CompTIA closed beta for CASP+ CAS-004

2021-05-13 10:33:00

CompTIA often have beta releases for new versions of their exams. You'll notice my blog has articles dating back a few years, where I keep doing these beta tests, "for fun and profit". Most betas are open to all takers, but the CASP+ (advanced security practitioner) is "closed". With thanks to some very nice people at CompTIA I managed to get accepted into the closed beta. 

Took the test this morning, at home via the OnVue testing solution. As before my experiences with OnVue were decent. 

However! In a not-so-fun move, PearsonVue decided to do a big and unannounced IAM change! Anyone who's testing via PearsonVue for CompTIA, whom also has tested for other companies (such as Microsoft) has now been forced to take a new username. They literally changed everybody's login names, without warning them up front. And no, you also don't get an email. Now they have a warning on their login page, but last night I got a big fright because there was zero information!

Here's a few things I took away from the CAS-004 beta.

• On MacOS the instruction on PBQs (performance based questions) to ctrl-click for multiple selections does not work. On MacOS that is a right-click. The usual replacement cmd-click also did not work. The proctor did not have a solution for me, so questions that require multiple selections on MacOS are an automatic (partial) fail.
• There was a post-exploit question about persistence where "the attacker got root on windows". That by and of itself is an error, but it muddied the whole question: should I look for Unix-based answers, or Windows? Because which part of the question was wrong? "root" or "windows"?
• There was a question about SSH access log analysis, which did not show the actual logging. There was a question, there was a bit of explanation, but the actual logs were not shown.
• Many questions were frustrating to parse: the language or formulation used, made it hard to piece together the situation / question. Some questions I had to reread five times.
• Many questions about vulnerabilities focus on "input validation" as the "correct, best solution". In many cases it is not. For SQLi, it's parametrized queries. For XXE, it's disabling unsafe features and settings like external entity parsing. 
• A good thing: no questions stood out as being out-dated. There's no antiquated stuff and plenty of cloud.

The exam gave me three hours time and took me between a bit less than two hours to power through without going back to any questions. There were plenty "bad" questions in there (see above) and a few where I honestly would not know the answer. Since this is a beta I decided to pludge it without studying any of the books or materials.

kilala.nl tags: studies,

View or add comments (curr. 0)