CompTIA SecurityX CAS-005 Lessons

Every lesson is free to read, with three practice questions each. Work through them in order, or jump to the objective you need.

Practise with the exam simulator

  1. Policies, standards, procedures and guidelines, and why the difference is examinableObjective 1.1Audio
  2. An enterprise lab you cannot actually build, and what to build insteadAudio
  3. Running the programme: training, communication, reporting and RACIObjective 1.2Audio
  4. COBIT, ITIL and the frameworks that govern IT rather than securityObjective 1.3Audio
  5. Asset life cycle, the CMDB, and an inventory you can trustObjective 1.4Audio
  6. GRC tooling: mapping a control once and tracking compliance automaticallyObjective 1.5Audio
  7. Data governance across production, development, testing and QAObjective 1.6Audio
  8. Risk assessment: quantitative, qualitative, and the third party you cannot auditObjective 1.7Audio
  9. Threat modelling with STRIDE, ATT&CK and CAPECObjective 1.8Audio
  10. Attack surface: architecture reviews, data flows and trust boundariesObjective 1.9Audio
  11. PCI DSS, ISO/IEC 27000 and industry-specific obligationsObjective 1.10Audio
  12. NIST, the CSF, CSA, and choosing a framework you can actually runObjective 1.11Audio
  13. CASB, shadow IT detection, and the shared responsibility lineObjective 2.1Audio
  14. Securing the pipeline: CI/CD, Terraform and AnsibleObjective 2.1Audio
  15. Container, orchestration and serverless workload securityObjective 2.1Audio
  16. Cloud data exposure, leakage and remanenceObjective 2.2Audio
  17. Encryption keys in the cloud, and who actually holds themObjective 2.2Audio
  18. Choosing proactive, detective and preventative controls in the cloudObjective 2.3Audio
  19. Customer-to-cloud connectivity, service integration and continuous authorizationObjective 2.3Audio
  20. Segmentation and microsegmentation, and the difference that mattersObjective 2.4Audio
  21. VPN, always-on VPN, and integrating security through APIsObjective 2.4Audio
  22. Asset identification, management and attestationObjective 2.5Audio
  23. Data perimeters and secure zonesObjective 2.5Audio
  24. Deperimeterization: SASE, SD-WAN and software-defined networkingObjective 2.6Audio
  25. Zero trust: subjects, objects, and the decision in betweenObjective 2.7Audio
  26. Scripting for security: PowerShell, Bash and PythonObjective 3.1Audio
  27. Infrastructure as code, cloud APIs and event triggersObjective 3.1Audio
  28. SOAR, playbooks and workflow automationObjective 3.1Audio
  29. Generative AI in security work, and automated patchingObjective 3.1Audio
  30. Vulnerability scanning: strategy before toolingObjective 3.2Audio
  31. SCAP: OVAL, XCCDF, CPE and what the acronyms buy youObjective 3.2Audio
  32. CVE, CVSS, and a report somebody acts onObjective 3.2Audio
  33. Post-quantum cryptography and what to do about it nowObjective 3.3Audio
  34. Homomorphic encryption, forward secrecy and data in useObjective 3.3Audio
  35. Key stretching, hardware acceleration and where crypto actually runsObjective 3.3Audio
  36. Cryptographic use cases: data at rest, in transit and in useObjective 3.4Audio
  37. Secure email and certificate-based authenticationObjective 3.4Audio
  38. Blockchain, privacy technologies and compliance use casesObjective 3.4Audio
  39. Tokenisation, hashing and digital signaturesObjective 3.5Audio
  40. Code signing and cryptographic eraseObjective 3.5Audio
  41. SIEM: getting events in, parsing them, and keeping themObjective 4.1Audio
  42. False positives, false negatives, and tuning without going blindObjective 4.1Audio
  43. Correlation, prioritisation and behaviour baselinesObjective 4.1Audio
  44. Injection, cross-site scripting and insecure configurationObjective 4.2Audio
  45. Mitigations: input validation, patching, encryption and defence in depthObjective 4.2Audio
  46. Threat hunting: internal and external intelligenceObjective 4.3Audio
  47. Sharing what you find: STIX, TAXII, Sigma, YARA and SnortObjective 4.3Audio
  48. Directing malware analysis and reverse engineeringObjective 4.4Audio
  49. Metadata analysis, data recovery and root causeObjective 4.4Audio