CompTIA Advanced Security Practitioner (CASP+) (CAS-004) Cert Prep
27h 41mAdvanced2024-07-29
Authors
Jason Dion
Cybersecurity Trainer at Dion Training Solutions
Dion Training Solutions LLC
Course details
The CASP+ (CompTIA Advanced Security Practitioner+) (CAS-004) certification is a vendor-neutral certification that validates your knowledge and ability to conduct advanced-level cybersecurity skills. This certification tests your ability to implement solutions within cybersecurity policies and frameworks. CASP+ (CAS-004) is an advanced-level cybersecurity certification covering technical skills in security architecture and senior security engineering. The CompTIA Advanced Security Practitioner+ exam focuses on security architecture and engineering, to validate a technical leader's ability to assess cyber readiness and design and implement the proper solutions. In this comprehensive course, expert cybersecurity trainer Jason Dion helps you prepare to earn this certification, covering in depth each topic you will need to understand for the exam.
Skills covered
Network SecurityIncident ResponseCert PrepCybersecurity
Concepts
Introduction
- Welcome
- About the exam
Securing Networks
- Securing networks
- Switches
- Routers
- Wireless and mesh
- Firewalls
- Proxies
- Gateways
- IDS and IPS
- Network access control
- Remote access
- Unified communication
- Cloud vs. on-premises
- DNSSEC
- Load balancer
Securing Architectures
- Securing architectures
- Traffic mirroring
- Network sensors
- Host sensors
- Layer 2 segmentation
- Network segmentation
- Server segmentation
- Zero trust
- Merging networks
- Software-defined networking
Infrastructure Design
- Infrastructure design
- Scalability
- Resiliency issues
- Automation
- Performance design
- Virtualization
- Containerization
Cloud and Virtualization
- Cloud and virtualization
- Cloud deployment models
- Cloud service models
- Deployment considerations
- Provider limitations
- Extending controls
- Provisioning and deprovision
- Storage models
- Virtualization
Software Applications
- Software applications
- Systems development lifecycle
- Software development lifecycle
- Development approaches
- Software assurance
- Baselines and templates
- Best practices
- Integrating applications
Data Security
- Data security
- Data lifecycle
- Data classification
- Labeling and tagging
- Deidentification
- Data encryption
- Data loss prevention (DLP)
- DLP detection
- Data loss detection
Authentication and Authorization
- Authentication and authorization
- Access control
- Credential management
- Password policies
- Multifactor authentication
- Authentication protocols
- Federation
- Root of trust
- Attestation
- Identity proofing
Cryptography
- Cryptography
- Privacy and confidentiality
- Integrity
- Compliance and policy
- Data states
- Cryptographic use cases
- PKI use cases
Emerging Technology
- Emerging technology
- Artificial intelligence and machine learning
- Deep learning
- Big data
- Blockchain distributed consensus
- Passwordless authentication
- Homomorphic encryption
- Virtual and augmented reality
- 3D printing
- Quantum computing
Threat and Vulnerability Management
- Threat and vulnerability management
- Threat intelligence
- Threat hunting
- Intelligence collection
- Threat actors
- Threat management frameworks
- Vulnerability management activities
- Security Content Automation Protocol
Vulnerability Assessments
- Vulnerability assessments
- Penetration test
- Pen test steps
- Pen test requirements
- Code analysis
- Protocol analysis
- Analysis utilities
Risk Reduction
- Risk reduction
- Deceptive technologies
- Security data analytics
- Preventative controls
- Application controls
- Security automation
- Physical security
Analyzing Vulnerabilities
- Analyzing vulnerabilities
- Race conditions
- Buffer overflows
- Authentication and references
- Ciphers and certificates
- Improper headers
- Software composition
- Vulnerable web applications
Attacking Vulnerabilities
- Attacking vulnerabilities
- Directory traversals
- Cross-Site Scripting (XSS)
- Cross-site request forgery (CSRF)
- SQL injections
- XML injections
- Other injection attacks
- Authentication bypass
- VM attacks
- Network Attacks
- Social engineering
Indicators of Compromise
- Indicators of compromise
- Types of IoCs
- PCAP files
- NetFlow
- Logs
- IoC notifications
- Response to IoCs
Incident Response
- Incident response
- Triage
- Communication plan
- Stakeholder management
- Incident response process
- Playbooks
Digital Forensics
- Digital forensics
- Forensic process
- Chain of custody
- Order of volatility
- Forensic analysis
Digital Forensic Tools
- Digital forensic tools
- Forensic workstations
- File carving tools
- Binary analysis tools
- Forensic analysis tools
- Imaging tools
- Collection tools
Enterprise Mobility
- Enterprise mobility
- Enterprise mobility management
- WPA3
- Connectivity options
- Security configurations
- DNS protection
- Deployment options
- Reconnaissance concerns
- Mobile security
Endpoint Security Controls
- Endpoint security controls
- Device hardening
- Patching
- Security settings
- Mandatory access controls (MAC)
- Secure boot
- Hardware encryption
- Endpoint protections
- Logging and monitoring
- Resiliency
Cloud Technologies
- Cloud technologies
- Business continuity and disaster recovery
- Cloud encryption
- Serverless computing
- Software-defined networking (SDN)
- Log collection and analysis
- Cloud application security broker
- Cloud misconfigurations
Operational Technologies
- Operational technologies
- Embedded systems
- ICS and SCADA
- ICS protocols
- Industries and sectors
Hashing and Symmetric Algorithms
- Hashing and symmetric algorithms
- Hashing
- Message authentication
- Symmetric algorithms
- Stream ciphers
- Block ciphers
Asymmetric Algorithms
- Asymmetric algorithms
- Using asymmetric algorithms
- SSL, TLS, and cipher suites
- S MIME and SSH
- EAP
- IPSec
- Elliptic curve cryptography (ECC)
- Forward secrecy
- Authenticated encryption with associated data (AEAD)
- Key stretching
Public Key Infrastructure
- Public key infrastructure
- PKI components
- Digital certificates
- Using digital certificates
- Trust models
- Certificate management
- Certificate validity - CRL and OCSP
- Protecting web traffic
- Troubleshooting certificates
- Troubleshooting keys
Data Considerations
- Data considerations
- Data security
- Data classification
- Data types
- Data retention
- Data destruction
- Data ownership
- Data sovereignty
Risk Management
- Risk management
- Risk strategies
- Risk management lifecycle
- Risk types
- Risk handling
- Risk tracking
- Risk assessment
- When risk management fails
Policies and Frameworks
- Policies and frameworks
- Policies
- Frameworks
- Regulations
- Standards
- Contracts and agreements
- Legal considerations
- Integrating industries
Business Continuity
- Business continuity
- Business continuity plan
- Business impact analysis
- Privacy impact analysis
- Incident response plan
- Testing plans
Risk Strategies
- Risk strategies
- Asset value
- Access control
- Aggregating risk
- Scenario planning
- Security controls
- Security solutions
- Cost of a data breach
Vendor Risk
- Vendor risk
- Business models
- Influences
- Organizational changes
- Shared responsibility model
- Viability and support
- Dependencies
- Considerations
- Supply chain