CCSP and AI/ML Security in 2026: What the Exam Tests

Part of our CCSP Complete Guide series.

Artificial intelligence and machine learning security has moved from a niche topic to a material component of the CCSP curriculum. If you’re using study materials from before 2024, this is a gap you need to address before your exam.

The good news: the CCSP approaches AI/ML security the same way it approaches everything else — through governance and risk management, not technical implementation. You don’t need to understand backpropagation to answer CCSP questions about AI security.

Where AI/ML Security Appears in the CBK

AI/ML security content is distributed across three domains:

Domain 2 — Cloud Data Security (Primary)

Training data for machine learning models is sensitive data managed in cloud environments. Domain 2’s data security principles apply directly:

Training data access controls: ML training datasets often contain sensitive personal data (healthcare records, financial transactions, user behavior data). The same access control principles that apply to data generally — least privilege, need-to-know, separation of duties — apply to training data with particular urgency, as compromised training data can corrupt model outputs at scale.

Data poisoning prevention: Adversaries who can inject malicious records into training datasets can manipulate model behavior. Security professionals need to understand this threat category, the controls that prevent unauthorized data modification, and the audit trails that make poisoning detectable.

Model training data provenance: Governance frameworks for AI require documenting the origin, handling, and processing of training datasets. This aligns with data lifecycle management concepts already in Domain 2.

Domain 4 — Cloud Application Security

AI/ML applications deployed in cloud are software systems with the same security requirements as other cloud applications, plus AI-specific attack surfaces:

Adversarial inputs: AI models can be manipulated through carefully crafted inputs that cause misclassification or unexpected behavior. Understanding this attack category and the controls (input validation, model robustness testing) that address it is testable content.

Model extraction attacks: Adversaries who have inference access to a deployed model may be able to reconstruct the model itself through systematic querying. This is intellectual property theft with security implications. Controls include rate limiting, output perturbation, and access controls on inference APIs.

Prompt injection: For AI systems that process natural language instructions, prompt injection allows adversaries to override intended behavior through malicious input. This is particularly relevant for LLM-based applications that process user-provided content.

LLM data leakage: Large language models trained on sensitive data may reproduce training data in outputs. Security professionals need to understand this risk, evaluation approaches, and governance controls.

MLOps security: ML pipelines (data ingestion, feature engineering, model training, evaluation, and deployment) are software systems with CI/CD characteristics. The same application security principles that apply to DevSecOps apply to MLOps: code scanning, dependency management, pipeline access controls, and artifact integrity.

Domain 6 — Legal, Risk and Compliance

AI governance and regulation is a significant addition to Domain 6:

EU AI Act: The EU AI Act classifies AI systems by risk level (prohibited, high-risk, limited-risk, minimal-risk) and imposes requirements on high-risk systems including conformity assessments, technical documentation, and human oversight. Cloud-deployed AI systems may be subject to these requirements depending on their use case and the data subjects involved.

NIST AI Risk Management Framework (AI RMF): NIST published the AI RMF in 2023. It organizes AI risk management into four functions: Govern, Map, Measure, and Manage. Security professionals familiar with the NIST Cybersecurity Framework will recognize the structure. The AI RMF is referenced in CCSP study materials as a governance framework for AI risk.

ISO/IEC 42001: The AI management system standard published in 2023, providing requirements for organizations that develop or use AI systems. Referenced for cloud security governance contexts.

How the CCSP Tests AI Security

CCSP questions about AI security follow the same pattern as all CCSP questions: scenarios asking what a competent cloud security professional should do.

Typical question frames:

“An organization is deploying an ML model that processes health records in a cloud IaaS environment. Which approach best addresses training data security?”

“A cloud application uses an LLM to process customer-submitted text. Which control best mitigates prompt injection risk?”

“Your organization’s AI vendor is based in a different legal jurisdiction. Under the EU AI Act, which governance requirement applies to your deployment?”

These questions test:

• Understanding of what threat categories exist (poisoning, extraction, injection, leakage)
• Which controls address which threats
• Which governance frameworks apply to which scenarios
• Governance-first thinking: the “best” answer is usually the governance solution, not the specific technical control

Preparation Strategy for AI/ML Security

If your existing study materials don’t cover AI/ML security (materials from before 2024 typically don’t):

1. Supplement with NIST AI RMF: The framework is publicly available on the NIST website. Read the overview document and the four core functions. This is the primary AI governance framework referenced in CCSP content.

2. Review EU AI Act fundamentals: You don’t need deep legal knowledge. Understand the risk classification levels, what makes an AI system “high-risk” under the Act, and what the primary compliance obligations are for cloud-deployed AI.

3. Understand threat categories conceptually: Data poisoning, model extraction, adversarial inputs, and prompt injection are the four primary AI-specific attack categories tested. Understand what each threat is, not how to implement the attack.

4. Apply existing CCSP frameworks: AI training data is data — Domain 2’s data lifecycle, access control, and encryption principles apply. AI applications are applications — Domain 4’s DevSecOps and API security principles apply. AI governance is governance — Domain 6’s risk management frameworks apply.

The AI/ML security content on CCSP is not a separate specialty — it’s existing CCSP principles applied to a new technology context. If you understand the underlying governance frameworks, the AI application is conceptually straightforward.

Next: CCSP and Container/Serverless Security | CCSP Exam Changes 2026