CompTIA SecurityX (ehemals CASP+) + IT-Projektmanagement + Microsoft Office 365

CompTIA SecurityX (ehemals CASP+ CompTIA Advanced Security Practitioner, neue Bezeichnung CAS-005 seit Dezember 2024) ist die Senior-Security-Architect-Zertifizierung von CompTIA — direkter Aufstieg von Security+ und CySA+. Themen SecurityX CAS-005: 1. Security Architecture (25-30%) — Resilient Network Architecture (Defense-in-Depth, Zero Trust mit Microsegmentation, Air-Gapped Networks, SDN/SD-WAN), Resilient System Architecture (Hardware Security mit TPM, Secure Boot, HSM, Software Security mit Memory Protection ASLR/DEP, Microservices-Architecture-Security), Resilient Data Architecture (Data-Loss-Prevention, Database Encryption, Tokenization, Masking). Hybrid und Cloud Architectures (Multi-Cloud-Security, CSPM, CWPP, CNAPP, SASE Secure Access Service Edge mit ZTNA, CASB, SWG, FWaaS). Application Architecture (Microservices vs. Monolith, Container-Security, API-Security mit OAuth/OIDC, GraphQL Security). 2. Security Engineering (25-30%) — Cryptographic Engineering (Algorithmic Choice, Key Management, PKI mit Cert-Authorities, Cert-Revocation OCSP/CRL), Post-Quantum Cryptography (NIST PQC Standards seit 2024 — CRYSTALS-Kyber für KEM, CRYSTALS-Dilithium für Signatures), Quantum Key Distribution. Secure Communications (TLS 1.3, IPsec mit IKEv2, modern VPN-Lösungen wie WireGuard, DNS over HTTPS DoH, DNS over TLS DoT). Identity Architecture (Federated Identity, OAuth 2.0/2.1 mit PKCE, OpenID Connect, SAML 2.0, FIDO2/WebAuthn als passwortlose Zukunft). Endpoint Security (EDR, XDR, BYOD-Management). 3. Security Operations (20-25%) — Threat Intelligence (Sources, MITRE ATT&CK, Threat Actor Profiles, IoCs vs. TTPs), Threat Hunting (Hypothesis-Driven, MITRE-Mapping), Incident Response (NIST CSF Lifecycle, Cyber Kill Chain, Diamond Model), Digital Forensics (Volatile vs. Non-Volatile Memory, Chain of Custody, Anti-Forensics). 4. Governance, Risk, and Compliance (20-25%) — Risk Management Frameworks (NIST RMF, ISO 31000, COSO ERM), Compliance Programs (PCI DSS, HIPAA, GDPR, SOX, FedRAMP, FISMA), Third-Party Risk Management (Vendor Risk Assessment, Supply Chain Security). Privacy (DSGVO, CCPA, China PIPL). Aktuelle Themen: AI/ML Security (Adversarial Attacks, Prompt Injection für LLMs, MITRE ATLAS), Cloud-Native Security (Kubernetes-Security mit OPA/Kyverno, Service Mesh mit Istio, Container-Runtime-Security mit Falco). Examen CAS-005: 90 Multiple-Choice + Performance-Based, 165 Min, Pass/Fail (CompTIA hat bei SecurityX keinen numerischen Pass-Score mehr). IT-Projektmanagement (1 Woche): PRINCE2 Foundation oder vergleichbare Methodik. Microsoft Office 365 (3 Wochen): Standard.