Are you ready for the CASP+ CAS-004 Exam?
The CompTIA Advanced Security Practitioner (CASP+) certification is a vendor-neutral credential and internationally targeted validation of advanced-level cybersecurity skills and knowledge. The security architect and senior security engineer skills covered by CASP+ help companies comply with regulations, such as PCI-DSS and NIST 800-53 Risk Management Framework (RMF), which require IT pros to identify and mitigate enterprise risk. CASP+ is approved under the Department of Defense (DoD) Directive 8140/8570.01-M and under ANSI/ISO standard 17024.
The primary job roles for CASP+:
- Security architect
- Senior security engineer
- Security Operations Center (SOC) manager
- Security analyst
- IT cybersecurity specialist / INFOSEC specialist
- Cyber risk analyst
CASP+ CAS-003 vs. CAS-004
CompTIA is constantly reviewing the content of its certifications to ensure they address the latest technologies and meet the needs of the industry. The previous CASP+ exam objectives have been updated to be more reflective of cybersecurity architecture and engineering; endpoint security; governance, risk and compliance skills and how to assess an enterprise’s cybersecurity readiness. There’s also more focus on leading teams to design, troubleshoot and implement enterprise-wide cybersecurity solutions.
CASP+ Exam Domains
The exam domains covered in CompTIA Advanced Security Practitioner (CAS-004) are not vastly different from those in CAS-003, as they are still relevant to current job roles, but you will see some slight changes.
The exam domains have been rearranged to cover four topics instead of five, as shown in the following table:
|
CAS-004 Exam Domains |
CAS-003 Domain Equivalency |
| 1.0 Security Architecture (29%) | 2.0 Enterprise Security Architecture (25%) |
| 2.0 Security Operations (30%) | 3.0 Enterprise Security Operations (20%) |
| 3.0 Security Engineering and Cryptography (26%)
|
4.0 Technical Integration of Enterprise Security (23%) |
| 4.0 Governance, Risk and Compliance (15%) | 1.0 Risk Management (19%) |
| Redistributed across domains as needed | 5.0 Research, Development and Collaboration (13%) |
The reorganization of the exam domains results in 80% of the topics being similar to the previous version and 20% of them getting updated to include the following:
- Security Architecture: Expanded coverage to analyze security requirements in hybrid networks to work toward an enterprise-wide, zero-trust security architecture with advanced, secure cloud and virtualization solutions
- Security Operations: Expanded emphasis on newer techniques addressing advanced threat management, vulnerability management, risk mitigation, incident response tactics and digital forensics analysis
- Security Engineering and Cryptography: Expanded to focus on advanced cybersecurity configurations for endpoint security controls, enterprise mobility, cloud/hybrid environments and enterprise-wide PKI and cryptographic solutions
- Governance, Risk and Compliance: Expanded to support advanced techniques to prove an organization’s overall cybersecurity resiliency metric and compliance to regulations, such as CMMC, PCI-DSS, SOX, HIPAA, FISMA, NIST and CCPA
CASP+ Exam Objectives
The new CASP+ (CAS-004) includes more exam objectives. In fact, CAS-004 has 28 exam objectives versus the 19 in CAS-003. The purpose of this update is to break down the larger objectives found on CAS-003 into multiple objectives to improve instructional design.
The new exam objectives focus on the most up-to-date and current skills needed for the following tasks:
- Architect, engineer, integrate and implement secure solutions across complex environments to support a resilient enterprise
- Use monitoring, detection, incident response and automation to proactively support ongoing security operations in an enterprise environment
- Apply security practices to cloud, on-premises, endpoint and mobile infrastructure, while considering cryptographic technologies and techniques
- Consider the impact of governance, risk and compliance requirements throughout the enterprise
This is equivalent to at least 10 years of general hands-on IT experience, with at least 5 of those years being broad hands-on security experience. CASP+ is recommended to follow CompTIA Security+, CompTIA PenTest+ and CompTIA CySA+ on the CompTIA Cybersecurity Career Pathway.
As you use the exam objectives to prepare for your test, note that they are not exhaustive of everything you may be tested on. Consider the exam objectives stem (the heading) as your item to study and the bulleted lists as examples of some of the things that might be covered. CompTIA is constantly reviewing exam content and updating questions to ensure relevance and exam integrity.
How CASP+ Evolves with the Industry
In a field like cybersecurity, where the job is continually evolving, CompTIA exam domains need to reflect what’s happening in the industry right now. The following table explains why we updated the CASP+ exam domains and how they relate to current job requirements.
| Exam Domain | Description | How It Applies to the Job |
| 1.0 Security Architecture | Includes designing resilient enterprise cybersecurity systems to withstand the next attack. | Design architectures such as zero-trust and software-defined networking (SDN) provide resiliency solutions. |
| 2.0 Security Operations | Includes SOC processes to reduce risk such as security data analytics and security automation. | Automated attacks are used by bad actors; IT pros must fight back with automated incident response in the enterprise SOC. |
| 3.0 Security Engineering and Cryptography | Includes applying secure configurations to enterprise mobility and endpoint security controls. | Endpoint security across the enterprise, including mobility security, are proven techniques to secure all systems. |
| 4.0 Governance, Risk and Compliance | Includes applying appropriate risk strategies and compliance frameworks to an enterprise network. | Security architects must design and operate systems that comply to regulations such as PCI-DSS, NIST and CCMC. |
What Skills Will You Learn?
Security Architecture – Expanded coverage to analyze security requirements in hybrid networks to work toward an enterprise-wide, zero-trust security architecture with advanced secure cloud and virtualization solutions.
Governance, Risk, and Compliance – Expanded to support advanced techniques to prove an organization’s overall cybersecurity resiliency metric and compliance to regulations, such as CMMC, PCI-DSS, SOX, HIPAA, GDPR, FISMA, NIST, and CCPA.
Security Operations – Expanded emphasis on newer techniques addressing advanced threat management, vulnerability management, risk mitigation, incident response tactics, and digital forensics analysis.
Security Engineering and Cryptography – Expanded to focus on advanced cybersecurity configurations for endpoint security controls, enterprise mobility, cloud/hybrid environments, and enterprise-wide PKI and cryptographic solutions.
Learn More About CompTIA CASP+
Leave a Reply
You must be logged in to post a comment.