CompTIA CASP+

CASP+ Domain #1: Security Architecture [2022 update]

March 7, 2022 by Greg Belding

Are you an advanced-level security architect or senior security engineer and want to verify your high level of cyber security skills? Do you want to prove to hire organizations that you have the knowledge that is up to the task of leading and improving your organization’s cyber security readiness? If so, the CompTIA Advanced Security Practitioner, or CASP+, may be the certification for you. To earn the cert, you will first have to pass the certification exam covering four knowledge domains. 

What is CASP+?

CASP+ is an advanced-level cyber security certification that is intended for cyber security practitioners. Successful certification candidates will have the knowledge and skill required to:

  • Architect, engineer, integrate, and implement secure solutions across complex environments to support a resilient enterprise
  • Use monitoring, detection, incident response, and automation to proactively support ongoing security operations in an enterprise environment
  • Apply security practices to cloud, on-premises, endpoint, and mobile infrastructure, while considering cryptographic technologies and techniques
  • Consider the impact of governance, risk, and compliance requirements throughout the enterprise

What has changed since the last CASP+ exam version?

The latest CASP+ exam version is CAS-004, and much has changed since CAS-003. The CASP+ certification exam has dropped a Domain (down to four), and all Domain names and respective percentages of exam material have all changed. Below is a comparison:

CAS-004 Exam Domains CAS-003 Exam Domains
1.0 Security Architecture (29%) 1.0 Risk Management (19%)
2.0 Security Operations (30%) 2.0 Enterprise Security Architecture (25%)
3.0 Security Engineering and Cryptography (26%) 3.0 Enterprise Security Operations (20%)
4.0 Governance, Risk and Compliance (15%) 4.0 Technical Integration of Enterprise Security (23%)
5.0 Research, Development, and Collaboration (13%)

 CASP+ Domain 1: Security Architecture

Below is the material covered by Domain 1 of the CASP+ certification exam.

1.1 Given a scenario, analyze the security requirements and objectives to ensure an appropriate, secure network architecture for a new or existing network

1. Services

  • Load balancer
  • Intrusion detection system (IDS)/Network intrusion detection system (NIDS)/Wireless intrusion detection system (WIDS)
  • Intrusion prevention system (IPS)/Network intrusion prevention system (NIPS)/Wireless intrusion prevention system (WIPS)
  • Web application firewall (WAF)
  • Network access control (NAC)
  • Virtual private network (VPN)
  • Domain Name System Security Extensions (DNSSEC)
  • Firewall/unified threat management (UTM)/next-generation firewall (NGFW)
  • Network address translation (NAT) gateway
  • Internet gateway
  • Forward/transparent proxy
  • Reverse proxy
  • Distributed denial-of-service (DDoS) Protection
  • Routers
  • Mail security
  • Application programming interface (API) gateway/Extensible Markup Language (XML) gateway
  • Traffic mirroring
    • Switched port analyzer (SPAN) ports
    • Port mirroring
    • Virtual private cloud (VPC)
    • Network tap
  • Sensors
    • Security information and event management (SIEM)
    • File integrity monitoring (FIM)
    • Simple Network Management Protocol (SNMP) traps
    • NetFlow
    • Data loss prevention (DLP)
    • Antivirus

 2. Segmentation

  •       Microsegmentation
  •       Local area network (LAN)/virtual local area network (VLAN)
  •       Jump box
  •       Screened subnet
  •       Data zones
  •       Staging environments
  •       Guest environments
  •       VPC/virtual network (VNET)
  •       Availability Zone
  •       NAC lists
  •       Policies/security groups
  •       Regions
  •       Access control lists (ACLs)
  •       Peer-to-peer
  •       Air gap

3. Deperimeterization/zero trust

  • Cloud
  • Remote work
  • Mobile
  • Outsourcing and contracting
  • Wireless/radio frequency (RF) networks

4. Merging of networks from various organizations

  • Peering
  • Cloud to on-premises
  • Data sensitivity levels
  • Mergers and acquisitions
  • Cross-domain
  • Federation
  • Directory services

5. Software-defined networking (SDN)

  • Open SDN
  • Hybrid SDN
  • SDN overlay

1.2 Given a scenario, analyze the organizational requirements to determine the proper infrastructure security design

1. Scalability

  • Vertically
  • Horizontally

2. Resiliency

  • High availability
  • Diversity/heterogeneity
  • Course of action orchestration
  • Distributed allocation
  • Redundancy
  • Replication
  • Clustering

3. Automation

  • Autoscaling
  • Security Orchestration, Automation, and Response (SOAR)
  • Bootstrapping

4. Performance

5. Containerization

6. Virtualization

7. Content Delivery network

8. Caching

1.3 Given a scenario, integrate software applications securely into an enterprise architecture

  1. Baseline and templates
  • Secure design patterns/types of web technologies
    • Storage design patterns
  • Container APIs
  • Secure coding standards
  • Application vetting processes
  • API management
  • Middleware

3. Software assurance

  • Sandboxing/development environment
  • Validating third-party libraries
  • Defined DevOps pipeline
  • Code signing
  • Interactive application security testing (IAST) vs. dynamic application security testing (DAST) vs. static application testing (SAST)

4. Considerations of integrating enterprise applications

  • Customer relationship management (CRM)
  • Enterprise resource planning (ERP)
  • Configuration management database (CMDB)
  • Content management system (CMS)
  • Integration enablers

 5. Integrating security into development life cycle

  •       Formal methods
  •       Requirements
  •       Fielding
  •       Insertions and upgrades
  •       Disposal and reuse
  •       Testing
  •       Development approaches
  •       Best practices

1.4 Given a scenario, implement data security techniques for securing enterprise architecture

1. Data loss prevention

  • Blocking use of external media
  • Print blocking
  • Remote Desktop Protocol (RDP) blocking
  • Clipboard privacy controls
  • Restricted virtual desktop infrastructure (VDI) implementation
  • Data classification blocking

2. Data loss detection

  • Watermarking
  • Digital rights management (DRM)
  • Network traffic analysis

3. Data classification, labeling, and tagging

4. Obfuscation

5. Anonymization

6. Encrypted vs. unencrypted

7. Data life cycle

8. Data inventory and mapping

9. Data integrity management

10. Data storage, backup, and recovery

1.5 Given a scenario, analyze the security requirements and objectives to provide the appropriate authentication and authorization controls

  1. Credential management
  2. Password policies
  3. Federation
  4. Access control
  5. Protocols
  6. Multifactor authentication (MFA)
  7. One-time password (OTP)
  8. Hardware root of trust
  9. Single Sign-on (SSO)
  10. JavaScript Object Notation (JSON) web token (JWT)
  11. Attestation and identity proofing

1.6 Given a set of requirements, implement secure cloud and virtualization solutions

  1. Virtualization strategies
  2. Provisioning and deprovisioning
  3. Middleware
  4. Metadata and tags
  5. Deployment models and considerations
  6. Hosting models
  7. Service models
  8. Cloud provider limitations
  9. Extending appropriate on-premises controls
  10. Storage models

1.7 Explain how cryptography and public key infrastructure (PKI) support security objectives and requirements

  1. Privacy and confidentiality requirements
  2. Integrity requirements
  3. Non-repudiation
  4. Compliance and policy requirements
  5. Common cryptography use cases
  6. Common PKI use cases

1.8 Explain the impact of emerging technologies on enterprise security and privacy

  1. Artificial intelligence
  2. Machine learning
  3. Quantum computing
  4. Blockchain
  5. Homomorphic encryption
  6. Security multiparty computation
  7. Distributed consensus
  8. Big Data
  9. Virtual/augmented reality
  10. 3-D printing
  11. Passwordless authentication
  12. Nanotechnology
  13. Deep learning
  14. Biometric impersonation

CASP+ Domain 1

CASP+ is an advanced-level security architecture and senior security engineering cybersecurity certification. To earn this certification, you will have to pass the CASP+ certification exam that covers four Domains of knowledge. Use this article to help you map out your study outline for Domain 1, and you will have a solid start toward passing this certification exam and earning the CASP+ cert for yourself.

 

Sources

CASP C00-4 Exam Objectives, CompTIA

 CASP+ Certification! 003 vs. 004, Cyberkrafttraining

Posted: March 7, 2022
Author
Greg Belding
View Profile

Greg is a Veteran IT Professional working in the Healthcare field. He enjoys Information Security, creating Information Defensive Strategy, and writing – both as a Cybersecurity Blogger as well as for fun.

Leave a Reply

Your email address will not be published.