DevOps and ConfigMgr Blog

Tips For Passing the CCSP Exam

ChadCarroll — Fri, 01 Dec 2017 11:37:03 GMT

A few months ago I passed the Cloud Certified Security Professional (CCSP) exam from ISC2.org and afterword's a lot friends and colleagues were interested in my experience. The one questions that most people studying for the CCSP exam want to know is "How does this exam compare in difficulty to the CISSP?" If you're unfamiliar with the CISSP exam, it's considered the elite Cyber Security exam and the most globally recognized standard of achievement in the industry. It's a grueling 6 hours test that takes weeks of preparation.

What is CCSP?

The CCSP is a global credential that represents the highest standard for cloud security expertise. It was co-created by (ISC)² and Cloud Security Alliance — leading stewards for information security and cloud computing security. When you earn this cloud security certification, you prove you have deep knowledge and hands-on experience with cloud security architecture, design, operations and service orchestration. To qualify for the CISSP certification, you must have:

A minimum of five years cumulative, paid, full-time work experience in information technology
Of which five years must be in information security and one year in two or more of the eight domains of the CISSP Common Body of Knowledge (CBK)

To qualify for the CCSP certification, you must have:

A minimum of five years cumulative, paid, full-time work experience in information technology
Of which three years must be in information security and one year in one or more of the six domains of the CCSP Common Body of Knowledge (CBK)

How does the CCSP compare to the CISSP?

Ok, so this is the one question everyone wants to know and is somewhat subjective. I invested 2 months of focused studying to the CISSP exam and after answering the last question on the test, I thought I'd failed. It was difficult and there were a lot of questions that I felt had two answers. Surprising, and thankfully I passed the exam! So, what worked the first time to pass the CISSP exam must also work for the CCSP. For the CCSP exam I also dedicated 2 months of study the exam. Even though there are only 6 domains for the CCSP compared to 8 for the CISSP you need to take each domain seriously. Chances are if you fail a single domain you'll fail the exam. Below is a comparison table between the CISSP and CCSP. Of course, the study time and difficulty rating is based on my own experience and will vary by individual.

Topic	CISSP	CCSP
Number of questions	250	200
Exam Hours	6	4
Domains	8	6
Exam Costs	$599	$549
Preparation\Study Time	300 hrs	300 hrs
Difficulty on 1-10 scale	9	5

How did I prepare for the CCSP?

In preparation for the CCSP exam I used the following resources to successfully pass the exam.

Official (ISC)2 CCSP Self-Paced Training

This is the official training material provided by (ISC)2 and available for sale on their website. There often special deals for this training and can be purchased for $295.

Official (ISC)² CCSP student workbook (electronic version)
Interactive flash cards.
Post-assessment practice questions to gauge exam readiness
120 days of access to the recordings and course content from time of purchase

Opinion: I found the Official (ISC)² CCSP student workbook to be the best resource of material that aligns with the exam questions. The 120 days of access to recordings contained 40 hours of videos. However, I found the Official student workbook to be the best reading material and content that aligned with the test.

Official (ISC)2 CCSP Official Study Guide

This is the official study guide reviewed and endorsed by (ISC)2 and contains:

334 pages of reading content
Exercises, and chapter review
Hundreds of flashcards
Two complete practice exams
PDF glossary

Opinion: I used the CCSP Official Study Guide as a second major resource in preparation. The content was much deeper than that of the Student Workbook and the exam questions at the end of each chapter were a resource to reinforce your learning. However, after taking the exam I personally felt the level of detail in this guide was much deeper than the questions asked on the exam.

Quizlet

Quizlet is a mobile & web-based study application with tons of CCSP flash cards publicly available. https://quizlet.com/ Opinion: I found Quizlet to be extremely valuable in learning definitions. The mobile app is very easy to use and has several methods for learning that I found to be fun and helpful. I created my own set of personalized practice questions, but there are quite a few publicly available flash sets readily available.

Final Thoughts

The CCSP exam is not as difficult as the CISSP exam but that doesn't mean you should take it lightly. Study, study, and then study some more. If you use the study material presented above, you have an excellent chance at passing the exam on your first attempt. Similar to the CISSP, the exam content is a "mile wide and an inch deep" so it's important that you study all the domains equally. The official testing center for (ISC)2 is PearsonVue. https://home.pearsonvue.com/test-taker.aspx. I found when scheduling my exam that seats were extremely limited and the first available was 3 weeks out in my city. I've heard from others similar scheduling challenges. On this note, I recommend scheduling your exam well in advance. Not only will you be able to get the date and time that you want, but it will reinforce your commitment to your study plan. Please let me know if you found this exam prep guide helpful and good luck on your way to becoming a CCSP. Source - https://www.isc2.org/Certifications/CCSP

Use PowerShell to Send email from O365 Account

ChadCarroll — Tue, 28 Nov 2017 20:27:59 GMT

Prior to PowerShell 5.0 to send an email you had to use the .NET System.Net.Mail namespace. Now with PowerShell 5.0 and higher you can easily send email messages using the cmdlet Send-MailMessage. . You can use any valid SMTP server but for our example we'll use an O365 account. Just make sure you set your smtp address to smtp.office365.com and port to 587 and you should be all set.

Note: Make sure you use -UseSSL or else you'll receive a Send-MailMessage : The SMTP server requires a secure connection or the client was not authenticated. The server response was: 5.7.57 SMTP; Client was not authenticated to send anonymous mail during MAIL FROM

Upload and Download Files using a SAS Token

ChadCarroll — Sun, 26 Nov 2017 09:39:34 GMT

A SAS token can be used to grant temporary access to your storage without exposing your storage key. By leveraging a SAS token we can grant objects temporary access to our container with the defined permissions and a defined time. If you're unfamiliar or want the details of how a SAS token works then head over to https://docs.microsoft.com/en-us/azure/storage/common/storage-dotnet-shared-access-signature-part-1. Objective: Today we will simplify the process by demonstrating how easy it is to create and use a SAS Token and prove it works by uploading and downloading files. Implementation: Step 1: The first step if you haven't' already done so is to create a resource group and storage account.

$ResourceGroupName = 'LabRG1'

$StorageAccountName = 'labsa1'

$ContainerName = 'labcn1'

#create new resource group and storage account

New-AzureRmResourceGroup -Name $ResourceGroupName -Location $location

New-AzureRmStorageAccount -ResourceGroupName $ResourceGroupName -Name $StorageAccountName -Type Standard_LRS -Location "East US"

Set-AzureRmCurrentStorageAccount -ResourceGroupName $ResourceGroupName -Name $StorageAccountName

Step 2: Next, create a new storage container.

# create a container

New-AzureStorageContainer -Name $ContainerName -Permission Off

Note: Set the container Permission to Off so that anonymous access is turned off. Access will be granted with the SAS token created in the next step.

Step 3: Create the SASToken and specify the permissions and expiration time for the token. The ExpiryTime is the amount of time before the SASToken expires. You should set this value to a time that will allow you to complete the desired operation.

#new SASToken

$sasToken = New-AzureStorageContainerSASToken -container $ContainerName -Permission rwdl -ExpiryTime (get-date).AddHours(1)

#new storage content using the SAS token we just create

$StorageContext = New-AzureStorageContext $StorageAccountName -SasToken $sasToken

We now have everything setup to securely upload and download files. The key is the use the $StorageAccount object that we just created. Let's verify in our subscription that our container is created.

Step 4: Let's upload a file to our container as a blob.

#upload a file

Set-AzureStorageBlobContent -File $file -Container $containerName -Context $StorageContext -Blob $blob -Force -WarningAction SilentlyContinue

Now let's verify the file was uploaded to our container.

Step 5: Now let's download the file to our Azure Iaas VM.

#download a file

Get-AzureStorageBlobContent -Container $ContainerName -Blob 'testfile.txt' -Destination 'C:\test\testfile.txt' -Context $storageAccountContext -Force

The testfile.txt was downloaded to our local IaaS VM. See how easy it is to upload and download a file using a SASToken.

PowerShell