These free CSA study guides connect cloud-security foundations with responsibility mapping, identity, data protection and operational evidence. Use a fictional cloud application to compare what an organisation controls with what a provider operates. An additional AI-safety exercise follows the TAISE resource listed in the catalogue. Choose CCSK, CCSKv5 or TAISE deliberately: they are different resource labels and preparation directions, and an unspecified CCSK edition should not be assumed to match version 5.
Want free reference PDFs? Email freelearning@ciscoforall.com with your exam code and name. We will send an available older reference file free of charge. Availability varies. See the request section below.
Choose a CSA learning path
Choose the learning direction closest to your role and current knowledge. These orientations help you organise practice; they are not official exam objective lists. Compare your chosen target with the exact current syllabus and record any additional topics you need.
| Learning path | Who it suits | Topics to understand | First practice task |
|---|---|---|---|
| Cloud-security foundations | Learners studying vendor-neutral principles | Responsibility, identity, data and workloads | Map the controls for a fictional application |
| CCSK version review | Learners organising target-specific preparation | Curriculum, architecture and operations | Compare the listed resource edition with the target |
| AI-safety foundations | Learners considering AI system risks | Purpose, evaluations, human oversight and monitoring | Write a bounded AI-assistant risk scenario |
Explore CSA Premium study PDFs
Connect additional review material with a specific preparation gap. Open a relevant product to explore its details, confirm its code and version, and decide how it supports your learning goal.
| Premium resource | Preparation focus |
|---|---|
| CCSK — Certificate of Cloud Security Knowledge — Premium PDF | Cloud-security foundations; verify the unspecified CCSK edition. |
| CCSKv5 — Certificate of Cloud Security Knowledge v5 — Premium PDF | Cloud-security preparation for the explicitly listed version 5. |
| TAISE — Trusted AI Safety Expert v1 — Premium PDF | AI-safety scope, evaluation and governance foundations for TAISE v1. |
The catalogue includes an unspecified CCSK resource, an explicitly version-5 CCSK resource and TAISE v1. Confirm the exact curriculum and edition; this page is an independent collection of original exercises.
Make shared responsibility specific to the service
Responsibility depends on the selected service and configuration. A broad statement that the provider secures the cloud does not explain who configures access or protects application data. Map a concrete application and identify each control owner. Include dependencies and evidence so responsibilities can be checked rather than left as general slogans.
Practice task: Compare identity, application configuration and data controls for two fictional cloud service models. Expected result: A control-owner matrix with explicit assumptions. Common mistake to avoid: Assuming provider operation removes every customer responsibility
Connect identity decisions with resource access
Cloud access involves identities, authentication, permissions and the operation being requested. A successful sign-in does not establish that the identity should access every resource. Separate routine user work from administration and service-to-service access. Use fictional roles to test whether permissions match the required tasks and whether unnecessary actions are denied.
Practice task: Create a role matrix for user, deployment service and administrator of a fictional application. Expected result: Access checks linked to tasks and expected denial cases. Common mistake to avoid: Granting broad permissions because one required action failed
Follow data through its lifecycle
Data protection starts with what is collected, where it travels, how it is stored and when it is no longer needed. Encryption is one control, not a substitute for access and lifecycle decisions. Draw a small data flow and identify where copies can appear, including logs and backups. Use fictional values to avoid exposing real information.
Practice task: Map a fictional support ticket from input through storage, diagnostics and retention review. Expected result: A lifecycle map with copies and responsible controls. Common mistake to avoid: Considering only the main database copy
Review workloads and changes with evidence
A workload-security exercise should connect configuration, dependencies and deployment changes with observable checks. State the approved baseline and what a change is intended to accomplish. Check an allowed path and a denied path in an authorised lab. A successful deployment does not itself establish that the workload is configured securely.
Practice task: Write a change-review checklist for restricting a fictional application service to its required callers. Expected result: A baseline and test plan covering intended access and denied access. Common mistake to avoid: Equating deployment success with secure configuration
Make telemetry support a response decision
Monitoring is useful when an observation can be interpreted and acted on. Define the event, context, expected signal and responsible reviewer. More logs do not automatically provide better detection. Include missing or delayed telemetry in the exercise and explain what cannot be concluded when evidence is unavailable.
Practice task: Design a tabletop alert for unexpected administrative access with context and escalation ownership. Expected result: An actionable observation and a stated evidence limitation. Common mistake to avoid: Treating log volume as a measure of monitoring effectiveness
Bound AI use and test foreseeable failures
AI-safety reasoning begins with the intended task, users and permitted actions. Identify an incorrect or unsafe output that matters in that context and define how it would be detected. Human oversight should have a clear decision and authority. A small evaluation set can reveal weaknesses, but passing it does not establish universal reliability.
Practice task: Write an evaluation for a fictional internal assistant that must cite supplied documents and avoid unsupported instructions. Expected result: A bounded test set with failure criteria and human review. Common mistake to avoid: Declaring an AI system safe after a few successful examples
Practical checklist: produce evidence you can review
Complete these activities as written exercises or in an authorised practice environment with fictional data. Define the expected outcome before starting and save a brief explanation of what the result establishes. Verify version-specific steps for your selected technology.
| Activity | What to do | Expected result |
|---|---|---|
| Make shared responsibility specific to the service | Compare identity, application configuration and data controls for two fictional cloud service models. | A control-owner matrix with explicit assumptions. |
| Connect identity decisions with resource access | Create a role matrix for user, deployment service and administrator of a fictional application. | Access checks linked to tasks and expected denial cases. |
| Follow data through its lifecycle | Map a fictional support ticket from input through storage, diagnostics and retention review. | A lifecycle map with copies and responsible controls. |
| Review workloads and changes with evidence | Write a change-review checklist for restricting a fictional application service to its required callers. | A baseline and test plan covering intended access and denied access. |
Common mistakes and better study habits
Use these comparisons to find an assumption worth revisiting. For each mistake, write a new example with different details and explain why the corrected principle still applies.
| Common mistake | Why it matters | Better approach |
|---|---|---|
| Equating deployment success with secure configuration | Compare the assumption with the observation before changing the design. | A baseline and test plan covering intended access and denied access. |
| Treating log volume as a measure of monitoring effectiveness | Compare the assumption with the observation before changing the design. | An actionable observation and a stated evidence limitation. |
| Declaring an AI system safe after a few successful examples | Compare the assumption with the observation before changing the design. | A bounded test set with failure criteria and human review. |
An original CSA self-check scenario
A cloud provider operates the infrastructure, but an organisation leaves a storage resource broadly accessible. Does provider responsibility resolve the exposure?
Explanation: No. Identify the customer configuration responsibility for that selected service and correct the access decision through the authorised process. Shared responsibility must be mapped to concrete controls rather than inferred from who operates the hardware.
Write your own answer before reading the explanation. Identify the evidence supporting it, then change one detail and decide whether your answer should change. This is an original learning exercise, not an actual exam question.
A flexible four-week study plan
| Stage | Focus | Practice outcome |
|---|---|---|
| Week 1 | Select the target and foundations | Compare identity, application configuration and data controls for two fictional cloud service models. A control-owner matrix with explicit assumptions. |
| Week 2 | Apply core concepts | Create a role matrix for user, deployment service and administrator of a fictional application. Access checks linked to tasks and expected denial cases. |
| Week 3 | Investigate weak topics | Map a fictional support ticket from input through storage, diagnostics and retention review. A lifecycle map with copies and responsible controls. |
| Week 4 | Review mixed examples | Write a change-review checklist for restricting a fictional application service to its required callers. A baseline and test plan covering intended access and denied access. |
Four weeks is an example schedule, not a promise of readiness. Adjust each stage to your experience and available time. Extend a stage when you cannot explain the topic without the notes or apply it to a fresh scenario. Revisit the exact target objectives so a familiar topic does not replace a relevant topic you have not practised.
Build a revision record that shows progress
Create a tracker with target topic, initial explanation, practice activity, observed result and next review date. Separate a topic you recognise from a topic you can apply. A useful record makes the remaining gap visible and helps you choose the next activity instead of repeatedly rereading the same material.
When an answer is wrong, preserve the initial assumption, the contradicting evidence and the corrected principle. Create a second example using different details. If the explanation works only for the first example, return to the concept before adding more resources. Review recurring errors together: they may reveal a missing foundation rather than several unrelated weaknesses.
| Tracker field | Example entry to write | Review question |
|---|---|---|
| Requirement | Compare identity, application configuration and data controls for two fictional cloud service models. | What outcome am I trying to establish? |
| Evidence | A control-owner matrix with explicit assumptions. | Which observation supports my explanation? |
| Limitation | State what the exercise did not establish. | Am I making a broader claim than the evidence allows? |
| Next activity | Create a role matrix for user, deployment service and administrator of a fictional application. | What new example will test the principle? |
Request free CSA reference PDFs
Email freelearning@ciscoforall.com with your exam code and name, the product or framework version if known, and the topics you need. We will send an available older reference file free of charge. Availability varies; a file may not be available for every target. The original notes, tables and exercises on this page are free to read without requesting a file.
Keep the code and version visible when using an older reference. Terminology, objectives and product behaviour may differ from your current target. Compare the material with the scope you intend to study and verify release-specific information before using it in a lab. We share only resources we are permitted to distribute. If you are unsure of the target name, include the learning goal so the request can be understood.
Combine practical learning with Premium PDFs
Use this guide to organise foundations and identify weaker topics. Then choose a relevant CSA Premium PDF for additional review. Give the resource a clear purpose: explain a concept, compare alternatives or repeat a practical scenario. Track the exact target and version alongside your notes so useful older material is not mistaken for complete current coverage.
Build a preparation routine around topic review, original exercises and an error log. After reviewing a resource, close it and explain the principle in your own words. Apply that principle to an unfamiliar example and record any remaining uncertainty. The value comes from understanding and application, rather than the number of files collected.
Cloud-security foundations; verify the unspecified CCSK edition. — Premium PDF · Cloud-security preparation for the explicitly listed version 5. — Premium PDF · AI-safety scope, evaluation and governance foundations for TAISE v1. — Premium PDF
Frequently asked questions
Is this guide free?
Yes. The learning notes, tables, study plan and original exercises here are free to read. Premium PDFs are available separately through the linked product pages.
Should I choose CCSK or TAISE for the same study goal?
CCSK-oriented resources address cloud-security knowledge, while the TAISE listing points toward AI-safety preparation. Some concepts overlap, but the target curriculum and purpose should guide the choice.
Can I request a free reference PDF?
Yes. Email freelearning@ciscoforall.com with your name, exact target and exam code. We will send an available older reference file free of charge. Availability varies.
Will an older reference match my current target?
It may explain useful foundations while describing an earlier version. Compare its code, objectives and product behaviour with your exact target before treating it as a complete preparation resource.
How should I choose a Premium PDF?
Use the product table to find a resource matching your target. Explore its details and version, then connect it with the concept or practice gap you want to strengthen.
Must I complete the plan in four weeks?
No. Adjust the schedule to your experience, available time and practice results. Repeat a stage until you can explain its concepts and apply them to a different example.
Are these actual exam questions?
No. The scenarios are original exercises for understanding and decision-making. They are designed to help you practise explanations and evidence-based reasoning.
Does this guide guarantee an exam result?
No. Results depend on your knowledge, practical skills and preparation.
Choose your next CSA study resource
Complete one small activity today and record its result. For an available older reference, email freelearning@ciscoforall.com. For additional preparation, choose a relevant Premium PDF above or browse the vendor selection below.