CompTIA Advanced Security Practitioner (CASP+) 003 vs. 004: What’s the Difference?

IT certifications show employers that candidates have the knowledge and skills they need to do the job, and they help IT pros advance their careers. As cybersecurity has become a critical function, cybersecurity certifications are among the most popular IT certifications globally.

The CompTIA Advanced Security Practitioner (CASP+) certification is a vendor-neutral credential and internationally targeted validation of advanced-level cybersecurity skills and knowledge.

The security architect and senior security engineer skills covered by CASP+ help companies comply with regulations, such as PCI-DSS and NIST 800-53 Risk Management Framework (RMF), which require IT pros to identify and mitigate enterprise risk. CASP+ is approved under the Department of Defense (DoD) Directive 8140/8570.01-M and under ANSI/ISO standard 17024.

IT Jobs Related to CASP+

The latest version of CASP+ (CAS-004) launched in October 2021. CompTIA updates its certifications every three years so IT pro skills are relevant and up to date on the latest technologies.

When CompTIA updates exams, subject matter experts (SMEs) from the industry participate in workshops to write and review the content, ensuring the exam domains, objectives and questions validate the skills needed on the job today.

Cybersecurity experts from the following companies contributed to the update of the CASP+ exam:

• AT&T Cybersecurity
• Lockheed Martin
• ExxonMobil
• John Hopkins University Applied Physics Laboratory
• U.S. Navy Center for Information Dominance
• Target Corp.
• General Dynamics IT (GDIT)
• Tanium
• Ricoh
• Splunk
• SecureWorks
• aeSolutions Industrial Cybersecurity

Read more about the CompTIA exam development process.

Individuals who hold CASP+ have proven they can design and implement effective cybersecurity solutions on complex enterprise networks. This cybersecurity certification communicates the mastery-level skills of an enterprise-level security architect and senior security engineer. IT pros who pass the CASP+ performance exam can design, assess, mitigate and operate a secure enterprise network and lead the technical teams responsible for these tasks.

The primary job roles for CASP+ (CAS-004) are similar to those for CAS-003, as the core skills requirements for these jobs have not significantly changed over the past three years:

• Security architect
• Senior security engineer

As cybersecurity architecture job roles are tasked with identifying cyber risk and mitigating it across an enterprise network, the following job roles can also benefit from a CASP+ certification:  

• Security operations center (SOC) manager
• Security analyst
• IT cybersecurity specialist/INFOSEC specialist
• Cyber risk analyst

CASP+ CAS-003 vs. CAS-004

CompTIA is constantly reviewing the content of its certifications to ensure they address the latest technologies and meet the needs of the industry. The previous CASP+ exam objectives have been updated to be more reflective of cybersecurity architecture and engineering; endpoint security; governance, risk and compliance skills and how to assess an enterprise’s cybersecurity readiness. There’s also more focus on leading teams to design, troubleshoot and implement enterprise-wide cybersecurity solutions.  

CASP+ Exam Domains

The exam domains covered in CompTIA Advanced Security Practitioner (CAS-004) are not vastly different from those in CAS-003, as they are still relevant to current job roles, but you will see some slight changes.

The exam domains have been rearranged to cover four topics instead of five, as shown in the following table:

The reorganization of the exam domains results in 80% of the topics being similar to the previous version and 20% of them getting updated to include the following:

• Security Architecture: Expanded coverage to analyze security requirements in hybrid networks to work toward an enterprise-wide, zero-trust security architecture with advanced, secure cloud and virtualization solutions
• Security Operations: Expanded emphasis on newer techniques addressing advanced threat management, vulnerability management, risk mitigation, incident response tactics and digital forensics analysis
• Security Engineering and Cryptography: Expanded to focus on advanced cybersecurity configurations for endpoint security controls, enterprise mobility, cloud/hybrid environments and enterprise-wide PKI and cryptographic solutions
• Governance, Risk and Compliance: Expanded to support advanced techniques to prove an organization’s overall cybersecurity resiliency metric and compliance to regulations, such as CMMC, PCI-DSS, SOX, HIPAA, FISMA, NIST and CCPA

CASP+ Exam Objectives

The new CASP+ (CAS-004) includes more exam objectives. In fact, CAS-004 has 28 exam objectives versus the 19 in CAS-003. The purpose of this update is to break down the larger objectives found on CAS-003 into multiple objectives to improve instructional design.

The new exam objectives focus on the most up-to-date and current skills needed for the following tasks:

• Architect, engineer, integrate and implement secure solutions across complex environments to support a resilient enterprise
• Use monitoring, detection, incident response and automation to proactively support ongoing security operations in an enterprise environment
• Apply security practices to cloud, on-premises, endpoint and mobile infrastructure, while considering cryptographic technologies and techniques
• Consider the impact of governance, risk and compliance requirements throughout the enterprise

This is equivalent to at least 10 years of general hands-on IT experience, with at least 5 of those years being broad hands-on security experience. CASP+ is recommended to follow CompTIA Security+, CompTIA PenTest+ and CompTIA CySA+ on the CompTIA Cybersecurity Career Pathway.

As you use the exam objectives to prepare for your test, note that they are not exhaustive of everything you may be tested on. Consider the exam objectives stem (the heading) as your item to study and the bulleted lists as examples of some of the things that might be covered. CompTIA is constantly reviewing exam content and updating questions to ensure relevance and exam integrity.

How CASP+ Evolves with the Industry

In a field like cybersecurity, where the job is continually evolving, CompTIA exam domains need to reflect what’s happening in the industry right now. The following table explains why we updated the CASP+ exam domains and how they relate to current job requirements.

How to Train for CASP+

It may seem like CASP+ covers a lot of ground, but don’t worry, we’ve got your back. One major difference between CAS-003 and CAS-004 is the official training solutions available. For the first time, CASP+ (CAS-004) will have a full suite of training solutions available when the new exam launches.

Here are all the ways CompTIA helps you learn the material and get certified:

• The Official CompTIA Advanced Security Practitioner (CASP+) Study Guide: Available in hardcover and eBook
• CompTIA CertMaster Learn: Comprehensive eLearning with videos, flash cards, multiple-choice and performance-based questions and more
• CompTIA Labs: Virtual labs where you can learn and practice the hands-on skills related to CASP+
• Integrated Learn and Labs: Seamlessly gain the knowledge and then practice the hands-on skills by combining CertMaster Learn and CompTIA Labs
• CompTIA CertMaster Practice: Get exam ready with practice questions and practice tests that mimic the certification exam experience

CompTIA training solutions are designed to cover what you need to know for your CompTIA exam. No other content library covers all the exam objectives for all certifications. CompTIA training solutions help you prepare for your CompTIA certification exam with confidence.

Ready to get started? Download the exam objectives for CASP+ (CAS-004) to begin studying now.