS solution, who is responsible for configuring data-at-rest encryption for customer PII? The provider or the customer? The CCSP exam presents exactly this kind of judgment call, and getting it wrong is how competent professionals fail the highest-weighted domain. The answer is the customer, and this guide will show you why.
CCSP Domain 1, Cloud Concepts, Architecture, and Design, covers the foundational principles of cloud computing from a security perspective. It tests your ability to apply concepts like the shared responsibility model, NIST cloud definitions (SP 800-145), and architectural principles to solve security problems in IaaS, PaaS, and SaaS environments.
Key facts
- Exam Title
- Certified Cloud Security Professional (CCSP)
- Official Body
- ISC2
- Passing Score
- 700 out of 1000 scaled points
- Domain 1 Weight
- 17% of the exam
- Average Salary
- $120,000 to $175,000 for CCSP holders (BLS data)
- Official Blueprint
- Based on the ISC2 CCSP Common Body of Knowledge (CBK)
What is CCSP Domain 1 Actually Testing?
This domain tests your judgment, not your memory. Accounting for 17% of your score, "Cloud Concepts, Architecture and Design" is the foundation for the entire CCSP exam. ISC2 wants to see if you can move beyond simple definitions and analyze the security implications of architectural decisions.You will be asked to determine responsibility, identify risks, and select appropriate controls based on a given cloud service and deployment model. The questions are designed to trap candidates who apply outdated on-premise security thinking to the cloud. Your goal is to prove you can think like a cloud security architect. To do that, you need to internalize the core models and frameworks.
What are the Core Frameworks and Models for Domain 1?
Your ability to pass rests on your fluent application of a few key models. These are not complex formulas but principles that dictate secure cloud design and operation.The Shared Responsibility Model: Your Most Important Chart
This is the single most important concept in Domain 1. You must know exactly where the line of responsibility falls between the Cloud Service Provider (CSP) and the Cloud Customer for each service model.| Area of Responsibility | On-Premise (Customer Owns All) | IaaS (Infrastructure as a Service) | PaaS (Platform as a Service) | SaaS (Software as a Service) |
|---|---|---|---|---|
| Physical Security | Customer | Provider | Provider | Provider |
| Network & Hypervisor | Customer | Provider | Provider | Provider |
| Operating System | Customer | Customer | Provider | Provider |
| Application Runtime | Customer | Customer | Provider | Provider |
| Applications & Code | Customer | Customer | Customer | Provider |
| Data & Access | Customer | Customer | Customer | Customer |
The exam will test this with nuance. For example, while the provider manages the application in SaaS, the customer is still responsible for configuring access controls and managing the data within it.
Studying for CCSP? Benchmark your score in 5 minutes.
Get an instant weak-spot assessment and a custom 12-week study plan PDF generated for your exam window.
- Applying security patches to the underlying web server's operating system.
- Conducting static code analysis on the patient portal's custom code.
- Ensuring ePHI is encrypted both in transit and at rest.
Step 1: Identify the Cloud Service Model
CareFlow is using PaaS. The provider manages the infrastructure and the platform (OS, runtime). CareFlow builds and deploys its own application on top.Step 2: Apply the Shared Responsibility Model
- OS Patching: This is the provider's responsibility. In a PaaS model, the customer consumes the platform and does not manage the underlying OS.
- Application Code Security: This is the customer's (CareFlow's) responsibility. The provider supplies the platform, but CareFlow wrote the application code. They own its security.
- Data Encryption: This is the customer's (CareFlow's) responsibility. Data, especially regulated data like ePHI, and its protection are always the customer's duty. While the PaaS provider may offer encryption tools, CareFlow must implement, configure, and manage them to meet HIPAA requirements.
This model also extends to other service types like Function as a Service (FaaS) or Database as a Service (DBaaS), where the provider's responsibility increases but the customer always retains ownership of their data and access logic.
Cloud Deployment Models: Where Does the Cloud Live?
You must know the four deployment models and their security trade-offs. Use the mnemonic PPC-H.- Public: Owned by a CSP and sold to the public (e.g., AWS, Azure, GCP). Offers massive scale but requires careful configuration to secure a multi-tenant environment.
- Private: Used exclusively by a single organization. Offers maximum control and privacy but at a higher cost and operational burden.
- Community: Shared by several organizations with common goals or compliance needs (e.g., a group of government agencies). Spreads costs while maintaining a semi-private environment.
- Hybrid: A composition of two or more of the above models, bound by technology that enables data and application portability. This is the most common model for established enterprises.
NIST SP 800-145: The 5 Essential Cloud Characteristics
These five traits define "cloud computing." The exam uses scenarios to test if you can identify them. Remember them with the mnemonic ORNEM.- On-demand self-service: Provision resources automatically without human intervention from the provider.
- Resource pooling: The provider's resources are pooled to serve multiple tenants.
- Network access (Broad): Services are available over the network via standard mechanisms.
- Elasticity (Rapid): Scale resources up or down quickly and automatically.
- Measured service: Resource usage is metered, monitored, and reported.
Key Architectural Frameworks: CSA and NIST
Familiarity with these frameworks demonstrates an understanding of structured cloud security.- Cloud Security Alliance (CSA) Cloud Controls Matrix (CCM): A meta-framework of cloud security controls, mapped to major standards. It's a tool for assessing a CSP's security posture.
- CSA Enterprise Architecture (EA) Reference Model: Provides a structured way to think about cloud security architecture, helping you identify risks and place controls.
- NIST SP 800-53: A comprehensive catalog of security and privacy controls for all U.S. federal information systems, often adapted for use in commercial cloud environments.
Calculate Your CCSP Score & Study Hours by Domain
Adjust your practice scores across official CCSP blueprint domains to predict your pass probability and generate a domain-weighted study schedule.
What Architectural Concepts Get Tested Most?
Beyond the basic models, the CCSP exam dives into the technical components that make up a cloud environment.Virtualization and Container Security
The cloud is built on virtualization. You need to understand its security implications.- Hypervisors: Know the difference between Type 1 (bare-metal) and Type 2 (hosted) hypervisors. The exam expects you to know that a vulnerability in the hypervisor could compromise every virtual machine running on it.
- VM Escape: This is an attack that breaks out of a guest VM to access the host OS or other VMs. It's a critical, though rare, vulnerability you must be aware of.
- Containers (Docker, Kubernetes): Containers share the host OS kernel, making them less isolated than VMs. A kernel exploit can compromise all containers on a host. You need to understand the security trade-offs.
Cloud Native Security: APIs and Microservices
Modern cloud applications are built on APIs and microservices. This distributed architecture creates new attack surfaces. Securing the API gateway, implementing mutual TLS between services, and managing secrets for thousands of ephemeral services are key challenges tested on the exam.Cloud Access Security Brokers (CASB)
A CASB is a critical security control point placed between cloud service consumers and cloud service providers. It enforces security policies as users and devices access cloud resources. The exam will expect you to know its four pillars:- Visibility: Discover what cloud services are in use (Shadow IT).
- Compliance: Assess if services meet compliance requirements like HIPAA or PCI DSS.
- Data Security: Enforce data loss prevention (DLP) policies, tokenization, and encryption.
- Threat Protection: Detect and block anomalous behavior and malware.
What are the Most Common Domain 1 Exam Traps?
The CCSP exam is famous for its tricky questions. Here are the traps that catch the most candidates in Domain 1.Another common trap is confusing rapid elasticity with on-demand self-service. Self-service is about provisioning resources without calling someone. Elasticity is about scaling those resources automatically based on load. Read the scenario carefully to see if the focus is on initial creation or dynamic scaling.
How Should I Study for Domain 1?
A cheat sheet is for review, not initial learning. Use a structured approach to master these concepts for good.- Build the Foundation: Start with comprehensive, textbook-grade lessons that explain these concepts from the ground up. Don't just read definitions; understand the why behind them. Passive video lectures often lead to poor retention. Interactive lessons with active recall checkpoints, like those in VoraPrep's complete CCSP course, are far more effective.
- Drill with Scenarios: Once you understand the concepts, immediately apply them with high-quality practice questions. Focus on questions that present a scenario and force you to make a judgment call. VoraPrep's adaptive practice banks include over 1,800 questions with detailed rationales that teach you to think like the examiner.
- Review and Reinforce: Use this cheat sheet and spaced-repetition flashcards in the final weeks before your exam. This will solidify your recall of key terms, models, and frameworks. Quickly review the shared responsibility chart and NIST characteristics daily until they are second nature.
This methodical approach ensures you build deep understanding first, then sharpen your test-taking skills.