CASP+: overview of domains [updated 2022]

The CASP+ is for security architects tasked with identifying cyber risk and mitigating it across an enterprise network or senior security engineers who work to build and maintain a safe system against cyberattacks. 

This master-level credential can validate a professional's advanced IT security behavioral analytics skills, which can greatly value an employer looking to hire the right resource. So, whether you are an IT security professional or cyber risk analyst who wants to advance their career, or a security expert tasked with leading the team of professionals working on improving an organization's cybersecurity readiness, the CompTIA Advanced Security Practitioner (CASP+) certification provides a way to work in one of the fastest-growing fields in the U.S. 

Earn your CASP+, guaranteed!

Enroll in a CompTIA CASP+ boot camp and earn one of the industry’s most respected certifications — guaranteed.

Get Pricing

About the CASP+ credential

CASP+ is a great option for senior-level professionals who effectively lead and manage their organization's overall cybersecurity resilience against attacks but still want to be fully immersed in all technical aspects of their profession. It is the "only hands-on, performance-based certification for advanced practitioners — not managers — at the advanced skill level of cybersecurity," says CompTIA.

This credential is accredited by ANSI and compliant with the ISO 17024 standard. It also meets the requirements for DoD directive 8140/8570.01-M; in fact, it is listed as a possible choice for IAT Level III, IAM Level II, as well as IASAE I and II. This means CASP+ has been approved as one of the IA baseline certifications for the workforce.

The CASP+ exam is also internationally regarded as a validation of advanced-level cyber security skills and practical knowledge. It will certify that the successful candidate can stay up to date on new technology, assess cyber readiness, and design and implement appropriate solutions against the newest attacks.

This vendor-neutral credential is aimed at pros who have the essential skillset acquired through hands-on experience and working knowledge tied to implementing solutions with analytics tools. Credential holders must be familiar with analyzing risk impact and responding to security events within cybersecurity policies and frameworks.

CASP+ exam details

Number of questions: Maximum of 90 questions

Type of questions: Multiple-choice and performance-based

Length of test: 165 minutes

Passing score: Pass/fail only. No scaled score.

Price: $4​66 

Note: the new CASP+ (CAS-004) exam launched Oct. 6, 2021. The next version is expected in three years, as the certification undergoes regular reviews and updates to its exam objectives.

What's new in this version of CASP+?

Patrick Lane, Director of Products at CompTIA, says, "the popular certification is getting an overhaul heading into 2022 to ensure it validates the most relevant and in-demand skills — from security architecture and operations to engineering and governance."

The CASP+ Certification Exam Objectives (Number: CAS-004) will certify if candidates have the knowledge and skills required to:

• Architect, engineer, integrate and implement secure solutions across complex environments to support a resilient enterprise
• Use monitoring, detection, incident response and automation to proactively support ongoing security operations in an enterprise environment
• Apply security practices to cloud, on-premises, endpoint and mobile infrastructure, while considering cryptographic technologies and techniques
• Consider the impact of governance, risk and compliance requirements throughout the enterprise

CAS-003 CAS-004

Enterprise Security Architecture — 25% Security Architecture — 29%

Enterprise Security Operations — 20% Security Operations — 30%

Technical Integration of Enterprise Security— 23% Security Engineering and Cryptography — 26%

Risk Management — 19% Governance, Risk and Compliance — 15%

Research, Development and Collaboration — 13% Redistributed across domains as needed

CASP+ (CAS-004) has 28 exam objectives versus the 19 in CAS-003.

"The reorganization of the exam domains results in 80% of the topics being similar to the previous version and 20% of them getting updated." Here are some of the changes from CAS-003 to CAS-004, as released by CompTIA's Patrick Lane: 

• Security architecture: expanded coverage to analyze security requirements in hybrid networks to work toward an enterprise-wide, zero-trust security architecture with advanced, secure cloud and virtualization solutions
• Security operations: expanded emphasis on newer techniques addressing advanced threat management, vulnerability management, risk mitigation, incident response tactics and digital forensics analysis
• Security engineering and cryptography: expanded to focus on advanced cybersecurity configurations for endpoint security controls, enterprise mobility, cloud/hybrid environments and enterprise-wide PKI and cryptographic solutions
• Governance, risk and compliance: expanded to support advanced techniques to prove an organization's overall cybersecurity resilience metric and compliance to regulations, such as CMMC, PCI-DSS, SOX, HIPAA, FISMA, NIST and CCPA

CASP+ domains: The areas measured by this examination

The latest CASP+ exam objectives reflect the newest advances in cybersecurity architecture and engineering. There is also a much-needed focus on hot topics like governance and compliance.

Now it's time to know the specific domains and 28 exam objectives that will appear on the CASP+ CAS-004 test.

Security Architecture

• Analyze the security requirements and objectives to ensure an appropriate, secure network architecture for a new or existing network
• Analyze the organizational requirements to determine the proper infrastructure security design
• Integrate software applications securely into an enterprise architecture
• Implement data security techniques for securing enterprise architecture
• Analyze the security requirements and objectives to provide the appropriate authentication and authorization controls
• Implement secure cloud and virtualization solutions
• Explain how cryptography and public key infrastructure (PKI) support security objectives and requirements
• Explain the impact of emerging technologies on enterprise security and privacy

Security Operations

• Perform threat management activities
• Analyze indicators of compromise and formulate an appropriate response
• Perform vulnerability management activities
• Use the appropriate vulnerability assessment and penetration testing methods and tools
• Analyze vulnerabilities and recommend risk mitigations
• Use processes to reduce risk
• Implement the appropriate response
• Explain the importance of forensic concepts
• Use forensic analysis tools

Security Engineering and Cryptography

• Apply secure configurations to enterprise mobility
• Configure and implement endpoint security controls
• Explain security considerations impacting specific sectors and operational technologies
• Explain how cloud technology adoption impacts organizational security
• Implement the appropriate PKI solution
• Implement the appropriate cryptographic protocols and algorithms
• Troubleshoot issues with cryptographic implementations

Governance, Risk, and Compliance

• Given a set of requirements, apply the appropriate risk strategies
• Explain the importance of managing and mitigating vendor risk
• Explain compliance frameworks and legal considerations, and their organizational impact
• Explain the importance of business continuity and disaster recovery concepts

Note: a complete breakdown of these specific areas is mentioned in the CASP+ Certification Exam Objectives.

CASP+ exam qualifications: What candidates must meet to be eligible

Let's take a look at what qualifications are needed to be eligible to sit in for the CASP+ exam:

• A minimum of 10 years of general hands-on IT experience, with at least five of those years being broad hands-on IT security experience
• The following recommended prerequisites: Network+, Security+, CySA+, Cloud+, and PenTest+ or equivalent certifications/knowledge

Note: CompTIA's Continuing Education (CE) program allows you to extend your certification in three-year intervals through activities and training related to your certification's content. To renew your CASP+ certification, collect at least 75 Continuing Education Units (CEUs) in three years and upload them to your certification account.

How do I prepare for the CASP+ test?

Passing the CASP+ exam is not impossible, but preparation is key, as this is an expert-level exam. Professionals preparing for the test might now consider The Official CompTIA CASP+ Self-Paced Study Guide, as the newly updated Fourth Edition of CASP+ CompTIA Advanced Security Practitioner Study Guide Exam CAS-004 is not currently available; the book is set to be released on April 26, 2022.

In addition, to succeed on the new CAS-004 exam, you may consider CompTIA's certification training companion tools designed to check knowledge, practice skills and explore the topics across all exam objectives. View the store's product options to see what best suits your needs.

You can also peruse the many online options from reputable third-party training providers who may offer boot camp-style courses for the candidates aspiring to pass this examination. 

Online testing is available by Pearson OnVUE, a remote exam proctoring service that provides a secure and easy way to complete exams. Once ready, students can register for and schedule their test on the Pearson VUE website. Note that canceling or rescheduling an exam less than 24 hours is subject to a same-day forfeit exam fee."

Earn your CASP+, guaranteed!

Enroll in a CompTIA CASP+ boot camp and earn one of the industry’s most respected certifications — guaranteed.

Get Pricing

Understanding CompTIA's CASP+ 

Certifications can bring benefits for both the company and the employees. In particular, the CompTIA's CASP+ is one of the industry's most respected certifications and one of the few options that advanced-level professionals who are not in managerial roles have to certify their skills properly. This is possible, thanks to the test that has a strong focus on performance and scenario simulations.

Professionals who earn the CASP+ certification can apply for many IT security jobs, including security engineer positions or cybersecurity architect roles, which are growing in demand across the globe.

Becoming CASP+ certified can provide a means to demonstrate competencies in all technical aspects of an organization's IT security planning and cyber readiness. It also offers a positive outlook for job prospects with competitive salaries from organizations eager to hire certified individuals with mastery-level skills, such as a security architect, engineer, analyst or SOC manager.

 

Sources:

• CASP+, CompTIA
• Sneak Peek Webinar, CompTIA Instructor Network
• New CASP+ Certification…, CompTIA
• CompTIA Certification Testing, Pearson VUE
• Earn Continuing Education Units (CEUs), CompTIA
• CASP+ 003 vs. 004: What’s the Difference?, CompTIA
• CASP+ Certification Exam Objectives (Number: CAS-004), CompTIA
• What Jobs Can I Get with CASP+ Certification?, CompTIA
• CASP+: Validating Cybersecurity Skills for Government and Corporate Teams, CompTIA