CCSK Exam Guide: What the Certificate of Cloud Security Knowledge Actually Tests

What This CCSK Exam Actually Certifies

The Certificate of Cloud Security Knowledge (CCSK) exam  doesn't certify that you can operate a specific cloud platform. It certifies that you understand the security concepts that sit underneath all of them — AWS, Azure, GCP, or anything else a client happens to run. That vendor-neutral framing is the entire point: CSA built the CCSK body of knowledge around its own Security Guidance and Cloud Controls Matrix rather than around any single provider's documentation, so what you learn transfers when the client changes stacks.

It's worth being precise about the word "certificate" here, because CSA is precise about it too. The CCSK is a knowledge-based certificate, not a professional certification in the CISSP sense. There's no experience gate, no endorsement process, no code of ethics you sign, and — unusually for the industry — no annual maintenance fee or continuing education requirement to keep it active. You take the exam, you pass, and CSA considers it earned for good.

Who This CCSK Exam Is For (and Who It's Not For)

CSA pitches the CCSK broadly: security staff, developers, IT operations, audit and compliance professionals, and even sales engineers or product marketers who need a working grasp of cloud security concepts. In practice, it tends to land best with two groups — people early in a cloud security career who want a credential that doesn't require years of documented experience, and people already working in traditional IT or security who are moving toward cloud-heavy roles and need to backfill the conceptual gaps.

Where it's a weaker fit: if you already hold a CISSP and want a senior-level cloud credential that layers on top of it, the CCSK will feel introductory in places. It assumes some baseline security literacy (CSA specifically flags firewalls, encryption, secure development, and IAM as helpful prior knowledge) but doesn't test traditional information security concepts in depth the way ISC2's CCSP does. If your goal is a credential that signals years of hands-on cloud security leadership, the CCSK isn't built to prove that — it's built to prove you know the material.

CCSK Exam Format and Structure

The CCSK is open-book, online, and unproctored in the sense that you're not watching a monitor lock down your screen — you take it from wherever you have a stable internet connection. That sounds forgiving, and structurally it is: nobody's confiscating your notes. But instructors who teach both the CCSK and stricter proctored exams consistently warn candidates not to mistake "open-book" for "easy." Sixty questions in 120 minutes gives you exactly two minutes per question on average, and cloud security scenario questions rarely have an answer you can Ctrl+F your way to in under thirty seconds. If you're flipping through the study guide hunting for concepts you've never actually understood, the clock runs out well before you do.

The 80% passing bar amplifies this. That's a high floor for a multiple-choice exam — you can only afford to miss 12 questions. Most candidates report that the open-book format helps most with specific terminology and edge-case details, while the core reasoning (why a control matters, how a risk shifts between shared responsibility models) still needs to live in your head before you sit down.

Domains Covered in CCSK v5

CSA restructured the body of knowledge for v5, consolidating what used to be 14 domains into 12 and shifting emphasis toward the parts of cloud security that have actually changed in the last few years — serverless workloads, CI/CD and DevSecOps pipelines, and a domain that now centers on AI and generative AI rather than the older, broader "related technologies" grab-bag that used to cover IoT and mobile.

CSA doesn't publish a percentage weighting per domain the way some vendors do for their exams — questions are drawn randomly from a pooled bank rather than allocated by a fixed formula per domain, so no domain is officially flagged as "worth more" of the exam than another.

Cost Breakdown

A single token costs $445 and covers the exam plus access to CSA's AI study chatbot, and — importantly — that one purchase includes two test attempts, usable within two years of purchase. If you fail on your first attempt, you don't need to pay again to retake it, as long as you're inside that two-year window and haven't already used both attempts. If you exhaust both attempts without passing, you'd need to purchase a new token to try again. CSA doesn't publish region-specific pricing tiers, so the fee is the same regardless of where you're testing from.

Prerequisites and Eligibility

There are none, formally. CSA doesn't require prior work experience, a sponsoring employer, or any other certification before you can register. The one soft prerequisite worth taking seriously: CSA itself recommends candidates come in with a basic grounding in security fundamentals — firewalls, encryption, secure development practices, and identity and access management. That's not enforced at registration, but it shows up fast once you start reading the study guide, which assumes you already know what these terms mean rather than teaching them from scratch.

How the CCSK Exam Is Scored and What Passing Requires

Scoring is straightforward: 60 multiple-choice questions, no partial credit mechanics or scaled scoring curve described publicly by CSA — you need 80% correct, which works out to 48 or more correct answers, to pass. Results are typically available shortly after you submit, since it's a fixed-format online exam rather than one requiring manual grading.

Renewal and Recertification

Nothing to renew. Once you pass, the CCSK does not expire, and CSA doesn't attach a continuing education requirement or annual fee to keep it listed as active. This is a genuine point of differentiation from certifications like CISSP or CCSP, which require ongoing CPE credits and membership dues to stay current — worth factoring in if you're comparing total cost of ownership between credentials rather than just the up-front exam fee.

How CCSK Compares to CCSP

The most natural comparison is ISC2's Certified Cloud Security Professional (CCSP) — and it's a comparison CSA itself addresses directly, since CSA co-developed the CCSP's original body of knowledge with ISC2. The practical difference: CCSP assumes and tests traditional information security concepts (the kind of material CISSP covers) in addition to cloud-specific content, requires documented professional experience to hold the full certification, and carries ongoing CPE and membership obligations. One instructor who teaches both sums it up as CCSP being roughly "CCSK plus expanded governance, traditional security, and privacy" content. CCSP's exam is also longer and pricier — 125 questions over 3 hours, at a higher fee — and ISC2 explicitly allows CCSK to substitute for one year of the experience requirement in one of CCSP's six domains, which is a useful stepping-stone path if senior cloud security roles are the eventual goal.

If cost and speed matter more than seniority signaling, CCSK is the faster, cheaper entry point. If you're already deep into a security career and want a credential that assumes and builds on that experience, CCSP is the better target — with CCSK as a reasonable warm-up.

Preparation Timeline

Given the open-book format and lack of formal prerequisites, most self-study candidates budget somewhere between two and six weeks, depending on how much cloud security exposure they're bringing in already. Someone already working daily with cloud infrastructure and security tooling can often prepare in two to three weeks using CSA's free Prep Kit alone. Someone coming from a purely on-premises background, or without a security background at all, tends to need closer to a month or more to get comfortable with the terminology before the open-book format actually starts saving them time on exam day rather than costing it.