Overview
Domain 5 turns designs into running operations. It covers building physical and logical infrastructure securely, with hardware security modules (HSM), trusted platform modules (TPM), secure-by-default settings, management tools and virtual hardware configuration. It covers operating and maintaining that infrastructure: remote access, network configuration, network security controls, hardening, patching, availability of clustered hosts and guests, performance and hardware monitoring, backup and the management plane. It covers operational controls and standards drawn from ITIL and ISO/IEC 20000-1, such as change, incident, problem, release and configuration management. It finishes with digital forensics, communication with vendors, customers, partners and regulators, and security operations: the SOC, monitoring, SIEM, incident response, vulnerability assessment and penetration testing.
It is where Domain 3's infrastructure design and Domain 4's applications are run and defended, and where Domain 6's legal duties, such as breach notification and evidence handling, are carried out.
How it's tested
Questions put you in an operations role during routine work or an incident and ask what to do FIRST, which control is MOST appropriate, or which process owns an activity. The exam rewards preserving evidence, following defined processes, and coordinating with the provider rather than improvising.
-
Incident sequencing
A security event is underway, and you must order containment, evidence preservation, eradication and communication correctly.
-
Name the process
An operational activity is described, and you must identify the ITIL or ISO/IEC 20000-1 process responsible for it.
-
Right control for access
Administrative access, network configuration or monitoring needs are described, and you must pick the control that fits the cloud setting.
Monitoring shows a virtual machine in your IaaS account beaconing to a known malicious host. Terminating it immediately feels decisive but destroys volatile evidence in memory and possibly on ephemeral disks. The better sequence is to isolate it through security group changes, capture memory and snapshot its volumes, record hashes and handling, and only then eradicate. Preserve, then remove.
Subdomains 6
Official subdomains from the ISC2 outline, in outline order.
5.1 Build and implement physical and logical infrastructure for cloud environmentHardware security configuration, secure defaults, management tools, virtual hardware and guest toolsets.
- What it means
- Building infrastructure securely involves configuring hardware security components such as hardware security modules (HSM) and trusted platform modules (TPM), applying secure-by-default settings, installing and configuring management plane tools, setting virtual hardware parameters for network, storage, memory, CPU and hypervisor type, and installing guest operating system virtualization toolsets.
- What to understand
- An HSM is a dedicated, tamper-resistant device for generating, storing and using cryptographic keys. A TPM is a chip bound to one machine that supports secure boot, platform integrity and device-bound keys. Secure by default means the initial configuration is the secure one, so that insecure settings require deliberate change.
- How it shows up
- Questions ask which component BEST protects keys for a multi-tenant service, or what secure by default means for new deployments.
- Common confusion
- Using HSM and TPM interchangeably. An HSM serves key operations for applications and services, and a TPM protects the integrity of a single platform.
5.2 Operate and maintain physical and logical infrastructure for cloud environmentAccess, network configuration and controls, hardening, patching, availability, monitoring, backup and the management plane.
- What it means
- Operation covers controlling local and remote administrative access through RDP, SSH, jumpboxes, console access and SSO, configuring networks with VLANs, TLS, DHCP, DNSSEC and VPNs, running network controls such as firewalls, IDS, IPS, honeypots, security groups and bastion hosts, hardening operating systems against baselines, patching, keeping clustered hosts and guests available, monitoring performance, capacity and hardware, managing backup and restore, and operating the management plane.
- What to understand
- Administrative access should go through hardened jump points with MFA and logging rather than exposing RDP or SSH to the internet. Maintenance mode moves workloads off a host before patching so service continues. DNSSEC protects the integrity and origin of DNS data but does not encrypt it.
- How it shows up
- Questions ask for the BEST way to provide administrator access, how to patch hosts without downtime, or what a given network protocol protects.
- Common confusion
- Believing DNSSEC provides confidentiality. It signs DNS records to prevent spoofing and tampering, and queries remain readable.
5.3 Implement operational controls and standardsService management processes drawn from frameworks such as ITIL and ISO/IEC 20000-1.
- What it means
- The outline lists change, continuity, information security, continual service improvement, incident, problem, release, deployment, configuration, service-level, availability and capacity management, with reference frameworks including NIST, ISO, COBIT, CIS Controls, COSO, HIPAA, ITIL and ISO/IEC 20000-1.
- What to understand
- Each process has a distinct purpose. Change management authorizes changes, release management packages and plans them, and deployment management moves them into environments. Configuration management keeps an accurate record of components and their relationships. Incident management restores service, and problem management removes causes.
- How it shows up
- An activity is described, and you must identify the process that owns it, or the process that failed when something went wrong.
- Common confusion
- Blending change, release and deployment management into one. The exam can test which one authorizes, which bundles and which moves code.
5.4 Support digital forensicsForensic collection methods, evidence management, and acquiring and preserving evidence.
- What it means
- Supporting forensics means collecting data in a forensically sound way, managing evidence with chain of custody, and acquiring and preserving digital evidence so it stays admissible.
- What to understand
- Cloud forensics is complicated by volatile and ephemeral resources, multi-tenancy, data spread across jurisdictions and dependence on the provider's cooperation and tooling. Collect the most volatile evidence first, use snapshots and memory capture where available, hash evidence to prove integrity, and record every handling step.
- How it shows up
- A compromised cloud resource is described, and you must choose the FIRST step, or identify the main challenge in collecting evidence from the provider.
- Common confusion
- Treating eradication as more urgent than preservation. Terminating or rebuilding a resource first can destroy the evidence needed to understand and prove what happened.
5.5 Manage communication with relevant partiesCommunicating with vendors, customers, partners, regulators and other stakeholders.
- What it means
- This covers planned, accurate and timely communication with the parties connected to a cloud service, including during incidents and changes.
- What to understand
- Communication should follow predefined plans with authorized spokespeople, verified facts and contractual or legal timelines, such as breach notification deadlines. Providers, customers and regulators each need different information.
- How it shows up
- Questions ask who should communicate with a regulator, what to establish before an incident, or what is wrong with how a breach was announced.
- Common confusion
- Treating communication as something to improvise during an incident. Contacts, approval paths and templates should be agreed in advance.
5.6 Manage security operationsSOC, intelligent monitoring, log analysis, incident response, vulnerability assessment and penetration testing.
- What it means
- Security operations covers running a security operations center (SOC), monitoring security controls including with AI assistance, capturing and analyzing logs with SIEM, log management and threat intelligence, responding to incidents, and conducting vulnerability assessments and penetration tests.
- What to understand
- SIEM value depends on collecting the right sources, tuning detection rules and having people to act on alerts. Incident response follows a defined life cycle. Penetration testing in the cloud must follow the provider's published testing policy and agreed rules of engagement, and must stay within the customer's own resources.
- How it shows up
- Questions ask what must be done before penetration testing a cloud environment, or why a SIEM is not producing useful alerts.
- Common confusion
- Assuming the customer can test anything in the provider's environment. Testing is limited to the customer's resources and the provider's rules.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
HSM vs. TPM
An HSM is a dedicated device for key generation, storage and cryptographic operations. A TPM is a chip on one machine that supports secure boot and platform integrity.
- Remember
- HSM for application and service keys, TPM for device integrity.
- Tested as
- Key protection questions.
- Trap
- Choosing a TPM to protect keys for a multi-tenant service.
-
Jumpbox or bastion host
A hardened, monitored system through which administrators reach internal resources.
- Remember
- It avoids exposing RDP or SSH directly to the internet, and it pairs with MFA and logging.
- Tested as
- Administrative access questions.
- Trap
- Allowing direct administrative access from the internet.
-
DNSSEC
Adds digital signatures to DNS records.
- Remember
- Provides origin authentication and integrity, not confidentiality.
- Tested as
- Network configuration questions.
- Trap
- Choosing it to hide DNS queries.
-
Maintenance mode
Moving workloads off a host so it can be patched or repaired without service interruption.
- Remember
- It works with distributed resource scheduling and clustering.
- Tested as
- Availability during maintenance.
- Trap
- Patching live hosts without migrating workloads.
-
Change vs. release vs. deployment
Change management authorizes, release management packages and plans, and deployment management moves the release into environments.
- Remember
- They are separate processes in ITIL-style frameworks.
- Tested as
- Process identification questions.
- Trap
- Treating them as one process.
-
Incident vs. problem
Incident management restores service quickly. Problem management finds and removes the root cause.
- Remember
- Recurring incidents signal an unresolved problem.
- Tested as
- Process questions.
- Trap
- Measuring success only by incident closure time.
-
Order of volatility
Collect the most short-lived evidence first, such as memory and network state, before disks and backups.
- Remember
- Ephemeral cloud resources make this especially urgent.
- Tested as
- Forensic sequencing questions.
- Trap
- Imaging disks first while memory evidence disappears.
-
Chain of custody
A documented record of evidence handling from collection onward.
- Remember
- Hash evidence and log every transfer.
- Tested as
- Evidence management questions.
- Trap
- Collecting evidence without documenting handling.
-
Cloud penetration testing
Testing your own cloud resources within the provider's published rules and agreed scope.
- Remember
- Check the provider's testing policy and keep to your own resources.
- Tested as
- Pre-test requirements.
- Trap
- Testing provider infrastructure or other tenants.
-
SIEM
Security information and event management collects, correlates and alerts on log data.
- Remember
- Value depends on the right sources, tuning and analysts to respond.
- Tested as
- Monitoring effectiveness questions.
- Trap
- Assuming installation alone provides detection.
-
Secure by default
Systems ship and deploy with secure settings already applied.
- Remember
- Weakening security should require deliberate action.
- Tested as
- Build-phase questions.
- Trap
- Accepting vendor defaults without review.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
Change vs. release vs. deployment vs. configuration management
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Change management | Assesses and authorizes changes | Decides whether a change may proceed | Skipping it for urgent fixes without retrospective review |
| Release management | Plans and packages changes into releases | Decides what goes out together and when | Confusing it with authorization |
| Deployment management | Moves releases into live or other environments | Handles the technical movement | Assuming deployment implies approval |
| Configuration management | Records components and their relationships | Maintains the accurate baseline everything else depends on | Letting records drift from reality |
HSM vs. TPM
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| HSM | Dedicated tamper-resistant device for cryptographic keys and operations | Serves applications and services, often shared or cloud-provided | Thinking it protects platform boot integrity |
| TPM | Chip integrated into one computer | Supports secure boot, attestation and device-bound keys | Using it for high-volume key management for services |
Vulnerability assessment vs. penetration test
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Vulnerability assessment | Identifies and rates known weaknesses, often with automated scanning | Broad coverage, does not exploit | Treating scan results as proof of exploitability |
| Penetration test | Attempts to exploit weaknesses within agreed scope | Shows real impact, needs authorization and provider-policy compliance | Testing without checking the provider's rules |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Kill it first
- What candidates pick
- Terminate the compromised instance immediately and redeploy from a clean image.
- Why it looks right
- It removes the threat fast, and immutable redeployment is good practice.
- Why it's wrong
- Termination destroys memory and ephemeral storage evidence needed to scope and prove the incident. Isolate and preserve first.
Clue to watch for The question asks what to do FIRST, or mentions investigation or legal action.
-
DNSSEC for privacy
- What candidates pick
- Enable DNSSEC to stop eavesdropping on DNS queries.
- Why it looks right
- It is a DNS security protocol.
- Why it's wrong
- DNSSEC signs records for integrity and origin authentication but does not encrypt traffic.
Clue to watch for The requirement is confidentiality of DNS queries.
-
Test anything
- What candidates pick
- Start a penetration test against the cloud environment as soon as internal approval is given.
- Why it looks right
- Internal management has authorized it.
- Why it's wrong
- Cloud testing must also follow the provider's testing policy and stay within the customer's own resources.
Clue to watch for The scenario mentions a public cloud provider and an upcoming test.
-
Open admin ports
- What candidates pick
- Allow RDP or SSH from the internet with strong passwords for administrator convenience.
- Why it looks right
- It is simple and administrators are trusted.
- Why it's wrong
- Exposed admin ports are constantly attacked. Access should go through a bastion or jumpbox, VPN or brokered console, with MFA and logging.
Clue to watch for The question asks for the BEST way to provide remote administrative access.
-
SIEM bought equals detection
- What candidates pick
- Assume deploying a SIEM solves the monitoring gap.
- Why it looks right
- SIEM is the standard monitoring platform.
- Why it's wrong
- Without the right sources, tuned rules and staff to triage alerts, it produces noise or misses attacks.
Clue to watch for The scenario mentions alert fatigue, missed incidents or untuned rules.
-
Improvise communications
- What candidates pick
- Let the technical lead update customers and regulators directly as the incident unfolds.
- Why it looks right
- They know the facts best.
- Why it's wrong
- Communication should follow a predefined plan with authorized spokespeople, legal review and required timelines.
Clue to watch for Regulators, customers or the press are involved.
Answer framework
For any Domain 5 operations or incident scenario, work through these steps before answering.
- Identify whether the scenario describes routine operation, a planned change, or an active incident, because the governing process differs for each.
- In an incident, contain the threat while preserving volatile evidence, capturing memory and snapshots before terminating or rebuilding anything.
- Name the operational process that owns the activity, such as change, release, deployment, configuration, incident or problem management, and follow it.
- Check provider boundaries, including published testing policies, available forensic tooling and the shared responsibility split, before acting on any provider-managed resource.
- Communicate through the predefined plan and authorized channels, meeting every contractual and legal notification timeline with information that has been verified.
Practice question
Want more like this? The CCSP practice test has questions for every domain.
Checklist
0 of 13
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Start with incident handling and forensics in 5.4 and 5.6, because sequencing questions are common and they penalize operational instinct. Practice the order: contain, preserve volatile evidence, document, then eradicate and recover. Then learn what changes in the cloud: ephemeral resources, provider tooling and jurisdiction.
Next, work through the service management processes in 5.3. Make a one-line purpose statement for each listed process, and practice naming the process from a description. Change, release and deployment management are the most commonly confused.
Then cover 5.1 and 5.2, which are long but concrete. Focus on HSM versus TPM, secure administrative access, what each network protocol protects, and patching without downtime. Candidates commonly underestimate stakeholder communication in 5.5, which appears in incident scenarios involving regulators and customers.
Afterwards, take mixed practice sets with Domain 6, where breach notification, evidence admissibility and contract terms supply the legal side of these operational tasks. Review every missed question by naming the process or step you skipped.
FAQ
How much of the CCSP exam is Domain 5?
Cloud Security Operations carries 17% under the outline effective 1 August 2026.
Do I need to know ITIL in depth?
You need to know the purpose of each process listed in the outline, such as change, release, deployment, incident and problem management, and to recognize which owns a given activity. Detailed ITIL practice guidance is not required.
Why is cloud forensics difficult?
Resources can be ephemeral, infrastructure is shared between tenants, data may sit in several jurisdictions, and the customer depends on the provider's tooling and cooperation for some evidence.
Can I penetration test my cloud environment?
Generally yes, for your own resources, but you must follow the provider's published testing policy and agree scope and rules of engagement first.
What is the difference between an HSM and a TPM?
An HSM is a dedicated device that manages keys and cryptographic operations for applications. A TPM is a chip on one computer that supports secure boot and platform integrity.
Is AI part of this domain?
Yes. The outline lists AI among the examples of intelligent monitoring of security controls, and ISC2 states AI security is integrated across all domains.
How does Domain 5 relate to Domain 3?
Domain 3 designs the infrastructure and plans its controls. Domain 5 builds, runs, monitors and defends that infrastructure.
Other Cybersecurity certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
- CompTIA Cybersecurity Analyst+ Same subject: Domain 1: Security Operations (34%)
- CompTIA SecurityX (CASP+) Same subject: Domain 4: Security Operations (22%)
- CISSP Same subject: Domain 7: Security Operations (13%)
- CompTIA Security+ Same subject: Domain 4: Security Operations (28%)
- Microsoft Security Operations Analyst Associate Study guide
- Certified Ethical Hacker Study guide
- Penetration Tester Study guide
- Systems Security Certified Practitioner Study guide
- Certified in Risk and Information Systems Control Study guide
- CompTIA PenTest+ Study guide
- Azure Security Engineer Associate Study guide
- CISM (Certified Information Security Manager) Study guide
- Certified Information Systems Auditor Study guide
Test your Domain 5 knowledge
You have covered secure build and operation, service management processes, cloud forensics and security operations. Test whether you can sequence incident actions and identify the right process under exam conditions.