CompTIA SecurityX (CAS-005) Cert Prep

16h 52mAdvanced2025-06-06

Authors

Pearson

Michael Shannon

Course details

The CompTIA SecurityX (formerly CASP+) certification vets your abilities as an experienced IT professional to secure complex enterprise environments. In this hands-on, intensive course, instructor Michael Shannon prepares you for the SecurityX certification exam, which validates expertise in cloud, on-premises, and hybrid environments, as well as implementing cryptographic technologies and addressing emerging security trends with AI. Explore real-world applications to architect, engineer, and integrate secure solutions while proactively managing security operations through automation, monitoring, and incident response. Along the way, develop the skills needed to apply governance, compliance, and risk management strategies, preparing you for senior roles such as security engineers and architects who are responsible for defending networks and systems against modern cyber threats.

Learning objectives
Measure cybersecurity resilience and ensure compliance with regulations such as HIPAA, GDPR, PCI-DSS, and more.
Evaluate security needs in hybrid networks to develop an enterprise-wide Zero Trust architecture using advanced cloud and virtualization solutions.
Configure endpoint security, mobility solutions, and enterprise-wide PKI for secure cloud and hybrid environments.
Master advanced techniques in threat management, vulnerability assessment, incident response, and digital forensics.

Skills covered

Vulnerability ManagementNetwork SecurityIncident ResponseCybersecurityCert Prep

Concepts

0. Introduction

01 - CompTIA SecurityX (CAS-005) - Introduction

1. Implementing Appropriate Governance Components

02 - Module 1 - Governance, risk, and compliance introduction
03 - Learning objectives
04 - Security program documentation
05 - Security program management
06 - Governance frameworks
07 - Change and configuration management
08 - Governance, risk, and compliance (GRC) tools
09 - Data governance in staging environments

2. Risk Management Activities

10 - Learning objectives
11 - Impact analysis
12 - Risk assessment and management
13 - Third-party risk management
14 - Availability risk considerations
15 - Confidentiality risk considerations
16 - Integrity risk considerations
17 - Privacy risk considerations
18 - Crisis management and breach response

3. Compliance Security Strategies

19 - Learning objectives
20 - Awareness of industry-specific compliance
21 - Industry standards
22 - Security and reporting frameworks
23 - Audits vs. assessments vs. certifications
24 - Privacy regulations
25 - Cross-jurisdictional compliance requirements

4. Threat Modeling Activities

26 - Learning objectives
27 - Threat actor characteristics
28 - Attack patterns
29 - Threat modeling frameworks
30 - Attack surface determination
31 - Threat modeling methods
32 - Modeling applicability to the environment

5. Security Challenges with AI

33 - Learning objectives
34 - Legal and privacy implications
35 - Threats to the models
36 - AI-enabled attacks
37 - Risks of AI usage
38 - AI assistants and digital workers

6. Designing Resilient Systems

39 - Module 2 - Security architecture introduction
40 - Learning objectives
41 - Next-generation firewalls
42 - Intrusion detection prevention systems
43 - VPNs and SDPs
44 - Network access control (NAC)
45 - Web application firewalls (WAF)
46 - Content delivery networks (CDN)
47 - Scanners, proxies, taps, and collectors
48 - Availability and integrity design considerations

7. Securing the DevOps Lifecycle

49 - Learning objectives
50 - Security requirements definition
51 - Software assurance
52 - Continuous integration continuous deployment (CI CD)
53 - Supply chain risk management
54 - Hardware assurance
55 - End-of-life (EOL) considerations

8. Secure Architecture Control Design

56 - Learning objectives
57 - Attack surface management and reduction
58 - Detection and threat hunting
59 - Information and data security design
60 - Data loss prevention (DLP)
61 - Securing hybrid infrastructures
62 - Securing third-party integrations
63 - Assessing control effectiveness

9. Designing Access, Authentication, and Authorization

64 - Learning objectives
65 - Provisioning, proofing, and deprovisioning
66 - Access control systems
67 - Federation and SSO
68 - Zero trust PDPs and PEPs
69 - Access control models
70 - Public key infrastructure (PKI)
71 - Logging and auditing access control

10. Secure Cloud Implementation

72 - Learning objectives
73 - Cloud service types and shared responsibility
74 - Cloud control strategies
75 - Serverless cloud solutions
76 - Infrastructure as code (IaC)
77 - Container security
78 - API security
79 - Cloud access security brokers (CASB)
80 - Key management services
81 - Cloud connectivity, integration, and adoption

11. Zero Trust Concepts

82 - Learning objectives
83 - Zero trust principles
84 - Defining subject-object relationships
85 - Continuous authorization and context-based reauthentication
86 - Zero trust network architecture
87 - API integration and validation
88 - Asset identification, management, and attestation
89 - Security boundaries and deperimeterization

12. Engineering and Troubleshooting IAM

90 - Module 3 - Security engineering introduction
91 - Learning objectives
92 - Subject access control
93 - Authentication and authorization
94 - Biometric factors
95 - Secrets management
96 - Conditional access
97 - Privileged identity management and attestation
98 - Cloud IAM access and trust policies
99 - Logging and monitoring IAM

13. Enhancing Endpoint to Server Security

100 - Learning objectives
101 - Host-based IDS and IPS
102 - Endpoint detection and response (EDR)
103 - Next-generation EDR
104 - Attack surface monitoring and reduction
105 - Antimalware
106 - Host-based firewall and browser isolation
107 - SELinux
108 - Configuration management and application control
109 - Enterprise mobility management (MDM and MAM)
110 - Threat actor tactics, techniques, and procedures (TTPs)

15. Hardware Security Technologies and Techniques

119 - Learning objectives
120 - Threat actor TTPs
121 - Roots of trust
122 - Security coprocessors
123 - Virtual and self-healing hardware
124 - Secure and measured boot
125 - Host-based encryption and self-encrypting drive (SED)
126 - Tamper detection and countermeasures

16. Securing Specialized and Legacy Systems

127 - Learning objectives
128 - Characteristics of specialized and legacy systems
129 - Operational technology (OT)
130 - Internet of things (IoT)
131 - Embedded systems and system-on-chip (SoC)
132 - Wireless technologies and radio frequency (RF)
133 - Security and privacy considerations
134 - Industry-specific challenges

17. Securing the Enterprise with Automation

135 - Learning objectives
136 - Scripting and event-based triggers
137 - Infrastructure as code (IaC)
138 - Configuration files
139 - Cloud APIs andsoftware development kits (SDKs)
140 - Generative AI
141 - Containerization
142 - Automated patching and auto-containment
143 - Security orchestration, automation, and response (SOAR)
144 - Security content automation protocol (SCAP)

18. Advanced Cryptographic Concepts

145 - Learning objectives
146 - Post-quantum cryptography (PQC)
147 - Key stretching and splitting
148 - Homomorphic and envelope encryption
149 - Forward secrecy
150 - Authenticated encryption with associated data (AEAD)
151 - Hardware acceleration
152 - Mutual authentication and secure multiparty computation

19. Appropriate Cryptographic Use Cases and Techniques

153 - Learning objectives
154 - Data in transit, rest, and use
155 - Data sanitization and anonymization
156 - Secure email with cryptography
157 - Non-repudiation
158 - Immutable databases and blockchain
159 - Legal, regulatory, and privacy considerations
160 - Passwordless authentication
161 - Software provenance and code integrity
162 - Survey of cryptographic techniques

20. Monitoring and Response Activities

163 - Module 4 - Security operations introduction
164 - Learning objectives
165 - Security information event management (SIEM)
166 - Aggregate data analysis
167 - Behavior baselines and analytics
168 - Incorporating diverse data sources
169 - Security alerting for data
170 - Reporting and metrics

21. Analyzing Vulnerabilities and Attacks

171 - Learning objectives
172 - Injection attacks
173 - Request forgery
174 - Unsafe memory utilization
175 - Race conditions
176 - Insecure configurations and improper patching
177 - Deserialization and confused deputy vulnerabilities
178 - Weak ciphers

22. Mitigating Vulnerabilities and Attacks

179 - Learning objectives
180 - Input validation, output encoding, and indexing
181 - Safe functions
182 - Updating and patching
183 - Security design patterns
184 - Least privilege, defense in depth, and segregation of duties
185 - Fail secure and fail safe
186 - Secrets management
187 - Encryption and code signing

23. Threat Hunting and Threat Intelligence

188 - Learning objectives
189 - Internal intelligence sources
190 - External intelligence sources
191 - Counterintelligence and operational security
192 - Threat intelligence platforms (TIPs)
193 - Indicator of compromise (IoC) sharing
194 - Indicators of attack
195 - Rule-based languages

24. Incident Response Activities

196 - Learning objectives
197 - Malware analysis
198 - Hardware analysis
199 - Reverse engineering
200 - Data recovery and extraction
201 - Root cause analysis and threat response
202 - Preparedness exercises
203 - Cloud workload protection program (CWPP)

Conclusion

204 - CompTIA SecurityX (CAS-005) - Summary