Preparing for the CompTIA Advanced Security Practitioner^™ Certification Exam

CASP Exam Overview

• Examination and certification goals
• The four domains of the exam

Enterprise Security Principles

Distinguishing cryptographic tools and techniques

• Deploying encryption and hashing
• Advanced PKI concepts
• Cryptographic algorithms and usage
• Transport encryption
• Digital signature

Virtual, distributed and shared computing

• Leveraging virtual servers and the cloud
• Securing virtual environments and equipment
• Assessing vulnerabilities associated with virtual computing
• Implementing secure elastic cloud computing
• Maintaining different classification levels

Securing enterprise storage

• Virtual storage
• NAS
• vSAN
• iSCSI
• FCoE
• Secure storage management
• Maintaining availability with redundancy

Protecting Your Hosts and Networks

Integrating hosts, networks and applications

• Advanced network design
• Complex network security solutions for data flow
• Documenting with a logical deployment diagram
• Advanced configuration of routers and switches
• Host security: firewalls, end-point security, host hardening

Enhancing application security

• Designing secure web applications
• Application sandboxing
• Secure coding standards
• Preventing attacks with proper error and exception handling
• Securing against privilege escalation and fuzzing
• Mitigating client-side vs. server-side vulnerabilities
• Identifying buffer overflows and memory leaks

Conducting assessments

• Determining the best security testing tools
• Port and vulnerability scanners
• Protocol analyzers
• Password crackers
• HTTP interceptor
• Testing methods: penetration testing, black box, code review, social engineering

Risk Management Policies and Procedures

Applying risk mitigation strategies and controls

• Analyzing risk scenarios
• Determining risks associated with evolving business strategies
• Assessing the CIA aggregate score
• Conducting system specific risk analysis
• Selecting security controls
• Continuous monitoring

Supporting incident response and recovery

• Constructing a data inventory with e-discovery
• Minimizing the severity of a data breach
• Responding to incidents and emergencies

Privacy policies and procedures

• Safeguarding Personally Identifiable Information (PII)
• Developing security policies to support business objectives
• Implementing policies designed to prevent fraud
• Preventing social engineering attacks

Research and Analysis

Examining industry trends

• Performing on-going research to support best practices
• Testing new security systems and services
• Assessing social media hazards

Countering new exploits and attack methods

• Preparing to defend against zero days
• Identifying emerging threat information

Integrating Computing, Communications and Business Disciplines

Establishing communication requirements

• Determining how information needs to be shared
• Securely collaborating multiple job roles
• Publishing security documentation

Maintaining security in organizational change

• Complying with rules, policies and regulations
• Minimizing third-party product risk
• Segmenting networks to separate traffic

Securing the technology life cycle

• Selecting security controls
• Implementing unified communication security
• Integrating security to the systems development life cycle