Cloud Security Certifications (2026): CCSP vs CCSK vs AWS Security Specialty vs AZ-500 (Now SC-500)

By CyberExperts Editorial Team   Published: 11/09/26   13 min read
Cyber Security Careers

Published November 9, 2026. Exam facts come from the ISC2, Cloud Security Alliance, AWS and Microsoft Learn pages linked in each section, checked on that date. Fees change and vary by country, so we link to each official price page instead of listing them.

Cloud security certifications split into two groups. Vendor-neutral credentials, ISC2 CCSP and the Cloud Security Alliance CCSK, test whether you understand cloud security as a discipline: shared responsibility, data protection, governance and risk. Platform credentials from AWS and Microsoft test whether you can configure the security services on one provider.

This guide compares the four people search for most: CCSP, CCSK, AWS Certified Security – Specialty and Microsoft AZ-500. One change matters before you plan anything. Microsoft retired AZ-500 on August 31, 2026, and replaced it with SC-500, the Cloud and AI Security Engineer Associate exam. We cover the replacement below.

Short answer: start with CCSK if you want a broad, vendor-neutral base with no experience requirement. Take AWS Security Specialty or SC-500 for the platform your employer runs. Aim for CCSP once you have the experience ISC2 asks for, or sooner if you already hold CISSP, which covers the entire CCSP experience requirement.

Free one-page guide

Which cert next

Networking, then Security+, then the cert the job actually names: SecurityX if you stay technical, CISSP over CISM when you want to lead, CCSP after CISSP for cloud, CEH when postings require it, plus where ISC2 CC and PMP fit. From CyberExperts.
Join the CyberExperts Daily Brief. The PDF shows up here after you subscribe.

Cloud security certifications compared

ISC2 CCSPCSA CCSK v5AWS Certified Security – Specialty (SCS-C03)Microsoft AZ-500, now SC-500
TypeVendor-neutral certificationVendor-neutral certificateAWS platform certificationMicrosoft Azure platform certification
Exam formatComputerized adaptive test, 100 to 150 items, 3 hoursOnline, open-book, 60 multiple-choice questions, 120 minutes65 questions (50 scored, 15 unscored), 170 minutesSC-500: proctored, 120 minutes, may include interactive components
Passing score700 out of 100080%750 on a 100 to 1,000 scale700 or greater
Experience5 years in IT, including 3 in cybersecurity and 1 in a CCSP domain (CISSP covers all of it)None requiredAWS suggests 3 to 5 years securing cloud solutionsPractical Azure and hybrid administration; strong Microsoft Entra ID knowledge
Where you testPearson VUE test centerOnlinePearson VUE test center or online proctoredPearson VUE
ValidityThree-year cycle: 90 CPE credits plus an annual maintenance feeDoes not expire3 years; recertify by passing the latest version12 months; free online renewal assessment

Sources: ISC2 CCSP exam outline, CSA CCSK, CSA exam FAQ, ISC2 member policies, AWS Certified Security – Specialty, SCS-C03 exam guide, Microsoft Learn SC-500 and the SC-500 study guide.

ISC2 CCSP: the senior vendor-neutral credential

ISC2 says the CCSP shows “the advanced technical skills and knowledge to design, manage and secure data, applications and infrastructure in the cloud.” Its listed audience includes cloud architects, cloud engineers, cloud security analysts and auditors of cloud computing services (ISC2). ISC2 lists CCSP as ANAB accredited under ISO/IEC 17024 and lists U.S. DoDM 8140.03 among its recognitions.

The exam uses computerized adaptive testing: 100 to 150 items in 3 hours, multiple choice plus advanced item types, with 700 out of 1000 to pass. It runs at Pearson test centers in English, Chinese, Japanese and German (ISC2 exam outline). Domain weights:

CCSP domainAverage weight
1. Cloud Concepts, Architecture and Design17%
2. Cloud Data Security20%
3. Cloud Platform and Infrastructure Security17%
4. Cloud Application Security16%
5. Cloud Security Operations17%
6. Legal, Risk and Compliance13%

The current outline also adds AI material, such as protecting AI and machine learning data sets and models in domain 2 and the OWASP Top 10 for Large Language Model Applications in domain 4.

Experience: five years of cumulative, full-time IT work, with three in cybersecurity and one in at least one CCSP domain. Part-time work and internships can count. A relevant bachelor’s or master’s degree or the CCSK can each cover one year, but only one year can be waived in total. An active CISSP replaces the whole requirement. If you pass without the experience, you become an Associate of ISC2 and have six years to earn it (ISC2). To keep CCSP, ISC2 requires 90 CPE credits over each three-year cycle, at least 60 of them in Group A, plus an annual maintenance fee (ISC2 member policies).

Our CCSP exam guide covers the CISSP shortcut, and CISSP vs CCSP explains which ISC2 credential to take first.

CSA CCSK: the vendor-neutral starting point

The Certificate of Cloud Security Knowledge comes from the Cloud Security Alliance. CSA calls it “the first step in preparing for other cloud certifications.” The current version, CCSK v5, adds AI and generative AI, Zero Trust, data lakes and cloud telemetry, and it cut detailed laws-and-regulations coverage (CSA).

The exam is online and open-book: 60 multiple-choice questions drawn from a larger pool, 120 minutes, and an 80% minimum passing score. CSA says there is no official work experience or prior qualification requirement, though a basic grasp of firewalls, secure development, encryption and identity and access management helps. Purchase includes two test attempts to use within two years. CSA released v5 on July 16, 2024, offers the exam in English, Spanish and Japanese, and says the certificate does not expire (CSA exam FAQ).

CCSK v5 covers 12 domains:

CSA offers a free prep kit for self-study, plus self-paced, instructor-led and CCSK Plus (lectures and hands-on labs) training. The CCSK also counts for one year of the CCSP experience requirement (ISC2).

AWS Certified Security – Specialty (SCS-C03)

AWS says the Security Specialty validates “expertise in creating and implementing security solutions in the AWS Cloud,” including data classification, encryption and secure internet protocols (AWS). The exam has 65 questions in 170 minutes, multiple choice or multiple response, at a Pearson VUE test center or online with a proctor.

The SCS-C03 exam guide says 50 questions are scored and 15 are unscored, results come as a scaled score from 100 to 1,000, and 750 passes. Question types include multiple choice, multiple response, ordering and matching (AWS exam guide). Domain weights:

AWS describes the target candidate as having the equivalent of 3 to 5 years securing cloud solutions. Its certification page also points to five years of IT security experience and two or more years securing AWS workloads. No prior AWS certification is required, though many candidates earn Solutions Architect – Associate first. The certification is valid for three years. The Simplified Chinese, Spanish (Latin America) and Portuguese (Brazil) versions retire after December 31, 2026.

We cover study order and IAM-heavy questions in our AWS Security Specialty exam guide.

Microsoft AZ-500 is retired: SC-500 replaces it

Microsoft retired the Azure Security Engineer Associate certification and the AZ-500 exam on August 31, 2026. Its Learn page says you can no longer earn or renew the certification after that date (Microsoft Learn). The replacement is the Microsoft Certified: Cloud and AI Security Engineer Associate, exam SC-500, available since July 21, 2026. Microsoft’s partner announcement says certifications completed before the retirement date remain valid for one year (Microsoft).

SC-500 targets security engineers who protect identity, network, application, data and compute across Azure and hybrid environments, and who secure the platforms and data used by AI workloads. You get 120 minutes, the exam is proctored and may include interactive components, and 700 or greater passes (Microsoft Learn). Skills measured (study guide):

The AI items are specific: Microsoft Purview Data Security Posture Management for Copilot and AI apps, Microsoft Entra Agent ID, guardrails for agents in Microsoft Foundry and Defender for AI services. The posture domain covers Defender for Cloud, including connecting AWS and Google Cloud environments, plus Microsoft Sentinel and Security Copilot. Microsoft certifications at this level expire every 12 months and renew through a free online assessment on Microsoft Learn (Microsoft).

If your team works in Microsoft Sentinel and Defender XDR all day, also look at SC-200, the security operations analyst exam.

Which cloud security certification to take first

Our cybersecurity certification path and map shows where cloud credentials sit by level. For AI-specific credentials, see AI security certifications. If you are choosing tools rather than certs, start with DSPM vs CSPM vs CNAPP, then the best CNAPP tools and best CSPM tools guides.

Who pays for cloud security certifications

Many employers fund cloud certifications because the provider credentials tie directly to the platform the team runs. Ask before you buy, and check the official pages for current fees in your country:

If you are paying yourself, our certification cost calculator helps you add up exam, training and renewal costs, and the cheapest cybersecurity certifications lists lower-cost options.

Cloud security certification questions

What is the best cloud security certification?

It depends on your role. CCSP is the senior vendor-neutral credential. CCSK is the vendor-neutral starting point with no experience requirement. AWS Certified Security – Specialty and Microsoft SC-500 prove you can secure one provider’s platform.

Is AZ-500 still available?

No. Microsoft retired the AZ-500 exam and the Azure Security Engineer Associate certification on August 31, 2026. The replacement is SC-500, the Cloud and AI Security Engineer Associate exam, available since July 21, 2026.

What is the difference between CCSK and CCSP?

CCSK, from the Cloud Security Alliance, is an online, open-book exam with 60 questions and no experience requirement. CCSP, from ISC2, is a proctored adaptive exam with 100 to 150 items and requires five years of IT experience to certify. Passing the CCSK counts for one year of that CCSP experience.

Can I take the CCSP without experience?

Yes. If you pass without the required experience, you become an Associate of ISC2 and have six years to earn the five years ISC2 requires. An active CISSP covers the whole experience requirement.

How hard is the AWS Security Specialty exam?

AWS aims it at people with the equivalent of 3 to 5 years securing cloud solutions. It has 65 questions in 170 minutes, and you need a scaled score of 750 out of 1,000. Identity and access management is the largest domain at 20%.

Does the CCSK expire?

No. The Cloud Security Alliance says the CCSK certificate does not expire, though it advises staying current with the latest version. CCSP and the AWS and Microsoft certifications all need renewal.

Which cloud security certification should a beginner take?

CCSK is the usual starting point because it has no experience requirement and covers cloud security across providers. If you are new to security as well, start with Security+ or ISC2 CC first.

Sources

CyberExperts Editorial Team

CyberExperts guides are researched from official certification body sources and fact-checked by the CyberExperts editorial team.