CompTIA Certified SecurityX Training

This course prepares you for the CAS-005 certification exam, covering all official exam domains and their approximate weightings:

Domain 1 Governance, Risk, and Compliance (20%)

• Implement governance components (security program documentation, GRC tools, change/configuration management, data governance)
• Perform risk management activities (risk assessment frameworks, third-party/supply chain risk, confidentiality/integrity/availability/privacy risk considerations)
• Explain how compliance affects security strategy (industry standards e.g. PCI DSS, ISO/IEC 27000, NIST CSF; privacy regulations e.g. GDPR/CCPA; audits vs assessments vs certifications)
• Perform threat-modeling activities (actor characteristics, ATT&CK/CAPEC/STRIDE/Cyber Kill Chain frameworks, attack surface determination)
• Summarize information security challenges of AI adoption (prompt injection, model theft/inversion, AI-enabled attacks, AI-enabled assistants/digital workers)

Domain 2 Security Architecture (27%)

• Analyze requirements to design resilient systems (component placement, availability/integrity design, recoverability, scaling)
• Implement security throughout the systems life cycle (security requirements, SAST/DAST/IAST/RASP, SCA, SBOM, CI/CD, supply chain and hardware assurance)
• Integrate appropriate controls into secure architecture design (attack surface management, detection/threat-hunting enablers, DLP, hybrid infrastructures)
• Apply security concepts to access, authentication, and authorization system design (provisioning/deprovisioning, federation, SSO, PKI, access control models)
• Securely implement cloud capabilities in an enterprise environment (CASB, shared responsibility model, IaC via Terraform/Ansible, container/serverless security)
• Integrate Zero Trust concepts into system architecture design (continuous authorization, microsegmentation, deperimeterization via SASE/SD-WAN)

Domain 3 Security Engineering (31%)

• Troubleshoot IAM components in an enterprise environment (subject access control, MFA, PAM, federation protocols SAML/OAuth/OpenID)
• Analyze requirements to enhance endpoint and server security (EDR, HIPS/HIDS, application control, MDM, threat-actor TTPs)
• Troubleshoot complex network infrastructure security issues (DNS security, email security DKIM/SPF/DMARC, TLS/PKI issues, DDoS, ACL issues)
• Implement hardware security technologies and techniques (roots of trust, TPM/HSM, secure boot, tamper detection, firmware attacks)
• Secure specialized and legacy systems against threats (OT/SCADA/ICS, IoT, embedded systems, industry-specific challenges)
• Use automation to secure the enterprise (scripting, IaC, SOAR, generative AI, SCAP/CVE/CVSS) and apply advanced cryptographic concepts and use cases (post-quantum cryptography, homomorphic encryption, tokenization, digital signatures)

Domain 4 Security Operations (22%)

• Analyze data to enable monitoring and response activities (SIEM, aggregate data analysis, behavior baselines, reporting/dashboards)
• Analyze vulnerabilities and attacks to recommend mitigations reducing the attack surface (injection, XSS, deserialization, input validation, patching)
• Apply threat-hunting and threat intelligence concepts (OSINT, TIPs, STIX/TAXII, Sigma/YARA rule languages, indicators of attack)
• Analyze data and artifacts in support of incident response activities (malware analysis, reverse engineering, network/host/metadata analysis, root cause analysis, insider threat)