CertificationsCompTIA SecurityX CAS-005Labs
CompTIA SecurityX CAS-005 hands-on labs
Engineering judgement under pressure: containment, triage, risk rating and the compensating control that holds.
39 labs you run in the browser: 6 guided, 18 assisted, 14 challenge, 1 capstone. About 6 hours of authored lab time. This set has no free taster yet; the free tier still carries the lessons and practice questions.
39
labs
6
guided
steps in order
15
goal only
challenge and capstone
0
free tasters
none in this set
What you practise
Exam facts and study plan- SIEM queue· you click20 labs
- Risk register and control sheets· you click19 labs
Every lab in this set
Title, scenario summary, skills and tool. The steps and the write-up stay in the app.
Forty handhelds, one name
ProGuided · Quick · 6 min · Risk register and control sheets
Every warehouse handheld signs in with the same store account, chosen years ago so pickers would not queue at a locker. Forty devices share one name…
shared credentialsattributiondevice identityaccess architecture
Payroll in the flood plain
ProGuided · Quick · 6 min · Risk register and control sheets
The payroll batch runs on one server in a data hall two miles from the river. The hall has flooded twice in thirty years and each return took nine days. Payroll closes on the twenty fifth…
risk ratingrisk transferbusiness continuitycontrol mapping
The contractor who still holds the console
ProGuided · Quick · 6 min · Risk register and control sheets
The contractor who rebuilt the payment gateway finished in October. Her account still holds the gateway administrator role, the password has not changed since August…
access reviewjoiner mover leaverrisk ratingpreventive control
The transfer that the calendar already knew about
ProGuided · Quick · 6 min · SIEM queue
The detection for large outbound transfers fired at 01:20 on the clinical image store, which pushed one hundred and eighty gigabytes to an address in the disaster recovery range…
false positivechange recordrule tuningcontainment restraint
A server nobody can patch before the renewal
ProGuided · Quick · 7 min · Risk register and control sheets
The warehouse shift scheduler runs on an operating system the vendor stopped supporting in March. The replacement lands in nine months. A stopped shift costs a full day of dispatch…
risk ratingcompensating controlrisk registertreatment decision
The batch account that signed in at a desk
ProGuided · Quick · 7 min · SIEM queue
The batch account that moves payroll files signed in at 02:14 from the console of a finance workstation, which no service account should ever do…
valid account abusetriagecontainmenthost isolation
A ninety second call that reset a second factor
ProAssisted · Quick · 6 min · SIEM queue
At 21:03 the service desk took a call from a mobile number about a broken authenticator and reset the device after ninety two seconds…
service desk fraudsession takeovercontainment scopemailbox rule
One workstation, one lookalike domain
ProAssisted · Quick · 6 min · SIEM queue
At 03:41 one finance workstation asked the resolver for a domain registered three days ago, spelled with a zero where the letter belongs…
typosquattingcredential phishingtriageindicator blocking
The isolation from the night shift was for nothing
ProAssisted · Quick · 6 min · SIEM queue
At 02:40 the night shift isolated PAY-ROLL-02 after an unknown scheduled task started writing to the payroll database. Forensics finished at 09:15…
containmentrelease from isolationfalse positiveevidence review
A stick in the ward station at shift change
ProAssisted · Quick · 7 min · SIEM queue
A ward station mounted a personal USB stick at 06:52, seven minutes before the shift change handover. In nine minutes two point four gigabytes left the patient letters folder…
removable mediadata loss preventioninsider behaviourcontainment
An always on tunnel into the finance database
ProAssisted · Quick · 7 min · Risk register and control sheets
Branch laptops open a tunnel to head office the moment they are switched on and keep it open all day. Once the tunnel is up, the laptop can reach every server on the core subnet…
zero trustleast privilege accessdevice postureaccess architecture
Forty pushes before breakfast
ProAssisted · Quick · 7 min · SIEM queue
The approver who releases payment runs got forty push prompts in four minutes at six in the morning. At 06:06 one was approved, from an address in a region the company does not operate in…
MFA fatigueidentity containmentsession tokenstriage
One sign in path that skips the second factor
ProAssisted · Quick · 7 min · Risk register and control sheets
The finance portal asks for a password and nothing else whenever people arrive through the desktop client. That client is a vendor plugin that cannot draw a second prompt…
zero trustpolicy exemptionidentity proxyrisk register
Six years of chat nobody meant to keep
ProAssisted · Quick · 7 min · Risk register and control sheets
The support platform arrived with chat archiving switched on and no expiry date. Six years later the archive holds forty one thousand customer conversations…
retention scheduledata minimisationrisk ratingtreatment decision
Staff pasting customer notes into a public model
ProAssisted · Quick · 7 min · Risk register and control sheets
Support agents use a public AI assistant to rewrite replies to customers. A review of 40 prompts from last month found 11 account numbers…
AI riskdata exposurepreventive controlrisk register
The catalogue went first
ProAssisted · Quick · 7 min · SIEM queue
At 02:14 the backup service account emptied the catalogue folder on the archive server, one thousand four hundred files in four minutes…
pre-encryption behaviourservice account misusescheduled taskcontainment
The print server calls a number nobody published
ProAssisted · Quick · 7 min · SIEM queue
The invoice print server has opened a session to the same external address at 01:10 for six nights running. The vendor publishes its update service on a different address…
peripheral hardeningfirmware trusttriagecontainment
The support account that woke up
ProAssisted · Quick · 7 min · SIEM queue
A vendor support account for the invoice platform signed in at 04:02, four hundred and eleven days after its last use…
dormant accountsvalid account abusetriagecontainment restraint
Three hundred candidate files in a personal drive
ProAssisted · Quick · 7 min · Risk register and control sheets
The hiring team keeps every application pack in a personal cloud drive so recruiters can open files from home. The folder holds three hundred CVs…
special category dataprivacy riskdata minimisationcontrol selection
Who carries the loss when the provider is breached
ProAssisted · Quick · 7 min · Risk register and control sheets
The customer portal runs on a managed provider who patches the servers, holds the database and answers the pager…
third party riskrisk treatmentcontractual controlassurance evidence
Three hundred tool calls from one ticket
ProAssisted · Quick · 8 min · SIEM queue
The support assistant answers tickets and can look up accounts through one approved tool. At 11:41 it made three hundred and twelve lookups from a single customer message…
prompt injectionAI guardrailsagent containmentmonitoring
Settle four register entries before the AI design board
ProAssisted · In-depth · 30 min · Risk register and control sheets
The architecture board signs off the assistant rollout at the end of the month and the register still holds four entries from the design review with no score and no response…
risk ratingrisk treatmentrisk registercontrol mapping
The queue alerted on the inventory agent and missed the beacon
ProAssisted · In-depth · 31 min · SIEM queue
The overnight queue holds three alerts and two of them are about things that are supposed to happen: an inventory agent that touches a directory every ten minutes and an approved…
alert tuningthreat huntinglow severity signalindicator blocking
Four alerts, one address worth blocking
ProAssisted · In-depth · 32 min · SIEM queue
The daytime queue holds four alerts and only two of them are about an intrusion. A backup that wrote far more than usual is a budget alert wearing a security label…
queue triagebaseline and approved activitydomain first seenegress blocking
Four pages that nobody wants to rebuild early
ProChallenge · Quick · 6 min · Risk register and control sheets
The careers microsite runs a content platform whose vendor stopped shipping fixes in January. The site holds four pages of job advertisements and one application form that posts to the…
end of life softwarerisk acceptancemonitoring controlvulnerability management
The VPN flaw that is being used this week
ProChallenge · Quick · 6 min · Risk register and control sheets
The remote access appliance that 2,400 staff use carries a critical flaw. The vendor says a patch lands in ten days, and the same flaw appears in the exploited list this morning…
vulnerability prioritisationcompensating controlactive exploitationrisk treatment
A build runner that bills by the minute and never stops
ProChallenge · Quick · 7 min · SIEM queue
Runner CIRUN-04 has held every core at full load for nine hours, and the cloud bill for the pool is up four hundred pounds this week…
build pipeline abusebeacon patterncontainmentunapproved image
The analyser the vendor will not update
ProChallenge · Quick · 7 min · Risk register and control sheets
A bench analyser runs the only build its instrument software supports, and the vendor stopped shipping security updates for that build in the spring…
risk acceptancecompensating controlend of life systemrisk ownership
The endpoint that stopped reporting
ProChallenge · Quick · 7 min · SIEM queue
The coverage board shows one billing workstation dark for six hours. The agent service was stopped by an interactive command at 03:12. Four minutes later a new service appeared…
monitoring coveragesilent endpointservice creationhost containment
The key in a configuration nobody owns
ProChallenge · Quick · 7 min · Risk register and control sheets
An invoice matching service stopped at the end of the supplier contract in August. The service is gone, the supplier is gone…
machine credentialssecret lifecycledecommissioningrisk treatment
The model makes the call, the contract carries the cost
ProChallenge · Quick · 7 min · Risk register and control sheets
The claims director signed a schedule that lets a vendor model sort incoming motor claims before a handler sees them…
third party riskrisk transferAI riskcontract clause
The order text that carries a card number
ProChallenge · Quick · 7 min · Risk register and control sheets
Marketing bought a self serve text message platform on a card and wrote the copy for an order ready notice…
data minimisationthird party riskrisk avoidancecard data
The scanner that stopped learning
ProChallenge · Quick · 7 min · Risk register and control sheets
The quarterly report says ninety four percent of servers are free of known critical flaws, and the platform team repeats that number at every board meeting…
vulnerability managementscan coverageautomationrisk rating
Two hundred recordings in a free trial
ProChallenge · Quick · 7 min · Risk register and control sheets
A clinical team lead cleared a backlog by signing up for a free AI transcription service. Two hundred and forty consultation recordings went through it last month…
AI riskspecial category dataunsanctioned toolingrisk treatment
A laptop asking the same question every thirty seconds
ProChallenge · Quick · 8 min · SIEM queue
A lab laptop has asked the internal resolver for text records from one domain every thirty seconds since ten last night…
covert channelsDNS tunnellingbeacon intervalcontainment
Eleven days of a vendor tunnel
ProChallenge · Quick · 8 min · SIEM queue
A support tunnel for the document management vendor has been open for eleven days, though the contract allows four hours per month…
third party accessdata exfiltrationcontainmenttriage
Three point eight gigabytes before the last day
ProChallenge · Quick · 8 min · SIEM queue
A solutions engineer handed in her notice on Monday. On Tuesday afternoon her workstation read three point eight gigabytes from the proposals share and wrote it into a synced personal…
insider riskevidence preservationshared infrastructuredata loss prevention
Two alerts, one approved scan
ProChallenge · Quick · 8 min · SIEM queue
Two alerts landed on the overnight queue. The first says an internal host swept the database subnet just after one in the morning…
false positivetrue positivetriage disciplineindicator blocking
The playbook contained the mail relay and missed the endpoint
ProCapstone · In-depth · 34 min · SIEM queue
The overnight enrichment playbook matched a subject line against a campaign list at 02:09, isolated the inbound mail relay and blocked the address of the bulk provider that three business…
automation reviewalert triagefalse positivecontainment
Where to go next
Every certification with labsCAS-005 lab questions
There are 39 labs: 6 guided, 18 assisted, 14 challenge, 1 capstone. Together they carry about 6 hours of authored lab time, and none of them is a free taster yet.
Practise CAS-005 the way the exam asks
Open a guided lab first, then work the challenge set with the hints off. Every lab links back to the lesson it tests.
Free tier, no card. Pro starts with a 7-day trial; a card is required and you can cancel before day 7.