CCSE — Certified Cloud Security Engineer (312-40)

Security Engineer

Master cloud security engineering across AWS, Azure, and Google Cloud Platform — covering cloud architecture security, identity and access management, data security, network security, incident response, compliance, and DevSecOps in multi-cloud environments. The definitive cloud security certification.

Cloud Security AWS Security Azure Security GCP Security IAM Zero Trust CASB CSPM Container Security Serverless Security DevSecOps Compliance

Skills You'll Gain

The Complete CCSE Skill Set

From cloud fundamentals to advanced cloud security operations — every skill area from the 312-40 exam syllabus across AWS, Azure, and GCP.

Cloud Architecture Security

Cloud security reference architectures, Well-Architected Framework, defense-in-depth, Zero Trust in multi-cloud environments.

Identity & Access Management

AWS IAM, Azure Active Directory, GCP IAM, RBAC, least privilege, federated identity, PAM, and managed identities.

Data Security & Encryption

AES-256, AWS KMS, Azure Key Vault, GCP KMS, cloud DLP, data residency, sovereignty, and secure data sharing.

Cloud Network Security

VPC design, security groups, NACLs, private endpoints, VPN, DDoS protection, micro-segmentation, and cloud firewall.

Container & Kubernetes Security

Docker hardening, Kubernetes RBAC, image scanning, OCI security, Istio service mesh, pod security, and runtime monitoring.

DevSecOps & IaC Security

CI/CD security, SAST/DAST, Terraform/CloudFormation security, secrets management, GitOps, policy as code.

Cloud Security Monitoring

CloudTrail, Azure Monitor, GCP Logging, SIEM integration, GuardDuty, Azure Sentinel, Security Command Centre.

Cloud Incident Response

Cloud IR lifecycle, forensic acquisition, cloud-specific attack scenarios, IR playbooks, and containment strategies.

Serverless Security

Lambda/Azure Functions/GCP Cloud Functions security, event injection, function permissions, secrets in serverless.

Cloud Penetration Testing

Cloud pentest methodology, AWS/Azure/GCP exploitation, container escape, cloud C2 infrastructure, and reporting.

Cloud Compliance & Governance

SOC 2, ISO 27001, PCI DSS, HIPAA, GDPR in cloud, AWS Config, Azure Policy, compliance automation, cloud audit.

CASB & SaaS Security

SaaS security assessment, CASB, shadow IT discovery, OAuth app governance, third-party cloud integrations, vendor risk.

CCSE Is for Cloud Security Professionals

Whether you are a cloud engineer stepping into security or a security professional moving to cloud-native architectures, CCSE equips you with the multi-cloud security skills every enterprise demands.

☁️

Cloud Engineers

AWS/Azure/GCP engineers who want to specialise in cloud security and move into cloud security roles.

🛡️

Security Engineers

Traditional security engineers transitioning to cloud-native security architectures and tools.

💻

DevOps Engineers

DevOps professionals who want to integrate security into their pipelines and become DevSecOps practitioners.

🏢

Cloud Architects

Solution architects who need to design secure cloud architectures for enterprise and government deployments.

Curriculum

CCSE — 14 Course Modules

Every 312-40 exam objective covered — from cloud fundamentals and IAM to DevSecOps, serverless security, and compliance.

Cloud service models: IaaS, PaaS, SaaS, and FaaS explained
Cloud deployment models: Public, Private, Hybrid, and Multi-Cloud
Shared responsibility model across AWS, Azure, and GCP
Cloud provider comparison: AWS vs Azure vs GCP security features
Cloud economics and cost-security trade-offs
Cloud-native vs lift-and-shift architecture security implications
Multi-cloud and hybrid architecture design principles

Cloud security reference architectures and design patterns
Defense-in-depth strategy in cloud environments
Security zones, segmentation, and network isolation in cloud
Well-Architected Framework: Security Pillar deep dive
Cloud security controls: Preventive, Detective, Corrective
Zero Trust architecture implementation in cloud environments
Cloud security posture baseline and benchmarking

Cloud IAM fundamentals and access control models
AWS IAM: Users, Groups, Roles, Policies, and Permission Boundaries
Azure Active Directory: Tenants, RBAC, and Privileged Identity Management
GCP IAM: Service Accounts, Roles, and Org Policies
Role-based access control (RBAC) and least privilege enforcement
Service accounts, managed identities, and workload identity federation
Federated identity, SSO integration, and MFA in cloud
Privileged Access Management (PAM) for cloud environments

Data classification and sensitivity labelling in cloud
Encryption at rest: AES-256, AWS KMS, Azure Key Vault, GCP KMS
Encryption in transit: TLS, mutual TLS, and certificate management
Data Loss Prevention (DLP) in cloud: AWS Macie, Azure Purview
Secure data sharing, external collaboration, and access governance
Data residency, sovereignty, and cross-border transfer compliance
Cloud backup security, immutability, and ransomware protection

VPC architecture design, subnetting, and route table security
Security groups and NACLs: stateful vs stateless filtering
Private endpoints, VPC peering, and service endpoints
VPN and Direct Connect / ExpressRoute security considerations
DDoS protection: AWS Shield, Azure DDoS Protection, GCP Armor
CDN security, WAF integration, and bot protection
Cloud-native firewall: AWS Network Firewall, Azure Firewall
Network traffic analysis, flow logs, and micro-segmentation

VM hardening, golden image pipelines, and secure boot
Container security fundamentals: Docker security best practices
Kubernetes security: RBAC, namespaces, and network policies
Container image scanning with Trivy, Aqua Security, and Prisma Cloud
OCI security standards and supply chain hardening
Service mesh security with Istio: mTLS and traffic policy
Pod security policies, admission controllers, and OPA/Gatekeeper
Runtime security monitoring with Falco

Integrating security into CI/CD pipelines (GitHub Actions, GitLab, Jenkins)
SAST and DAST tools in DevSecOps: Checkmarx, SonarQube, OWASP ZAP
Infrastructure as Code security: Terraform and CloudFormation scanning with Checkov
Secrets management: HashiCorp Vault, AWS Secrets Manager, Azure Key Vault
GitOps security: branch protection, signing commits, and pipeline security
Policy as code with OPA and Sentinel
Compliance automation and continuous control monitoring in pipelines

Cloud-native logging: AWS CloudTrail, Azure Monitor, GCP Cloud Logging
SIEM integration: ingesting cloud logs into Splunk, Microsoft Sentinel
Cloud threat detection rules and tuning
Anomaly detection with ML-based cloud security tools
Cloud SOAR and automated incident response playbooks
AWS GuardDuty: threat intelligence and findings management
Azure Sentinel: analytics rules, workbooks, and UEBA
GCP Security Command Centre: finding sources and asset inventory

Cloud incident response lifecycle and PICERL framework in cloud
Evidence preservation: snapshots, memory acquisition, log export
Forensic acquisition from cloud instances (EC2, Azure VM, GCP Compute)
Cloud-specific attack scenarios: credential theft, S3 exfiltration, cryptomining
IR playbooks for cloud compromises: account takeover, data breach
Containment strategies: isolating instances, revoking credentials, quarantine VPCs
Post-incident cloud hardening and lessons learned documentation

Serverless attack surface and unique threat model
AWS Lambda security: execution roles, VPC config, and resource policies
Azure Functions and GCP Cloud Functions security configuration
Event injection attacks: SQS, SNS, API Gateway, and S3 trigger abuse
Function permissions and over-privileged execution roles
Cold start security and environment variable exposure risks
Secrets management in serverless and avoiding hardcoded credentials
Third-party library risks and dependency scanning in serverless

Cloud penetration testing methodology and scoping considerations
AWS exploitation: SSRF to metadata service, IMDSv1 vs IMDSv2
S3 bucket enumeration, misconfiguration exploitation, and data access
Azure Active Directory attack techniques and OAuth abuse
GCP IAM misconfiguration and service account key exploitation
Container escape techniques and lateral movement in Kubernetes
Cloud C2 infrastructure setup and evasion strategies
Cloud penetration testing tools: Prowler, ScoutSuite, CloudSploit, Pacu

Cloud compliance frameworks: SOC 2, ISO 27001, PCI DSS, HIPAA, GDPR
AWS Config: managed rules, conformance packs, and remediation
Azure Policy: built-in initiatives, custom policies, and compliance dashboard
GCP Security Command Centre: compliance posture and finding management
Compliance automation: automated evidence collection and reporting
Cloud audit logging requirements and evidence preservation
Governance frameworks: CIS Benchmarks, NIST CSF in cloud context

SaaS security assessment methodology and risk scoring
CASB (Cloud Access Security Broker): inline vs API-based deployment
Shadow IT discovery and unsanctioned cloud app management
SaaS API security: OAuth scopes, API key management, and token hygiene
OAuth app governance: reviewing and revoking third-party app permissions
Third-party cloud integrations: security review of marketplace apps
Vendor risk management in cloud supply chain environments

Cloud SOC operations: roles, tooling, and playbook development
CSPM (Cloud Security Posture Management): Prisma Cloud, Wiz, Orca
CWPP (Cloud Workload Protection Platform): runtime and host-level protection
Cloud asset inventory: tagging strategy and resource governance
CIS Benchmark implementation across AWS, Azure, and GCP
Continuous compliance monitoring: real-time drift detection and alerting
Cloud security metrics, KPIs, and executive reporting

Have Questions?

Chat with our EC-Council certified trainers instantly.

WhatsApp Us Call Us

Certified Cloud

Security Engineer

The World Standard in Cloud Security Engineering

Multi-Cloud Coverage

Practical Cloud Security

EC-Council Accredited

Highest Demand Role

The Complete CCSE Skill Set

CCSE Is for Cloud Security Professionals

CCSE — 14 Course Modules

312-40 Exam Information

Secure the Cloud as a Certified Cloud Security Engineer