Overview
Domain 3 looks under the services at the infrastructure that delivers them. It covers the components of cloud infrastructure and platforms, from the physical environment to the management plane. It covers secure data center design across logical, physical and environmental layers, and designing for resilience in power, cooling and connectivity. It covers analyzing infrastructure risks, including cloud-specific vulnerabilities and attacks, and choosing treatment strategies. It covers planning and implementing controls for physical protection, systems, storage, communications, identity and audit. It closes with business continuity and disaster recovery planning built around recovery objectives.
The domain matters because a failure at this layer affects every workload above it. It takes the building blocks from Domain 1 and makes them concrete, supplies the platform that Domain 4's applications run on, and defines the infrastructure that Domain 5 operates day to day.
How it's tested
Questions describe an infrastructure design, a risk or an outage scenario and ask for the MOST critical asset to protect, the BEST control, or the recovery strategy that meets a stated objective. Expect design questions that require you to identify the single point of failure, and BC/DR questions where RTO and RPO decide the answer.
-
Protect the control layer
Several assets are listed and you must recognize the management plane, or privileged access to it, as the highest-value target.
-
Find the single point of failure
A design looks redundant but depends on one region, provider, power feed or carrier, and you must spot it.
-
Objective-driven recovery
RTO, RPO and budget are given, and you must choose the recovery strategy that meets them without overspending.
An application runs in three availability zones in one region, and a regulator requires it to survive the loss of an entire region within four hours. Multiple zones protect against a data center failure, not a regional one. The design needs replication to a second region, with a failover process tested to meet the four-hour RTO. Adding more zones in the same region misses the requirement.
Subdomains 5
Official subdomains from the ISC2 outline, in outline order.
3.1 Comprehend cloud infrastructure and platform componentsPhysical environment, network, compute, virtualization, storage and the management plane.
- What it means
- Cloud infrastructure combines physical facilities, network and communications, compute resources, the virtualization layer that shares them, storage systems, and the management plane, meaning the consoles and APIs used to provision and control everything.
- What to understand
- The management plane is the most sensitive component, because compromising it gives control over every resource. It needs strong authentication, least privilege, separation of duties and thorough logging. The hypervisor is the isolation boundary between tenants.
- How it shows up
- Questions ask which component's compromise would have the GREATEST impact, or the BEST control for administrative access.
- Common confusion
- Focusing on securing individual virtual machines while leaving the console and API credentials that control them weakly protected.
3.2 Design a secure data centerLogical, physical and environmental design, and designing for resilience.
- What it means
- Logical design covers tenant partitioning and access control. Physical design covers location choice and whether to buy or build. Environmental design covers heating, ventilation and air conditioning (HVAC) and connectivity through multiple vendors and pathways. Resilient design covers redundant power, cooling and connectivity.
- What to understand
- Location affects natural hazard exposure, legal jurisdiction and access to power and carriers. Redundancy must be real: two network links through the same conduit, or two carriers sharing one upstream, are one failure point. Most customers rely on a provider's attestations for these controls rather than designing them.
- How it shows up
- A design is described and you must identify the hidden single point of failure, or the most important factor in choosing a site.
- Common confusion
- Counting diversity by vendor name rather than by physical path. Diverse providers that share a route are not diverse.
3.3 Analyze risks associated with cloud infrastructure and platformsRisk assessment, cloud-specific vulnerabilities and attacks, and treatment strategies.
- What it means
- This covers identifying and analyzing risks to cloud infrastructure, recognizing cloud-specific vulnerabilities and attacks such as misconfiguration, insecure interfaces and APIs, account hijacking, virtual machine escape, side-channel attacks and denial of service, and choosing treatments such as avoiding, mitigating, transferring, sharing or accepting.
- What to understand
- Misconfiguration and weak identity controls cause more cloud incidents than exotic attacks on hypervisors. Multi-tenancy introduces isolation risks the customer cannot directly control, so they are managed through provider assurance and contract. Treatment choices must be made by the risk owner with business context.
- How it shows up
- Questions ask for the MOST likely cause of a cloud breach, or the best treatment for a risk the customer cannot directly control.
- Common confusion
- Treating moving to the cloud as transferring the risk. Accountability for data and compliance stays with the customer.
3.4 Plan and implementation of security controlsPhysical, system, storage, communication, identity and audit controls in the cloud.
- What it means
- This covers physical and environmental protection where the organization runs its own facilities, protecting systems, storage and communications, identification, authentication and authorization in cloud environments, and audit mechanisms such as log collection, correlation and packet capture.
- What to understand
- In public cloud, physical controls are the provider's, and the customer verifies them through audit reports. Network-level visibility differs too: full packet capture may need provider-specific traffic mirroring features or may not be available in some services. Identity becomes the main perimeter.
- How it shows up
- Questions ask how to obtain assurance over provider physical security, or how to monitor network traffic when traditional taps are unavailable.
- Common confusion
- Expecting to audit the provider's data center in person. Most large providers do not allow customer site visits and rely on independent attestations instead.
3.5 Plan business continuity (BC) and disaster recovery (DR)Strategy, business requirements such as RTO and RPO, and creating and testing plans.
- What it means
- BC/DR planning defines a strategy, such as using the cloud as a recovery site, multi-region deployment or a second provider, based on business requirements including recovery time objective (RTO), recovery point objective (RPO) and recovery service level. Plans are then created, implemented and tested.
- What to understand
- Recovery objectives come from the business, through the BIA, not from IT preference. Availability zones protect against facility failures, and regions protect against regional events. A plan is not proven until it is tested, and test results should drive updates.
- How it shows up
- RTO, RPO and constraints are given, and you must choose the strategy that meets them, or identify what is missing from a plan.
- Common confusion
- Assuming high availability is the same as disaster recovery. High availability handles component failure, and DR handles the loss of a site or region.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
Management plane
The consoles and APIs used to provision, configure and control cloud resources.
- Remember
- Its compromise means control of everything, so it needs MFA, least privilege and logging.
- Tested as
- Highest-impact asset questions.
- Trap
- Protecting workloads but not administrative credentials.
-
Hypervisor isolation
The hypervisor separates tenants' virtual machines on shared hardware.
- Remember
- A virtual machine escape breaks that isolation, and the customer relies on provider assurance for it.
- Tested as
- Multi-tenancy risk questions.
- Trap
- Assuming the customer can harden the provider's hypervisor.
-
Type 1 vs. Type 2 hypervisor
Type 1 runs directly on hardware. Type 2 runs on top of a host operating system.
- Remember
- Cloud providers use Type 1 because it has a smaller attack surface and better performance.
- Tested as
- Virtualization questions.
- Trap
- Choosing Type 2 for production cloud infrastructure.
-
Availability zone vs. region
Zones are separate facilities within a region. Regions are separate geographic areas.
- Remember
- Multiple zones protect against facility failure, and multiple regions protect against regional events.
- Tested as
- Resilience design questions.
- Trap
- Using zones to meet a regional-outage requirement.
-
Path diversity
Redundant connections that follow physically separate routes.
- Remember
- Different vendors on the same path are not diverse.
- Tested as
- Data center design questions.
- Trap
- Counting vendors instead of paths.
-
RTO vs. RPO
RTO is how fast service must be restored. RPO is how much data loss, measured in time, is acceptable.
- Remember
- Both come from the business through the BIA.
- Tested as
- Recovery strategy questions.
- Trap
- Thinking a shorter RPO means faster recovery.
-
HA vs. DR
High availability keeps a service running through component failure. Disaster recovery restores it after the loss of a site or region.
- Remember
- They solve different problems and are often both needed.
- Tested as
- Continuity design questions.
- Trap
- Treating clustered servers as a DR plan.
-
Common cloud attacks
Misconfiguration, insecure APIs, account hijacking, VM escape, side-channel attacks and denial of service.
- Remember
- Misconfiguration and identity weaknesses are the most common causes of incidents.
- Tested as
- Risk analysis questions.
- Trap
- Prioritizing exotic attacks over basic configuration.
-
Attestation over inspection
Customers gain assurance about provider facilities through independent reports rather than site visits.
- Remember
- Read the report's scope and period carefully.
- Tested as
- Physical control assurance questions.
- Trap
- Expecting an on-site audit right with a hyperscale provider.
-
DR test types
Tabletop or walkthrough, simulation, parallel and full interruption tests.
- Remember
- Assurance and disruption rise together, so start with lower-risk tests.
- Tested as
- Plan testing questions.
- Trap
- Choosing full interruption as the first test.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
High availability vs. disaster recovery vs. business continuity
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| High availability | Keeping a service running through component failure | Automatic and local, measured in seconds or minutes | Treating it as protection against regional disasters |
| Disaster recovery | Restoring technology after loss of a site or region | Driven by RTO and RPO | Leaving the plan untested |
| Business continuity | Keeping critical business functions running through disruption | Covers people, processes and suppliers, not just technology | Assuming restored systems mean the business has recovered |
Availability zone vs. region vs. second provider
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Multiple availability zones | Spread across separate facilities in one region | Protects against single-facility failure | Using it for regional-outage requirements |
| Multiple regions | Spread across geographic regions of one provider | Protects against regional events | Forgetting data residency rules when choosing regions |
| Second provider | Recovery capability with a different cloud provider | Protects against provider-wide failure or exit | Underestimating the complexity and cost |
Type 1 vs. Type 2 hypervisor
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Type 1 (bare metal) | Runs directly on hardware | Smaller attack surface, used by cloud providers | Assuming the customer manages it in public cloud |
| Type 2 (hosted) | Runs on top of a host operating system | Larger attack surface, typical for desktops and testing | Choosing it for production multi-tenant hosting |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Harden the workloads first
- What candidates pick
- Focus on hardening individual virtual machines as the top priority.
- Why it looks right
- Workloads hold the applications and data.
- Why it's wrong
- An attacker with management plane access can modify, copy or delete every workload regardless of hardening.
Clue to watch for The question asks which asset's compromise has the GREATEST impact.
-
Zones for regional resilience
- What candidates pick
- Add more availability zones to survive a regional outage.
- Why it looks right
- More zones sounds like more resilience.
- Why it's wrong
- Zones are in the same region, so a regional event affects all of them.
Clue to watch for The requirement mentions a region, a geographic disaster or a regulator's regional-survival rule.
-
Visit the data center
- What candidates pick
- Audit the provider's physical security in person.
- Why it looks right
- Direct inspection gives the strongest evidence.
- Why it's wrong
- Large providers generally do not allow customer site audits. Assurance comes from independent attestations whose scope must be reviewed.
Clue to watch for The provider is a large public cloud.
-
Vendor diversity equals path diversity
- What candidates pick
- Accept two network carriers as redundant connectivity.
- Why it looks right
- Two vendors look like two independent links.
- Why it's wrong
- If both run through the same conduit or share upstream infrastructure, one cut takes both down.
Clue to watch for The scenario mentions shared routes, conduits or a single point of entry.
-
Cloud transfers the risk
- What candidates pick
- Treat moving infrastructure to a provider as transferring infrastructure risk.
- Why it looks right
- The provider now runs the hardware and facilities.
- Why it's wrong
- Operational duties move, but accountability for data, compliance and business impact stays with the customer.
Clue to watch for The question asks who remains accountable after migration.
-
Untested plan
- What candidates pick
- Accept a documented DR plan as evidence of recovery capability.
- Why it looks right
- The plan is complete and approved.
- Why it's wrong
- Only testing shows whether recovery meets RTO and RPO and whether staff can carry it out.
Clue to watch for No test results are mentioned.
Answer framework
For any Domain 3 infrastructure or continuity scenario, work through these steps before answering.
- Identify which infrastructure layer is involved, and whether the customer or the provider controls it in this particular service model.
- Check whether the management plane or privileged access is exposed, because that risk outranks risks to individual workloads.
- Look for hidden single points of failure in power, cooling, connectivity, region or provider, counting physical paths rather than vendor names.
- Take RTO, RPO and recovery service levels from the business requirement, and choose the least costly strategy that actually meets them.
- Prefer answers that verify through attestation, testing or logging over answers that assume a control works because it was documented.
Practice question
Want more like this? The CCSP practice test has questions for every domain.
Checklist
0 of 13
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Start with the infrastructure components in 3.1 and make the management plane your anchor. For every component, ask what happens if an attacker controls it, then note why the management plane answer is always the most severe.
Next, cover BC/DR in 3.5, because it produces the most scenario questions. Learn RTO and RPO thoroughly, the difference between high availability and disaster recovery, and the difference between zones and regions. Practice reading a requirement and naming the cheapest strategy that meets it.
Candidates commonly underestimate data center design (3.2), especially environmental and connectivity factors, because it feels like a provider's problem. The exam still tests it, often through single-point-of-failure questions. Risk analysis in 3.3 is shorter but connects directly to Domain 6's risk management.
Afterwards, move to Domain 5 and take a mixed practice set. It covers operating the infrastructure designed here, and practicing them together shows how design decisions become operational controls.
FAQ
How much of the CCSP exam is Domain 3?
Cloud Platform and Infrastructure Security carries 17% under the outline effective 1 August 2026.
Why is the management plane emphasized?
It is the set of consoles and APIs that control all cloud resources, so compromising it gives an attacker control of everything beneath it.
Do I need to know data center design if I only use public cloud?
Yes. The outline includes logical, physical and environmental design and resilience, and questions test whether you can judge a design, even if a provider runs it.
What is the difference between high availability and disaster recovery?
High availability keeps a service running through component failures. Disaster recovery restores service after a site or region is lost, and it is measured against RTO and RPO.
Can I audit my cloud provider's data center?
Large providers generally do not allow customer site visits. Customers rely on independent attestation reports and should check their scope and period.
Where do RTO and RPO come from?
From the business, through business impact analysis. Infrastructure design then has to meet them at an acceptable cost.
How does Domain 3 relate to Domain 5?
Domain 3 designs and plans the infrastructure and its controls. Domain 5 builds, operates and monitors them day to day.
Other Cybersecurity certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
- CompTIA Cybersecurity Analyst+ Study guide
- Microsoft Security Operations Analyst Associate Study guide
- Certified Ethical Hacker Study guide
- Penetration Tester Study guide
- Systems Security Certified Practitioner Study guide
- Certified in Risk and Information Systems Control Study guide
- CompTIA PenTest+ Study guide
- CompTIA SecurityX (CASP+) Study guide
- Azure Security Engineer Associate Study guide
- CISM (Certified Information Security Manager) Study guide
- CISSP Study guide
- CompTIA Security+ Study guide
- Certified Information Systems Auditor Study guide
Test your Domain 3 knowledge
You have covered infrastructure components, data center design, infrastructure risk, controls and BC/DR planning. Test whether you can spot the critical asset and the right recovery strategy under exam conditions.