CCSP Domains 1 and 2: AI and ML in cloud security, explained with practice questions

By Emmanuel Aigbehi Walstra — CISSP, CCSP, CEH, CCSE. Thirty-plus years in cybersecurity, Lead Cloud Security Trainer at TSTC since 2020, more than 10,000 people trained, and author of CCSP Excellence (2024).

The CCSP exam outline effective 1 August 2026 is the first to give artificial intelligence and machine learning their own subdomains. One sits in Domain 1 and one in Domain 2. This article sets out exactly what they contain, using ISC2's own wording, and finishes with five original practice questions.

For the full list of 2026 changes, see what changed in the CCSP exam outline, domain by domain.

Where AI appears in the 2026 outline

AI shows up in more than the two new subdomains:

Both new subdomains begin with the verb "Comprehend". My reading is that ISC2 expects you to understand the concepts and apply them to scenarios, not to build models. You don't need data science maths. You do need to recognise the risks and choose sensible controls.

Subdomain 1.6: Comprehend AI/ML

The outline lists five topics under 1.6, word for word:

• Cloud threat detection and analysis
• Data source validation and verification
• Security Orchestration, Automation And Response (SOAR)
• Ethical concerns
• Regulatory requirements

Cloud threat detection and analysis

ML-based detection learns a baseline of normal cloud behaviour (API calls, sign-ins, network flows, data access) and flags anything that departs from it. For the exam, understand its strengths and failure modes. False positives cause alert fatigue. False negatives cause missed attacks. Baselines drift as the business changes, so models need tuning and human oversight. AI supports a SOC. It doesn't replace one.

Data source validation and verification

An ML model is only as reliable as the data it learns from. If an attacker can influence the training data or the input stream, they can make the model learn the wrong thing. This is called data poisoning. OWASP's Top 10 for LLM Applications (2025) lists it as LLM04, "Data and Model Poisoning", and treats it as an integrity attack. NIST's adversarial machine learning taxonomy (NIST AI 100-2 E2025) also classifies poisoning attacks.

The controls are familiar security practice applied to data:

• know and document where each data source comes from (provenance);
• protect the integrity of log and data pipelines, with access control, hashing or signing, and immutable storage where it's justified;
• version your data sets;
• vet external data suppliers;
• monitor for anomalies in the training data itself.

SOAR

SOAR platforms automate the response to alerts. They gather context, open tickets, isolate hosts and disable accounts, following defined playbooks. AI can help with triage and correlation. The point to understand for the exam is where automation should stop. Low-risk, reversible steps can run on their own. High-impact steps usually need a person to approve them.

Ethical concerns

The outline lists no sub-topics. Common concerns are bias and fairness, transparency and explainability, privacy, accountability and human oversight. NIST's AI Risk Management Framework (AI RMF 1.0) lists characteristics of trustworthy AI, including "fair with their harmful biases managed", "explainable and interpretable" and "privacy enhanced". In a CCSP scenario, an ethical concern usually becomes a governance control: human review of significant decisions, documented model purpose, and monitoring for unfair outcomes.

Regulatory requirements

Again, the outline gives no specific laws under 1.6. These references are worth knowing as background:

• GDPR Article 22. It gives individuals the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects, subject to exceptions.
• The EU AI Act (Regulation (EU) 2024/1689). It is a risk-based regulation of AI systems. It has been amended since adoption, so check the current consolidated text for obligations and dates.
• NIST AI RMF. This is a voluntary framework built around four functions: Govern, Map, Measure and Manage.

In the exam, expect to apply principles rather than recall article numbers. For example: who is accountable when a provider's AI service processes personal data, or what to check in the contract.

Subdomain 2.9: Comprehend data protection of AI and ML data

2.9 has two topics, word for word:

• Data set and model privacy
• Data set and model security (e.g., validation, verification)

Data set and model privacy

Training data often contains personal or confidential information, and a trained model can leak some of it. NIST's taxonomy groups these risks as privacy compromises. They include membership inference, where an attacker works out whether a specific record was in the training set, data reconstruction, and model extraction, where an attacker copies a model's behaviour or parameters.

The controls you should be able to choose from:

• data minimisation: don't train on what you don't need;
• anonymisation or pseudonymisation before training, keeping their limits in mind;
• differential privacy, which adds calibrated noise so that no single record has much effect on the output. ISC2's AI exam guidance for CCSP mentions it alongside homomorphic encryption;
• access control, authentication and rate limiting on model endpoints, which make extraction and inference attacks harder;
• cloud data protection basics: classification, encryption at rest and in transit, and residency rules for training data, which may be copied across regions.

Data set and model security: validation and verification

The models and data sets themselves need protecting:

• Integrity. Hash or sign data sets and model artefacts. Verify the signatures before training or deployment.
• Provenance. Record where each model and data set came from. OWASP suggests tools such as an ML bill of materials (ML-BOM).
• Supply chain. Pre-trained models from public repositories can carry hidden risks. OWASP warns about malicious serialisation ("pickling") that runs code when a model loads. Scan third-party models and test them in isolation before production.
• Access control. Lock down training buckets and model registries like any sensitive data store.
• Retention and deletion. Training data and intermediate files left on ephemeral AI compute are a data remanence risk, and ISC2's guidance names this explicitly. Apply your retention and deletion policies to them.

Shared responsibility still applies. With a provider's AI service, you stay responsible for your data, prompts, configuration and access. See the shared responsibility model cheat sheet.

Five practice questions

These are original questions written for this article.

1. A SOC trains an anomaly-detection model on logs from cloud workloads. An attacker who controls one workload slowly generates low-volume, malicious-but-quiet activity over several weeks, so it becomes part of "normal". Which risk does this describe, and which control addresses it most directly?

• A. Data poisoning; validate and verify data sources and protect the integrity of the training pipeline
• B. Model extraction; rate-limit the model's API
• C. Membership inference; apply differential privacy
• D. Prompt injection; filter user input

Show the answer

Answer: A. The attacker is influencing training data so the model learns the wrong baseline. That is poisoning. The 1.6 topic "data source validation and verification" is the direct control. The other options address different attacks.

2. Your SOAR platform can carry out four automated actions after a high-severity alert. Which one should most clearly require human approval?

• A. Enriching the alert with threat-intelligence data
• B. Opening an incident ticket
• C. Disabling the service account that the production payment application uses
• D. Raising the alert's severity tag

Show the answer

Answer: C. Disabling a critical production account has a big business impact and can be hard to reverse quickly. The other actions are low-risk and reversible, so they suit full automation.

3. An attacker repeatedly queries a public, cloud-hosted ML model and, from its confidence scores, works out whether a specific patient's record was in the training data. What is this attack?

• A. Evasion
• B. Membership inference
• C. Model extraction
• D. Data poisoning

Show the answer

Answer: B. Membership inference reveals whether a given record was part of the training set, which is a privacy compromise under subdomain 2.9. Useful controls include differential privacy, limiting output detail such as confidence scores, and rate limiting.

4. A data science team wants to deploy a pre-trained model downloaded from a public repository. What should happen before it reaches production?

• A. Check that the file size matches the description
• B. Rely on the repository's download count as evidence of safety
• C. Deploy to production and monitor its outputs closely
• D. Verify its integrity and provenance (signature or published hash from a trusted source), scan it for embedded code, and test it in an isolated environment

Show the answer

Answer: D. This is 2.9's "data set and model security (e.g., validation, verification)" applied to the supply chain. Popularity is not assurance, and deserialising an untrusted model can run code.

5. A cloud-hosted model automatically rejects some credit applications with no human involvement. The organisation adds explanations for decisions and a human review route. Which concern does this most directly address?

• A. Availability of the inference endpoint
• B. Fairness and individuals' rights regarding automated decisions
• C. Storage costs for training data
• D. Inference latency

Show the answer

Answer: B. Explainability and human review address ethical concerns, such as bias and transparency, and regulatory requirements, such as GDPR Article 22 on solely automated decisions. Both are 1.6 topics.

For 30 more questions across all six domains, see 30 free CCSP practice questions with explanations.

Fitting this into your study

Add the AI/ML topics to Weeks 1 and 2 of the six-week CCSP study plan, and look out for them in the traps covered in common CCSP exam mistakes. If you're still choosing between certifications, read CCSP vs CISSP. Team leads teaching this internally can use how to run internal cloud security training with a ready-made slide deck.

Sectutor's free samples include a book chapter, about 50 slides and 30 questions, with no email needed. The CCSP Kit ($49) is a 430-page PDF study book and 600-question offline bank, and the CCSP Slide Deck ($499) is for internal training. Whatever material you use, check its coverage of 1.6 and 2.9 against the ISC2 outline. There are no videos, classes, labs or vouchers, and sales are final.