Skip to content

CompTIA SecurityX (CAS-005) Study Plan

Six weeks at 6-8 hours a week for someone with solid security experience. Study against the CompTIA SecurityX page and its objectives summary, and confirm which exam version is current before you book.

Week 1: Governance, risk and compliance (Domain 1, 20%)

  • Read notes/01-governance-risk-and-compliance.md
  • Sort policy, standard, procedure and guideline examples
  • Do three SLE and ALE calculations and decide whether a control is worth buying
  • Apply STRIDE to a simple data flow diagram and map ATT&CK techniques to two threats

Week 2: Security architecture, cloud and network (Domain 2, 27%)

  • Read notes/02-security-architecture.md
  • Compare API-based and proxy-based CASB for three situations
  • Draw a segmented network with microsegmentation for east-west traffic
  • Explain SASE, SD-WAN and SDN in one sentence each

Week 3: Zero trust and boundaries (Domain 2)

  • Work through the implement zero trust project
  • Define subject-object relationships for three applications
  • List what attestation and data perimeters add

Week 4: Security engineering, automation and vulnerabilities (Domain 3, 31%)

  • Read notes/03-security-engineering.md
  • Read the Python and PowerShell examples and say what each does
  • Describe the vulnerability management cycle and what SCAP, CVE and CVSS each contribute
  • Rank four findings by risk, not only by score

Week 5: Cryptography and operations (Domains 3 and 4, 22%)

  • Read notes/04-security-operations.md
  • Choose cryptographic techniques for ten use cases
  • Explain harvest-now-decrypt-later and the PQC response
  • Read a Sigma rule and a YARA rule and say what each matches
  • Work through the cloud incident response tabletop

Week 6: Practice and review

Readiness check

You are ready when you can explain, without notes: API-based versus proxy-based CASB, microsegmentation versus segmentation, tokenization versus encryption, CVE versus CVSS, a hunt versus a triage, and why you would choose each cryptographic technique for a given use case.