CAS-005 — CompTIA SecurityX Cheat Sheet

SecurityX questions often ask for the best control in context, not just a definition. Anchor each answer on:

SecurityX is an advanced security exam. Many questions are not asking, “What is this term?” They are asking, “Given this business constraint, threat, architecture, and operational reality, what is the best security decision?”

Your review should focus on:

• Architecture tradeoffs, not just tool names.
• Risk-based prioritization.
• Enterprise controls across identity, cloud, network, application, data, and operations.
• Secure implementation details.
• Governance, risk, and compliance reasoning.
• Incident response and resilience.
• Choosing the best answer when multiple options are technically valid.

Zero trust traps

Zero Trust Architecture

Zero trust assumes no implicit trust based solely on network location.

Zero Trust Principles

• Verify explicitly.
• Use least privilege.
• Assume breach.
• Continuously evaluate trust.
• Segment access to applications and workloads.
• Monitor behavior and posture.
• Apply policy consistently across users, devices, services, and data.

Zero Trust Control Map

Common Trap

A VPN alone is not zero trust. VPNs can provide encrypted connectivity, but zero trust requires explicit verification, least privilege, segmentation, and continuous evaluation.

Access models

Privileged access controls

Identity and Access Management

Identity is central to modern enterprise security. For advanced questions, expect identity to connect to cloud, remote work, privileged administration, SaaS, APIs, and zero trust.

Core Identity Concepts

Federation and Access Protocols

Identity Traps

• OAuth is not the same as authentication. OAuth delegates authorization; OpenID Connect adds authentication.
• SSO is not automatically safer. It centralizes risk; protect the identity provider with MFA, monitoring, conditional access, and strong recovery controls.
• MFA quality matters. Phishing-resistant MFA is stronger than SMS-based MFA.
• Privileged access is not only about admins. Service accounts, CI/CD runners, API keys, and cloud roles can be privileged.
• Least privilege requires lifecycle management. Access reviews, recertification, role mining, and deprovisioning matter.

PKI terms that matter

Crypto traps

Cryptographic Use Cases

PKI Components

TLS Review

Know the purpose of:

• Server authentication.
• Optional mutual TLS.
• Certificate chain validation.
• Cipher suite selection.
• Forward secrecy.
• Certificate expiration and renewal.
• Revocation checking.
• Secure protocol versions and configurations.

Crypto Traps

• Do not choose custom cryptography.
• Do not choose deprecated or weak algorithms when modern alternatives are available.
• Encryption does not provide integrity unless the mode or construction supports it.
• Hashing is not encryption.
• Encoding is not encryption.
• Key rotation must be planned with availability and data access in mind.
• Losing encryption keys can mean losing the data.

Cloud control selection

Container and Kubernetes security

Example concept: default deny plus explicit allow.

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-then-allow-api
spec:
  podSelector:
    matchLabels:
      app: api
  policyTypes:
    - Ingress
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app: web
      ports:
        - protocol: TCP
          port: 8443

Key interpretation: only selected web pods can reach selected api pods on TCP 8443; other ingress to those API pods is denied if policy is enforced by the CNI.

Cloud Security

Cloud questions often test whether you understand responsibility boundaries, identity, automation, logging, and secure architecture.

Shared Responsibility Review

Exact responsibility depends on service model and contract. IaaS gives the customer more operational responsibility than PaaS or SaaS.

IaaS, PaaS, SaaS Decision Points

Cloud Security Controls

Cloud Traps

• Public object storage exposure is usually a configuration and governance failure.
• Long-lived access keys are riskier than short-lived federated credentials.
• Cloud encryption is incomplete without access control and key governance.
• Security groups, NACLs, and routing controls operate differently; do not assume one replaces all others.
• Multi-cloud increases complexity; standardize identity, logging, policy, and tagging.

Container Security Checklist

Kubernetes Traps

• Do not run containers as root unless explicitly required and justified.
• Do not grant broad cluster-admin rights to applications.
• Kubernetes secrets are not automatically equivalent to full enterprise secrets management.
• Image scanning is not enough; runtime behavior still matters.
• Admission control can prevent risky deployments before they run.

OT/ICS security cues

Segmentation Choices

Perimeter and Edge Controls

Secure Network Services

Candidate Traps

• A firewall rule does not replace identity governance.
• Network segmentation does not remove the need for endpoint controls.
• IDS alerts are not prevention unless paired with blocking or response workflows.
• Exposing management interfaces to the internet is rarely acceptable.
• “Encrypt the traffic” does not fix excessive authorization.

OT/ICS Priorities

OT/IoT Traps

• Traditional vulnerability scanning can disrupt fragile systems.
• Patching may require vendor validation and maintenance windows.
• Default credentials and exposed management interfaces are common IoT risks.
• Network isolation is often essential because device-level controls may be limited.

Secure SDLC gates

Threat modeling quick map

API and application security cues

Secure SDLC Controls

Testing Types

API Security Review

Common Application Traps

• Authentication success does not prove authorization is correct.
• WAFs help, but they do not replace secure code.
• SAST may miss runtime configuration issues.
• DAST may miss unreachable code paths.
• SCA identifies dependency risk but does not always prove exploitability in your environment.
• Secrets in source control require rotation, not just deletion from the latest commit.

Threat Modeling

Threat modeling helps identify design flaws before deployment.

STRIDE Review

Threat Modeling Traps

• Threat modeling is most valuable early in design, not only after production deployment.
• A data flow diagram helps identify trust boundaries.
• Mitigations should map to specific threats.
• Business logic flaws may not be found by simple vulnerability scanning.

Infrastructure as Code Security

CI/CD Security

DevSecOps Trap

“Shift left” does not mean runtime security disappears. Strong programs combine early testing, secure pipelines, runtime monitoring, and rapid feedback.

Incident response workflow

    flowchart TD
	    A[Alert or report] --> B{Validate?}
	    B -- False positive --> C[Document and tune]
	    B -- True incident --> D[Classify severity and scope]
	    D --> E[Preserve evidence]
	    E --> F{Active threat?}
	    F -- Yes --> G[Contain: isolate, block, disable, revoke]
	    F -- No --> H[Investigate root cause]
	    G --> H
	    H --> I[Eradicate: remove malware, patch, rotate secrets]
	    I --> J[Recover and monitor]
	    J --> K[Lessons learned and control improvements]

Incident phase decision table

Containment choices

Forensics quick reference

Detection and Response Tooling

Log Sources to Remember

• Identity provider events.
• Endpoint telemetry.
• Network flow logs.
• DNS logs.
• Firewall and proxy logs.
• Cloud control plane logs.
• SaaS audit logs.
• Application logs.
• Database activity logs.
• EDR/XDR alerts.
• Email security events.
• CI/CD and code repository events.

Incident Response Process

Evidence Handling

For forensic scenarios, preserve:

• Chain of custody.
• Time synchronization.
• Original evidence integrity.
• Volatile data when appropriate.
• Disk/memory images when needed.
• Logs before retention windows expire.
• Documented actions and timestamps.

IR Traps

• Do not wipe a system before collecting required evidence if forensic investigation is needed.
• Do not restore from backup without removing the root cause.
• Do not notify externally before following the incident communication plan, unless the scenario clearly requires it.
• Containment should be proportional; disconnecting critical systems may create business harm.
• Lessons learned should produce control improvements, not only a report.

Generic Sigma-style detection example

title: Suspicious Encoded PowerShell
status: experimental
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    Image|endswith: '\powershell.exe'
    CommandLine|contains:
      - '-enc'
      - '-encodedcommand'
  condition: selection
fields:
  - Image
  - ParentImage
  - CommandLine
  - User
  - Hostname
level: high

Exam interpretation: encoded PowerShell is suspicious, but triage should confirm parent process, user context, script content, endpoint history, and business justification.

Prioritization factors

Do not prioritize by scanner score alone. Consider:

• Internet exposure
• Known exploitation
• Asset criticality
• Data sensitivity
• Compensating controls
• Ease and reliability of exploit
• Business impact of patching
• Availability of mitigation
• Regulatory or contractual commitments
• Whether the weakness enables privilege escalation or lateral movement

Risk Terms

Risk Treatment Options

Quantitative Risk Formulas

Use these when a question provides numerical values.

Where:

• SLE = single loss expectancy.
• ARO = annualized rate of occurrence.
• ALE = annualized loss expectancy.

Governance Artifacts

GRC Traps

• A policy without enforcement, ownership, and evidence is weak.
• Accepting risk should be formal and authorized, not informal.
• Compliance does not guarantee security.
• Security does not automatically prove compliance.
• Metrics should support decisions, not just report activity.
• Third-party risk continues after contract signing; monitoring and reassessment matter.

Key Terms

Availability and Recovery Choices

Backup Types

Continuity Trap

A backup is not a disaster recovery strategy by itself. The exam may expect tested restoration, defined RTO/RPO, alternate processing, dependency mapping, communications, and business ownership.

Common Candidate Mistake

Do not automatically choose the most expensive or most advanced technology. The exam often rewards the control that best satisfies the stated requirement with the least unnecessary complexity.

Example:

• If the problem is excessive standing administrator access, privileged access management with just-in-time access is usually stronger than simply adding another password policy.
• If the problem is untrusted east-west traffic, microsegmentation and workload identity are often better than only hardening the perimeter firewall.
• If the problem is lack of evidence for compliance, logging, control mapping, attestation, and repeatable reporting may matter more than buying a new prevention tool.

Data Protection Methods

Data Classification Decision Rule

If the question asks what to do first before applying data protection controls, the answer is often to identify, classify, and assign ownership. You cannot consistently protect data you have not inventoried or classified.

Assessment Types

Remediation Choices

Trap

A penetration test finding is not “fixed” when the report is delivered. Closure requires remediation, validation, tracking, ownership, and sometimes control redesign.

Security Objective Recognition

Architecture Pattern Recognition