CASSPT study guide
CASSPT · Work through your exam, one topic at a time.
The CASSPT is a professional certification exam focused on security analysis and threat assessment practice. It is aimed at practitioners who already work with security operations, architecture, or risk functions and want a credential that tests applied judgement across the full security lifecycle rather than a single tool or vendor product. The exam is delivered as multiple choice and is organised around five domains: threat and vulnerability assessment, security architecture and design, implementation and operations, monitoring, detection, and incident response, and governance, risk, and compliance. Questions tend to test how you reason through a scenario - choosing a control, interpreting a finding, or deciding an escalation path - more than recall of definitions. The CASSPT study guide has 5 sections and about 1,753 words.
01Threat and Vulnerability Assessment
CASSPT candidates must show they can turn raw vulnerability data and threat intelligence into defensible risk decisions. The exam tests threat modeling, vulnerability discovery, validation, scoring, and prioritization in business context, not scanner operation alone.
358 words, about 2 min02Security Architecture and Design
The Security Architecture and Design domain tests whether you can place controls at the right trust boundaries and justify design decisions. Expect questions on defense in depth, least privilege, zero trust, segmentation, secure defaults, and fail-safe behavior.
342 words, about 2 min03Implementation and Operations
Implementation and Operations tests secure delivery and runtime hygiene: secure SDLC, CI/CD controls, infrastructure as code, secrets management, hardening, patching, and change management. The focus is on preventing drift and proving that controls operate in production.
359 words, about 2 min04Monitoring, Detection, and Incident Response
Monitoring, Detection, and Incident Response tests whether you can build useful telemetry, detect adversary behavior, triage alerts, and run a defensible incident lifecycle. Expect coverage of logging, SIEM, detection engineering, MITRE ATT&CK, containment, and evidence handling.
341 words, about 2 min05Governance, Risk, and Compliance
Governance, Risk, and Compliance tests whether you can connect security work to business risk, policy, and evidence. Expect questions on risk assessment, risk registers, frameworks, third-party risk, exceptions, data classification, and audit readiness.
353 words, about 2 min