CompTIA SecurityX (CAS-005) — the full course

Every lesson and every lab is free to read, mapped one-to-one to CompTIA’s published exam objectives. The paid tier adds the 698-question exam simulator; nothing is taken away from the free course to make room for it.

49written lessons

77hands-on labs

81hours of lab work

698practice questions

Start with lesson 1 — Policies, standards, procedures and guidelines, and why the difference is examinable Exam simulator

Jump to a domain: 1. Governance, risk, and compliance · 2. Security architecture · 3. Security engineering · 4. Security operations

What the exam weighs

Domain	Share of the exam	Lessons here
1. Governance, risk, and compliance	20%	11
2. Security architecture	27%	13
3. Security engineering	31%	15
4. Security operations	22%	9

The curriculum

1. Governance, risk, and compliance 20% of the exam

01 Policies, standards, procedures and guidelines, and why the difference is examinable objective 1.1 part single
- Run an exception from request to expiry applied · 60 min
- Sort twenty requirements into the four document types short · 35 min
02 Running the programme: training, communication, reporting and RACI objective 1.2 part single
- Measure a phishing simulation by reporting rate, not click rate applied · 55 min
- Write a RACI that survives a containment decision short · 40 min
03 COBIT, ITIL and the frameworks that govern IT rather than security objective 1.3 part single
- Map one security control into an existing change process applied · 60 min
04 Asset life cycle, the CMDB, and an inventory you can trust objective 1.4 part single
- Decommission one asset completely, and prove nothing survived applied · 70 min
- Reconcile discovery against your own CMDB short · 45 min
05 GRC tooling: mapping a control once and tracking compliance automatically objective 1.5 part single
- Replace an assertion with an automated test applied · 75 min
- Map one control to clauses in three frameworks short · 40 min
06 Data governance across production, development, testing and QA objective 1.6 part single
- Write a classification table that actually drives configuration applied · 65 min
- Mask a dataset and then try to re-identify it short · 50 min
07 Risk assessment: quantitative, qualitative, and the third party you cannot audit objective 1.7 part single
- Assess a supplier you cannot audit applied · 70 min
- Run the ALE calculation in both directions short · 40 min
08 Threat modelling with STRIDE, ATT&CK and CAPEC objective 1.8 part single
- Take three threats from model to detection applied · 70 min
- Apply STRIDE to your own lab, category by category short · 55 min
09 Attack surface: architecture reviews, data flows and trust boundaries objective 1.9 part single
- Review an architecture for what a scanner cannot see applied · 75 min
- Count your lab's attack surface honestly short · 45 min
10 PCI DSS, ISO/IEC 27000 and industry-specific obligations objective 1.10 part single
- Scope a cardholder environment and assemble the evidence pack applied · 80 min
11 NIST, the CSF, CSA, and choosing a framework you can actually run objective 1.11 part single
- Choose a framework and write the statement of applicability applied · 70 min
- Domain 1 capstone: the governance pack, end to end capstone · 150 min
- Profile current and target state across the six functions short · 50 min

2. Security architecture 27% of the exam

01 CASB, shadow IT detection, and the shared responsibility line objective 2.1 part single
- Find the shadow IT in your own identity provider short · 45 min
02 Securing the pipeline: CI/CD, Terraform and Ansible objective 2.1 part single
- Find the secrets in your own Terraform state short · 50 min
03 Container, orchestration and serverless workload security objective 2.1 part single
- Draw the container estate and name what each compromise gives applied · 75 min
- Reject a privileged container with admission policy short · 55 min
04 Cloud data exposure, leakage and remanence objective 2.2 part single
- Expose a bucket deliberately, then detect it three ways short · 50 min
05 Encryption keys in the cloud, and who actually holds them objective 2.2 part single
- Choose a key model from a stated requirement, five times applied · 65 min
- Separate data access from key access, then prove it short · 55 min
06 Choosing proactive, detective and preventative controls in the cloud objective 2.3 part single
- Prove a guardrail beats an administrator short · 45 min
07 Customer-to-cloud connectivity, service integration and continuous authorization objective 2.3 part single
- Enumerate every trust relationship the platform will admit to applied · 70 min
- Replace a static key with a scoped workload identity short · 55 min
08 Segmentation and microsegmentation, and the difference that matters objective 2.4 part single
- Make a denied east-west connection your best detection applied · 70 min
- Observe first, then enforce, and keep the rollback short · 60 min
09 VPN, always-on VPN, and integrating security through APIs objective 2.4 part single
- Break an integration on purpose and see how it fails short · 50 min
10 Asset identification, management and attestation objective 2.5 part single
- Order your posture signals by how forgeable they are short · 45 min
11 Data perimeters and secure zones objective 2.5 part single
- Build a zone and find the path out that you did not design applied · 80 min
- Deny an exfiltration to your own second account short · 55 min
12 Deperimeterization: SASE, SD-WAN and software-defined networking objective 2.6 part single
- Protect the control plane better than what it controls applied · 70 min
- Measure what a local breakout removes short · 45 min
13 Zero trust: subjects, objects, and the decision in between objective 2.7 part single
- Revoke a session mid-flight, not just refuse the next one applied · 65 min
- Domain 2 capstone: prove every boundary by attempting its denies capstone · 150 min
- Enumerate subject-object-action triples for one application short · 55 min

3. Security engineering 31% of the exam

01 Scripting for security: PowerShell, Bash and Python objective 3.1 part single
- Make a mutating script refuse three ways short · 55 min
02 Infrastructure as code, cloud APIs and event triggers objective 3.1 part single
- Count the pagination gap in your own inventory script short · 50 min
03 SOAR, playbooks and workflow automation objective 3.1 part single
- Draw the automation line and bound the weaponisable action applied · 70 min
- Write an enrichment playbook that fails loudly short · 55 min
04 Generative AI in security work, and automated patching objective 3.1 part single
- Build a patch ring with a health gate that refuses to promote short · 60 min
05 Vulnerability scanning: strategy before tooling objective 3.2 part single
- Scan the same host authenticated and unauthenticated short · 50 min
06 SCAP: OVAL, XCCDF, CPE and what the acronyms buy you objective 3.2 part single
- Run a benchmark and refuse to average away the errors short · 55 min
07 CVE, CVSS, and a report somebody acts on objective 3.2 part single
- Write the report the fixing team will act on applied · 65 min
- Rescore one vulnerability for two of your own hosts short · 45 min
08 Post-quantum cryptography and what to do about it now objective 3.3 part single
- Build a cryptographic inventory of your own lab applied · 75 min
09 Homomorphic encryption, forward secrecy and data in use objective 3.3 part single
- Prove forward secrecy by looking at what a key recovers short · 50 min
10 Key stretching, hardware acceleration and where crypto actually runs objective 3.3 part single
- Benchmark a work factor on your own hardware short · 50 min
11 Cryptographic use cases: data at rest, in transit and in use objective 3.4 part single
- Issue short-lived certificates and survive an expiry applied · 75 min
- Read the data at each encryption layer short · 55 min
12 Secure email and certificate-based authentication objective 3.4 part single
- Publish and verify domain authentication records short · 45 min
13 Blockchain, privacy technologies and compliance use cases objective 3.4 part single
- Hash to a ledger instead of putting data on one short · 50 min
14 Tokenisation, hashing and digital signatures objective 3.5 part single
- Pick the primitive from the requirement, ten times short · 45 min
15 Code signing and cryptographic erase objective 3.5 part single
- Cryptographically erase, and find the copy that defeats it applied · 70 min
- Domain 3 capstone: an engineering pack that proves its own controls capstone · 160 min
- Sign an artefact, then break each link in the chain short · 55 min

4. Security operations 22% of the exam

01 SIEM: getting events in, parsing them, and keeping them objective 4.1 part single
- Silence a log source and prove you would notice short · 55 min
02 False positives, false negatives, and tuning without going blind objective 4.1 part single
- Narrow a noisy rule instead of deleting it, and prove the coverage held short · 55 min
03 Correlation, prioritisation and behaviour baselines objective 4.1 part single
- Re-rank your alert queue by consequence applied · 70 min
- Join two sources and discover your key does not match short · 55 min
04 Injection, cross-site scripting and insecure configuration objective 4.2 part single
- Find the interpreters in your own architecture short · 50 min
05 Mitigations: input validation, patching, encryption and defence in depth objective 4.2 part single
- Compensate for a patch you cannot apply applied · 65 min
- Rank five mitigations and pick two different ones short · 50 min
06 Threat hunting: internal and external intelligence objective 4.3 part single
- Plant a honeytoken and watch it fire short · 45 min
07 Sharing what you find: STIX, TAXII, Sigma, YARA and Snort objective 4.3 part single
- Sanitise an incident into something you could publish applied · 65 min
- Write one detection in a portable format and convert it short · 55 min
08 Directing malware analysis and reverse engineering objective 4.4 part single
- Triage a benign artefact statically, then dynamically short · 55 min
09 Metadata analysis, data recovery and root cause objective 4.4 part single
- Run a retrospective that reaches a design applied · 75 min
- Course capstone: make every claim in the lab prove itself capstone · 180 min
- Build a timeline from sources the attacker did not control short · 55 min

Supplementary not examined — background reading

01 An enterprise lab you cannot actually build, and what to build instead part single
- Stand up the four components and write the four documents short · 90 min

The exam simulator

698 questions, every one mapped to an objective and to the lesson that teaches it. Timed full-length papers drawn to the real domain split, retakes weighted to your weak areas, and a readiness report from your own results.

Open the simulator

This is an independent study companion for CompTIA SecurityX CAS-005 and is not produced by or endorsed by CompTIA.