CompTIA CASP+

Explore threat intelligence types, from osint and humint to vendor feeds, and apply the cyber kill chain, diamond model, and threat hunting practices to threat management.

Identify indicators of compromise and coordinate incident response through logging, SIEM, and SOAR while performing packet and protocol analysis with tcpdump and Wireshark.

Explore vulnerability management concepts, including scanning, assessments, and remediation, and learn how SCAP, CVSS, and standard languages like OVAL, ARF, and XCCDF standardize vulnerability reporting across on-premises and cloud environments.

Explore vulnerability analysis methods and tools, including static and dynamic analysis, side-channel and reverse engineering, plus Wireshark, Nmap, Burp Suite, BeEF, Metasploit, and SCAP scanners.

Analyze vulnerabilities in CASP+ by examining race conditions and buffer overflows, and outline protections like mutual exclusion, input validation, and defenses against session hijacking and insecure web headers.

Analyze web application vulnerabilities by comparing client-side versus server-side processing, examining REST/JSON APIs, injection risks, input sanitization, and SOAP, XML, and HTML5 considerations.

Identify and analyze web application vulnerabilities and attacks such as directory traversal, xss, csrf, and injection, and apply defenses like input validation, parameterization, and hard-coded static queries.

Explore deceptive technologies like honeypots, honey nets, and canary traps to observe attackers, while security data analytics and dynamic network configurations help reduce risk through monitoring and automated responses.

Master triage and incident response through event management, classification, and CSIRT communication. Develop playbooks for detection, containment, eradication, recovery, and post-incident activities with clear stakeholder coordination.

Explore digital forensics from a CASP+ perspective, detailing the four investigation phases—identification, collection, analysis, reporting—and emphasizing data acquisition, chain of custody, and integrity via imaging and cloning.

Learn file carving with foremost and strings, and perform binary analysis with hexdump, ghidra, readelf, objdump, gdb, and ollydbg; also explore firmware via binwalk for reverse engineering.

Discover essential analysis tools for incident response, including volatility for memory analysis and exiftool for file metadata, plus Nmap and its zen map GUI for network discovery.

Explore live collection tools and imaging techniques for forensics, using Wireshark, dd imaging, and hashing utilities to ensure data integrity, chain of custody, and real-time analysis.

Master key security operations concepts in domain two, including threat intelligence types, indicators of compromise, incident response, vulnerability management, and logging, guided by NIST SP 861 R2.

Explore security engineering and cryptography through managed configurations, MDM/EMM, and IAM to enforce policies, patches, encryption, and secure networking with MFA, DoH, WPA3.

Explore four mobile device deployment options—BYOD, COBO, COPE, and CYOD—focusing on ownership, security controls, and policy enforcement to enable secure corporate access and device management.

Explore mobile device security considerations, including wearables, BYOD, containerization, MDM/MAAM controls, and risk to PII and PHI. Understand jailbreaking, sideloading, bootloader security, eFuses, and wireless and hardware risks.

Explore essential hardening techniques, including removing unneeded services and unused accounts, end-of-life device management, offboarding, access reviews, and role-based access control, plus encryption, no execute (NX) memory protections, and ASLR.

Understand how policy, process, and procedure shape patching and host protection. Learn to triage updates and apply firmware patches across on-prem, cloud, and hybrid environments.

Demonstrate MAC and how classification levels govern a subject's access to an object through automated policies and execution control, including MMAC in SC Linux and SC Android.

Secure boot verifies firmware and OS integrity using TPM and UEFI certificates, PCR measurements, and KEK/DB/DBX databases to prevent tampering and enable attestation.

Explore compensating controls within defense in depth, covering antivirus, application controls, HIDS/HIPS, IDS vs IPS, EDR and XDR, UEBA, redundancy, and self-healing hardware.

Explore security risks and protections for embedded systems in the internet of things, from microcontrollers and ASICs to FPGAs and system-on-a-chip devices.

Explore industrial control systems (ICS) and SCADA, including PLCs and ladder logic. Examine security considerations for remote management, encryption, and authentication across DCS, OT networks, and IoT.

Explore industrial control system protocols, including CAN bus and Modbus, and assess security risks in automotive and UAV networks, with Zigbee, Ethernet/IP, and DDS implications.

Identify sectors where ICS and SCADA are prevalent and discuss security considerations as automated systems monitor data and control operations.

Explore cloud-based business continuity and disaster recovery (bcdr) strategies, including failover across primary and alternative providers, cloud fabric, and hybrid deployments, plus serverless computing, sdn, and log collection and analysis.

Explore cloud access security brokers as gatekeepers that enforce authentication, authorization, and auditing, while enabling encryption, key management, and data dispersion techniques across multi-cloud environments, including bit splitting.

Explore PKI basics, including asymmetric key pairs, root and subordinate certificate authorities, registration authorities, certificate types (DV, EV, SAN, wildcard), and revocation via CRL and OCSP.

Explore advanced PKI concepts, including certificate management, trust, code signing, and digital signatures, and learn how hashing, private keys, non repudiation, and OCSP/CRL secure TLS-based web communications.

Explore hashing and symmetric algorithms in depth, including hash functions, MAC and HMAC, IVs, stream and block ciphers, and practical hybrid approaches for secure data encryption.

Explore asymmetric algorithms and protocols, including public-private key pairs, key exchange (Diffie-Hellman, ECDH), digital signatures (RSA, DSA, ECDSA), TLS cipher suites, S/MIME, IPsec, SSH, and EAP variants.

Diagnose cryptographic key issues by identifying misconfigurations and mismatches in public-private key pairs and symmetric keys. Explore secure key handling, rotation, revocation, and crypto shredding.

Explore security engineering and cryptography essentials, including PKI, digital certificates, and cipher suites. Examine mobile device management, DNS security, encryption, access controls, patching, and cloud and industrial control systems considerations.

Identify and fix misconfigurations in cryptography and certificates by inspecting validity dates, certificate types, revocation status, CN matching, chain trust, and cipher suites to prevent exposure and integrity issues.

Identify mission critical functions and threats, assess vulnerabilities, and conduct risk assessment using quantitative and qualitative methods to determine controls and reduce residual risk.

Learn four risk handling techniques: avoid, accept, transfer, and mitigate through a cloud security scenario, with emphasis on due diligence, mutual risk acceptance, and a shared responsibility model.

Explore the differences between inherent and residual risk, understand how risk appetite guides tolerable residual risk, and learn how mitigation, acceptance, avoidance, transfer, and exceptions shape risk management.

The risk management lifecycle is an ongoing, cyclical process of identify, assess, control, and review that adapts to change, supported by NIST CSF and RMF frameworks.

Learn to track risk by distinguishing KPIs from KRIs, build risk registers, and use visual charts within the ISO 27001 ISMS framework.

Explore risk appetite and risk tolerance, and use ATAM trade-off analysis to inform policies and security practices, including separation of duties, least privilege, onboarding and auditing.

Explore the cloud shared responsibility model across IaaS, PaaS, and SaaS, clarifying provider and customer obligations from physical security to identity management and patching.

Learn how to perform cloud vendor assessments, evaluating lock-in and lock-out risks, data formats, vendor viability, source code escrow, service level agreements, incident reporting, geographic data residency, and third-party audits.

Apply technical testing and evaluation to verify security and that software and services perform as intended, ensure functional and nonfunctional requirements are met, and protect confidentiality, integrity, and availability.

Explore data types and classifications, including pii, phi, pifi, and ip, and how data ownership guides protection. Review retention, disposition, and destruction, plus cloud crypto-erasing and data sovereignty considerations.

Explore regulations, accreditations, and standards, from GDPR and COPPA to PCI DSS and NIST, and learn how maturity models, CSA STAR, and ISO common criteria guide compliance.

Explore legal jurisdiction, due care, due diligence, and the roles of legal holds and eDiscovery. Examine export controls and encryption laws shaping IT security decisions.

Explore master service agreements (MSA) and the suite of contracts (NDA, MOU, ISA, SLA, OLA, PLA) to govern data sharing, security, confidentiality, and scope of work in IT engagements.

Explore the business continuity plan and its link to disaster recovery, and how the business impact analysis sets priorities and recovery objectives (RTO, RPO, WRT, MAD/MDT) for high availability.

Learn how a privacy impact assessment identifies PII risks, ensures conformance with legal, regulatory and policy requirements, and guides the protection and proactive management of personal data.

Explore disaster recovery and business continuity by comparing hot, warm, cold, and mobile sites. Assess activation time, data loading, latency, and cloud disaster recovery as a service to balance cost.

Learn how compliance and leadership drive BCDR testing, and explore five test types—from checklist to full interruption—assessing RTO, RPO, and MTD to ensure disaster recovery readiness.

Explore incident response planning and testing through NIST guidance, including SP 800-61 R2 and SP 800-84, with after-action report templates and tabletop exercise guidance.

Explore governance, risk, and compliance concepts, including risk vocabulary, the five phases of risk management, business impact analysis, and cloud shared responsibility to prepare for the Casp+ exam.