CCSP Domain 2: Cloud Data Security
Domain 2.0: Cloud Data Security · 20% of the exam
The heaviest domain on the exam and the one that carries the most marks: all nine objectives (2.1–2.9), covering the cloud data lifecycle and data dispersion, storage architectures and the threats specific to each, encryption, tokenization, hashing, DLP and obfuscation, discovery and classification, information rights management, retention, deletion and legal hold, auditability and non-repudiation, and the new objective on protecting AI and ML data.
All study guides, current and every new one.
- Interactive online guide
- Downloadable PDF
- Lifetime updates
- 30-day money-back guarantee
Secure checkout via Stripe · no account needed · instant access
20% of your exam score
Domain 2.0 is worth 20% of the CCSP exam. Walk in having mastered it, not hoping it doesn't come up.
Every objective, nothing extra
Built line by line from the official ISC2 CCSP objectives 2.1–2.9: 29 in-depth topics with worked scenarios and exam tips, in a 153-page guide you'll actually finish.
90 exam-style questions
Every question comes with instant feedback and a full explanation, so a wrong answer teaches you as much as a right one.
The cloud credential, freshly rewritten
CCSP is the vendor-neutral cloud security certification, and the outline effective 1 August 2026 is brand new, with two AI objectives no incumbent book on the shelf covers.
Serving, transitioning, or a military spouse?
CCSP appears in the DoD 8140 qualification matrix. See how it maps to work roles, which credentialing program your branch runs, and what it will and will not pay for. Read the DoD 8140 guide →
Read a real excerpt, free
This is the actual opening of Module 2.1, Cloud data concepts, not marketing copy. If you like how it teaches, the rest of the guide reads the same way.
Describe cloud data concepts
The lifecycle phases and the control questions they raise, data dispersion and why it defeats simple location answers, and how to map data flows.
Rui Baptista had spent four years as Cobalt Grocery Group's data protection lead, and had answered the same question from regulators in three countries: where is the personal data of our residents held? Before the migration, the answer was a rack in Warsaw and a tape safe in Lisbon. Six months after it, the honest answer was that a customer's loyalty record existed as fourteen fragments distributed across at least three facilities in a region Rui could name but not visit, plus a replica in a second region for durability, plus whatever the analytics platform had cached, plus a nightly export sitting in an object bucket whose lifecycle policy nobody had set.
The regulator did not accept “in the cloud”. Neither does this exam.
When a Domain 2 question describes a control and asks where it belongs, or describes a phase and asks what control applies, it is testing the lifecycle mapping. Learn the six phases in order and the characteristic control for each: classify at create, encrypt and set access policy at store, apply least privilege and monitoring at use, apply rights management and transfer controls at share, set retention and long-term key availability at archive, and crypto-shred at destroy.
The cloud data lifecycle
| Phase | Definition | Where it typically goes wrong |
|---|---|---|
| Create | Data is generated new, or existing data is modified substantially enough to be treated as new. | No classification is applied, so every downstream control has to guess. Classification at creation is the cheapest control in the whole domain. |
| Store | Data is committed to a repository. In practice this happens at the same instant as creation. | Default encryption with provider-held keys accepted without a decision; access policy inherited from a template nobody has read. |
| Use | Data is viewed, processed or otherwise acted on, and must be in plaintext to be useful. | Over-broad entitlements; no record of who read what; analytics copies made outside the governed store. |
| Share | Data is made accessible to others — other users, other systems, other organizations, other jurisdictions. | The phase with the highest loss rate. Public links, over-permissive API scopes, exports to unmanaged endpoints, cross-border transfers with no lawful basis. |
| Archive | Data leaves active use for long-term retention, often on cheaper, slower storage. | Keys rotated or destroyed while the ciphertext survives; retention set without reference to legal hold; format obsolescence. |
| Destroy | Data is permanently removed by physical, logical or cryptographic means. | Copies in snapshots, replicas, backups and analytics extracts that the delete never touched. |
The lifecycle is often drawn as a circle, and that is the useful part: data moves back into use from archive, and a modification in use may amount to a create. Treat it as a state model, not a conveyor belt.
Data dispersion
Providers do not store an object as one file on one disk. They fragment it, compute parity or erasure-coding shards, and distribute those pieces across many devices, racks and often facilities. Any subset of the shards above a threshold can reconstruct the object; a single shard reveals nothing useful.
Not ready to buy? Read it later.
We'll email you a free sample of this guide as a PDF, no purchase needed.
Try 3 sample questions
Pulled straight from the guide's 90-question bank. Tap an answer for instant feedback and the explanation.
From module 2.1 · Cloud data concepts
1. Which lifecycle phase should classification be applied in, and why?
From module 2.2 · Cloud data storage architectures
1. A scenario describes data reachable by HTTPS URL within a flat namespace, permissioned by a resource policy. Which storage type is it?
From module 2.3 · Data security technologies and strategies
1. A data warehouse must correlate transactions by card without ever holding card numbers, and must fall outside PCI DSS scope. Which technique fits?
87 more questions like these are waiting inside.
What's inside
- 29 published sub-topics across 9 modules, mapped to objectives 2.1–2.9
- 90 exam-style practice questions with instant feedback
- Full answer key explaining why every distractor is wrong
- Tokenization, masking and anonymization, which one the question wants
- Why crypto-shredding only works if the key was never theirs
- Complete CCSP acronym & key-term reference
- 153-page downloadable PDF for offline study and printing
- Lifetime updates as the exam evolves
The modules, mapped to the objectives
- 2.110 Qs
Cloud data concepts
Describe cloud data concepts
Cloud data lifecycleData dispersionErasure codingData flow mappingData in transit / at rest / in useData residency - 2.210 Qs
Cloud data storage architectures
Design and implement cloud data storage architectures
Volume (block) storageObject storageEphemeral storageArchival / long-term storageRaw device storageStorage threats - 2.310 Qs
Data security technologies and strategies
Design and apply data security technologies and strategies
Tokenization & token vaultStatic vs dynamic maskingAnonymization vs pseudonymizationDLP discovery/monitoring/enforcementSecrets managementCertificate lifecycle - 2.410 Qs
Data discovery
Implement data discovery
Structured data discoveryUnstructured content inspectionSemi-structured dataLabel-based vs content-basedData location & residencyContinuous discovery - 2.510 Qs
Data classification
Plan and implement data classification
Classification policyData owner accountabilityClassification vs categorizationLabelling & taggingTag-based access controlReclassification - 2.610 Qs
Information rights management
Design and implement Information Rights Management (IRM)
Persistent protectionGranular rightsRevocation & expiryRights server / licenceOffline access licenceIRM vs DLP - 2.710 Qs
Retention, deletion and archiving
Plan and implement data retention, deletion and archiving policies
Retention scheduleLegal holdCrypto-shreddingObject lock / WORMRight to erasureArchive retrievability - 2.810 Qs
Auditability, traceability and accountability of data events
Design and implement auditability, traceability and accountability of data events
Event attributesManagement plane vs data plane logsLog integrity / WORMTime synchronisationChain of custodyNon-repudiation - 2.910 Qs
Protecting AI and ML data
Comprehend data protection of Artificial Intelligence (AI) and Machine Learning (ML) data
Membership inferenceModel inversion & extractionDifferential privacyFederated learningVector store protectionModel provenance & signing
About the author
Chris Rees
Professional information technologist with 25+ years in IT and the author of 51 certification training courses, 50+ live on Pluralsight, rated 4.6/5 across more than 2,000 reviews. This guide is that same exam-focused teaching, in a format you can finish.
More about ChrisSitting the whole exam? Get the Complete CCSP Collection.
Every domain of the exam, including this guide, for $99, one time.
See everything insideQuestions, answered
Do I need an account to buy?
No. Checkout is a single Stripe form: email and card, about 30 seconds. We create your access from your checkout email automatically and sign you in the moment payment completes.
Is this up to date with the real CCSP exam?
Yes. The guide is mapped module-by-module to the official ISC2 CCSP objectives (2.1–2.9), and lifetime updates are included, so as the exam evolves your guide does too.
What exactly do I get?
Instant access to the interactive online guide with all 90 practice questions, plus a 153-page PDF you can download, print, and keep forever.
Do I need the other domains too?
This guide covers Domain 2.0 (20% of the exam). To prepare for the whole exam, the Complete CCSP Collection bundles all 6 domains for $99, less than the price of three guides.
What if it isn't for me?
Every purchase comes with a 30-day money-back guarantee. Email us and we'll refund you, no hoops.
Who wrote it?
Chris Rees, a professional information technologist with 25+ years in IT and the author of 51 certification courses published on Pluralsight, rated 4.6/5 across 2,007 ratings.
Be ready for 20% of the exam, for $24.95
Instant access, lifetime updates, and a 30-day money-back guarantee. The only risk is walking into the exam without it.
Get the guide