thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Cloud Security Alliance · Governance, Risk & Privacy · Professional

Certificate of Cloud Auditing Knowledge (CCAK) exam guide

Exam CCAK

The Certificate of Cloud Auditing Knowledge (CCAK), developed by the Cloud Security Alliance and ISACA, validates the ability to audit cloud environments using the Cloud Controls Matrix, CAIQ and the STAR program. It fills the gap between general IT audit credentials and cloud-specific assurance work.

Questions76
Time limit120 minutes
Passing score70%
Exam feeSee official page
Valid forSee official page
DeliveryOnline remote proctored

Format: Multiple choice. Fee note: Check the CSA or ISACA store for current pricing; 12-month eligibility period after registration.

Who it's for

IT auditors, GRC professionals, cloud security staff and vendor risk analysts who assess cloud providers and cloud workloads.

What the exam covers

Cloud Compliance Program—
Cloud Governance—
Cloud Auditing—
CCM and CAIQ: Goals, Objectives and Structure—
Evaluating a Cloud Compliance Program—
CCM: Auditing Controls—
Continuous Assurance and Compliance—
A Threat Analysis Methodology for Cloud Using CCM—
STAR Program—

A dash means the vendor does not publish a weight for that domain.

Eligibility & prerequisites

Required: None

Recommended: IT audit or cloud security background; CISA or CCSK knowledge is helpful.

Keeping it active

Confirm current maintenance requirements with CSA/ISACA before relying on an expiry date.

Skills & careers

Skills it validates

  • Auditing cloud controls with the CCM
  • Using CAIQ for provider assessments
  • Interpreting STAR registry entries and attestations
  • Continuous assurance and compliance monitoring
  • Cloud governance and shared responsibility evaluation
  • Cloud threat analysis for audit scoping

Job roles

IT AuditorCloud Audit SpecialistGRC AnalystThird-Party Risk AnalystCloud Compliance ManagerSecurity Assurance Lead

Where it fits in your path

You are here

Certificate of Cloud Auditing Knowledge (CCAK)

Planning a degree too? See how this cert earns college credit in the College Credit Navigator.

Build my study plan

  1. Week 1: Review CCSK-level cloud fundamentals and the shared responsibility model.
  2. Week 2: Study the Cloud Controls Matrix and CAIQ structure, control domains and mappings.
  3. Week 3: Audit domains: planning, evidence, continuous assurance and the STAR program levels.
  4. Week 4: Practice questions and the official study guide, then book the exam within your eligibility window.

Make it yours: pick your exam date and weekly hours. We'll split your time by domain weight and give you a printable plan.

Exam-day tips

  • Know STAR levels (self-assessment, third-party certification/attestation, continuous) and what each proves.
  • CCM and CAIQ structure is heavily tested; learn domain names and purposes.
  • Answer as an auditor: evidence and assurance, not implementation.
  • At about 1.5 minutes per question, there is time to reread long scenarios.
  • Schedule within the 12-month eligibility period.

Key terms for this exam

All 22 terms Study with thinQcards™

Commonly confused on this exam

Frequently asked questions

How many questions are on CCAK?

76 multiple-choice questions in two hours; the pass mark is 70%.

Who issues CCAK?

The Cloud Security Alliance with ISACA.

CCAK vs CISA?

CISA covers IT audit broadly and requires experience; CCAK is cloud-specific with no experience requirement.

Is CCAK worth it?

It is valuable for auditors and vendor-risk teams who assess cloud providers.

Should I take CCSK before CCAK?

It helps; CCSK covers cloud security fundamentals that CCAK assumes.

Official page: cloudsecurityalliance.org. Reviewed November 2026. Vendors change fees and objectives, so confirm with the vendor before you book. Spot something out of date? Tell us.